Privacyidea Documentation Release 1.4
Total Page:16
File Type:pdf, Size:1020Kb
privacyIDEA Documentation Release 1.4 Cornelius Kölbel October 06, 2014 CONTENTS 1 Overview 3 2 Installation 5 2.1 Python package index..........................................5 2.2 Debian packages.............................................5 3 The ini file 9 3.1 Common config.............................................9 3.2 Audit...................................................9 3.3 Other paramters............................................. 10 3.4 Database connection........................................... 11 3.5 Logfiles.................................................. 11 4 Login to the Web UI 13 4.1 Login for normal users.......................................... 13 4.2 Login for administrators......................................... 13 5 Configuration 15 5.1 UserIdResolvers............................................. 15 5.2 Realms.................................................. 19 5.3 System config.............................................. 20 5.4 Token configuration........................................... 22 5.5 privacyIDEA setup tool......................................... 24 6 Tokenview 27 6.1 Functions for one token......................................... 27 6.2 Functions for multiple tokens...................................... 30 6.3 Columns................................................. 31 7 Userview 33 7.1 Enroll tokens............................................... 33 7.2 Assign tokens............................................... 33 8 Policies 35 8.1 Admin policies.............................................. 35 8.2 System policies.............................................. 39 8.3 Selfservice policies............................................ 40 8.4 Enrollment policies............................................ 44 8.5 Authentication policies.......................................... 46 8.6 Authorization policies.......................................... 48 8.7 Audit policies............................................... 49 i 8.8 Machine policies............................................. 49 8.9 OCRA policies.............................................. 50 8.10 Gettoken policies............................................. 51 9 Client machines 55 9.1 SSH.................................................... 55 9.2 LUKS................................................... 56 10 Audit 57 10.1 Cleaning up entries............................................ 57 11 Tools 59 11.1 Get Serial by OTP value......................................... 59 11.2 Copy token PIN............................................. 59 11.3 Check Policy............................................... 59 11.4 Export token information........................................ 60 11.5 Export audit information......................................... 60 12 Import 61 12.1 SafeNet XML.............................................. 61 12.2 OATH CSV................................................ 61 12.3 Yubikey CSV............................................... 62 13 The code documentaton 63 13.1 UserIdResolvers............................................. 63 13.2 Audit log................................................. 67 13.3 Controllers................................................ 68 13.4 library functions............................................. 95 14 Indices and tables 101 Python Module Index 103 Index 105 ii privacyIDEA Documentation, Release 1.4 The privacyIDEA documentation is work in progress. If you are missing any information or descriptions file an issue at github (which would be the preferred way), drop a note to info(@)privacyidea.org or go to the Google group. This will help us a lot to improve documentation to your needs. Thanks a lot! CONTENTS 1 privacyIDEA Documentation, Release 1.4 2 CONTENTS CHAPTER ONE OVERVIEW privacyIDEA is a system that is used to manage devices for two factor authentication. In the beginning there were OTP tokens, but other means to authenticate like SSH keys are added. Other concepts like handling of machines or enrolling certificates are coming up, you may monitor this development on Github. privacyIDEA is a web application written in Python based on the pylons framework. You can use any webserver with a wsgi interface to run privacyIDEA. E.g. this can be Apache, Nginx or the python paster. A device or item used to authenticate is still called a “token”. All token information in stored in an SQL database, while you may choose, which database you want to use. privacyIDEA uses SQLAlchemy to map the database to internal objects. Thus you may choose to run privacyIDEA with SQLite, MySQL, PostgreSQL, Oracle, DB2 or other database. privacyIDEA provides a Web API, which you can investigate at http://api.privacyidea.org/. Administrators can use a Web UI or a command line client to manage authentication devices. Users can login to a self service portal. Authentication is performed via the API or certain plugins for FreeRADIUS, simpleSAMLphp, Wordpress, Contao, Dokuwiki... to either provide default protocols like RADIUS or SAML or to integrate into applications directly. Due to this flexibility there are also many different ways to install and setup privacyIDEA. We will take a look at certain comman ways to setup privacyIDEA in the section Installation but there are still many others. 