AAA in Fedora Infrastructure
summary
The Fedora Accounts System runs on RHEL6 EOL Nov 2020 and holds 60,000 accounts (roughly half actively used), backing ~500 servers and 30 web apps. Existing FAST is custom TurboGears1 code with past security failures (notably an ssh authorized_keys symlink vuln) and unmaintained auth. Migration uses incremental password sync into an IPA instance, a user-migration script, and a new self-service portal FreeIPA + securitas (Python/Flask, python-freeipa, epsilon OIDC) already proof-of-concept and functional for core workflows.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:01How FAS Works
- 4:20Why FAS was made
- 5:38Problems with FAS
- 6:58As a result...
- 9:11Requirements
- 10:33Amazon Cognito
- 16:26Are there any downsides?
- 18:09Self-service User Portal Goals
- 24:58Portal Stack
- 26:43Other Pieces
- 29:37Still up for discussion
- 30:46Acknowledgements
related talks
26mMigrating a Linux environment to IDM
48mFedora Automated Testing State of the Art: Not Quite CI for Distributions, but...
47m35 Fedora releases in 35 minutes: a look back with lessons for any project
13mTake The Scare Out of Using Fedora Rawhide
33mFIDO2 authentication for centrally managed users
01h 09m35 Fedora Releases in 30 Minutes (plus Q&A)
39mCI and automated testing in Fedora: where we're at
46mEnhancing the Fedora Upgrade Process