Documented ways FreeIPA connects to web identity providers, file servers and automation: Keycloak federation over SSSD, external OAuth 2.0 identity providers for Kerberos, Samba file servers on IPA clients and Ansible deployment.
Putting Keycloak in front of FreeIPA so web applications get OIDC and SAML while Linux identities stay in FreeIPA: the SSSD federation provider versus LDAP federation, D-Bus read-only access, attribute and group import behavior, and where users are managed.
Letting users obtain Kerberos tickets in FreeIPA by signing in at an external OAuth 2.0 identity provider: device authorization flow at the console or SSH, which providers support it, chaining through a local Keycloak for those that do not, and SSSD prerequisites.
Serving SMB file shares from an IPA client with Samba as a domain member: how Samba translates between Windows SIDs and POSIX identities, what the IPA domain controller side provides, and how this fits with Active Directory trusts.
Deploying and managing FreeIPA as code with the ansible-freeipa collection: server, replica and client roles in one playbook, backups, smart card setup, modules for users, HBAC, sudo, DNS and certificates, OTP client enrollment, and controller and node version requirements.
Giving applications that cannot use Kerberos a dedicated LDAP bind identity in FreeIPA: LDAP system accounts added in 4.13, least-privilege permissions, password handling for bind credentials, and when Kerberos or Keycloak is the better route.
Letting users on enrolled machines reach internal web apps without a password: a FreeIPA HTTP service principal and keytab, Apache Kerberos authentication, browser negotiation settings, and HBAC rules for who may use the app.
Registering services in FreeIPA and handing them credentials: service principals, retrieving keytabs, who may create or retrieve a keytab, rotating keys, and where service certificates fit.
Letting a web front end act for users against back-end services in FreeIPA without full delegation: general constrained delegation versus resource-based constrained delegation, who controls each, and typical use cases.
Authenticating to FreeIPA from machines that are not enrolled, such as build agents or admin laptops: a separate krb5 configuration, KRB5_CONFIG, required snippets, and the time and DNS requirements Kerberos imposes.
Passing FreeIPA user attributes and group membership to web applications through SSSD's InfoPipe and mod_lookup_identity, so apps authorize by group without their own LDAP code.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.