Deploying FreeIPA for Centralised Identity Management
Context
User and host identities were managed inconsistently across systems, with no single source of truth for accounts, groups, or DNS records tied to hosts.
Decision
Deploy FreeIPA as the central identity provider, integrating DNS and managing the full user/host lifecycle through it.
Alternatives Considered
Keep local accounts per system
Pros
- Simple for a small number of machines
Cons
- Does not scale, no central audit or revocation
Adopt a commercial IdP
Pros
- Vendor support, polished UI
Cons
- Licensing cost
- Less control over integration with existing DNS/Linux infrastructure
Reasoning
FreeIPA's tight integration with DNS and native Linux/Kerberos tooling fit the existing infrastructure without introducing a new dependency on external services, while still giving a single place to manage the account and host lifecycle.