3 privacyIDEA Documentation, Release 1.4 4 Chapter 1. Overview CHAPTER TWO INSTALLATION 2.1 Python package index You can install privacyidea on usually any linux distribution in a pyhton virtual environment like this: virtualenv /opt/privacyidea cd /opt/privacyidea source bin/activate Now you are within the python virtual environment. Within the environment you can now run: pip install privacyidea pip install privacyideaadm Depending on the database you want to use, you may have to install additional packages. TODO: Configuration and setup with webserver 2.2 Debian packages There are ready made debian packages for Ubuntu 14.04 LTS. These are available in a public ppa repository, so that the installation will automatically resolve all dependencies. Install it like this: add-apt-repository ppa:privacyidea/privacyidea apt-get update apt-get install privacyidea privacyideaadm Optionally you can also install necessary configuration files to run privacyIDEA within the Nginx Webserver: apt-get install privacyidea-nginx 2.2.1 Appliance There is also the possibility to install privacyIDEA on an Ubuntu 14.04 system in an appliance like way: add-apt-repository ppa:privacyidea/privacyidea apt-get update apt-get install privacyidea-appliance privacyidea-radius which will setup a system containing everything. It also provides a tool to easily configure privacyIDEA, add admin- istrators and manage your RADIUS clients. 5 privacyIDEA Documentation, Release 1.4 To take closer look at this tool read privacyIDEA setup tool. 2.2.2 Application packages We also provide debian packages for certain applications. FreeRADIUS privacyIDEA has a perl module to “translate” RADIUS requests to requests to the privacyIDEA server. This module plugs into FreeRADIUS. The FreeRADIUS does not have to run on the same machine like privacyIDEA. To install this module: apt-get install privacyidea-radius If you are running your FreeRADIUS server on another distribution, you may download the module at 1. Then you need configure your FreeRADIUS site and the perl module. Note: The perl module is not thread safe, so you need to start FreeRADIUS with the -t switch. SimpleSAMLphp Starting with 1.4 privacyIDEA also supports SAML via a plugin for simpleSAMLphp 2. The simpleSAMLphp service does not need to run on the same machine like the privacyIDEA server. To install it on a Ubuntu 14.04 system please run: apt-get install privacyidea-simplesamlphp Follow the simpleSAMLphp instructions to configure your authsources.php. A usual configuration will look like this: ’example-privacyidea’ => array( ’privacyidea:privacyidea’, /* * The name of the privacyidea server and the protocol * A port can be added by a colon * Required. */ ’privacyideaserver’ => ’https://your.server.com’, /* * Check if the hostname matches the name in the certificate * Optional. */ ’sslverifyhost’ => False, /* * Check if the certificate is valid, signed by a trusted CA * Optional. */ ’sslverifypeer’ => False, 1 https://github.com/privacyidea/privacyidea/tree/master/authmodules/FreeRADIUS 2 https://github.com/privacyidea/privacyidea/tree/master/authmodules/simpleSAMLphp 6 Chapter 2. Installation privacyIDEA Documentation, Release 1.4 /* * The realm where the user is located in. * Optional. */ ’realm’ => ’’, /* * This is the translation from privacyIDEA attribute names to * SAML attribute names. */ ’attributemap’ => array(’username’ => ’samlLoginName’, ’surname’ => ’surName’, ’givenname’ => ’givenName’, ’email’ => ’emailAddress’, ’phone’ => ’telePhone’, ’mobile’ => ’mobilePhone’, ), ), 2.2. Debian packages 7 privacyIDEA Documentation, Release 1.4 8 Chapter 2. Installation CHAPTER THREE THE INI FILE privacyIDEA is a pylons application that uses an ini-file. The default location of the ini-file is /etc/privacyidea/privacyidea.ini, but depending on your installation it can reside anywhere else. 3.1 Common config The ini file looks like this: [DEFAULT] debug = false profile = false email_to = [email protected] smtp_server = localhost error_email_from = paste@localhost You can use the debug parameter to output debug messages, if you are running privacyIDEA with the paster. If you are running privacyIDEA in Apache WSGI, you need to set this to false. The profile parameter writes profiling output, so that