ipsilon-server-install(1)

📦 version 3.1.1, in epel 9, fedora 43, fedora 44

✨ ipsilon-server-install ✨

okay bestie, welcome to the Ipsilon Manual Pages 💖 this is ipsilon-server-install and it's literally the glow-up button for your very own Ipsilon Identity Provider instance. let's get into it 🦋

🌸 NAME 🌸

ipsilon-server-install — configure an Ipsilon Identity Provider instance (yes. that's the whole job. iconic.)

🎀 SYNOPSIS 🎀

ipsilon-server-install [OPTION]...

💜 DESCRIPTION 💜

so what this does is set up an Ipsilon instance that provides identity services using any of the supported-and-enabled protocols. that's the whole vibe. ✨

ngl, Ipsilon runs on a pluggable framework, which means some options might just... not be there, depending on which plugins you've got installed. it's giving "your mileage may vary" but make it cute. 💅

Ipsilon supports three types of plugins:

  1. Authentication provider plugins — implements an authentication protocol such as SAML 2, OpenID or Persona. At least one needs to be enabled. (fr fr, at least one.)
  2. Login plugins — mechanisms for authenticating including GSSAPI, LDAP, PAM, etc. At least one should be enabled.
  3. Info plugins — sources where additional attributes of the user may be obtained.

there are also environment helper options which aid in configuring the Identity Provider for a particular environment, such as a FreeIPA domain. love that for you 🫶

and the installation details? they get logged to /var/log/ipsilon-install.log. so if something's weird, that's where the receipts are. 💀

🗄️ DATABASES 🗄️

Ipsilon stores configuration and session information in database tables. by default, a set of sqlite databases are used. no cap.

if you want a full RDBMS though — main character energy — then the --database-url and/or *-dburi options can be used to provide the database URIs. and honestly? you should probably do this in load-balanced situations so all servers can use the same database. it's the only way it works. periodt.

an example of a specific URI is:

--users_dburi=postgresql://@dbserver.example.com:45432/users

and the templatized version would be:

--database-url=postgresql://@dbserver.example.com:45432/%(dbname)s

✨ OPTIONS ✨

🌈 BASIC OPTIONS 🌈

  • -h, --help — Show this help message and exit
  • --version — Show program's version number and exit
  • -o LM_ORDER, --login-managers-order LM_ORDER — Comma separated list of login managers
  • --hostname HOSTNAME — The hostname used by clients to reach this instance. This is used to determine the URLs provided in SAML metadata
  • --instance INSTANCE — Ipsilon instance name
  • --system-user SYSTEM_USER — User account used to run the server
  • --admin-user ADMIN_USER — User account that is assigned Ipsilon admin privileges
  • --database-url DATABASE_URL — The (templatized) database URL to use
  • --secure — Boolean to turn on all security checks
  • --server-debugging — Enable debugging
  • --uninstall — Uninstall the server and all data
  • --yes — Always answer yes
  • --admin-dburi ADMIN_DBURI — Configuration database URI (override template)
  • --users-dburi USERS_DBURI — User configuration database URI (override template)
  • --transaction-dburi TRANSACTION_DBURI — Transaction database URI (override template)

🔐 AUTHENTICATION PROVIDER OPTIONS 🔐

  • --openid — Configure OpenID Provider
  • --openid-dburi OPENID_DBURI — OpenID database URI (override template)
  • --saml2 — Configure SAML2 Provider
  • --saml2-metadata-validity SAML2_METADATA_VALIDITY — Metadata validity period in days (default - 1825)

👑 LOGIN MANAGER OPTIONS 👑

  • --form — Configure External Form authentication
  • --form-service FORM_SERVICE — PAM service name to use for authentication
  • --fas — Configure FAS (Fedora Authentication System) authentication
  • --ldap — Configure LDAP authentication
  • --ldap-server-url LDAP_SERVER_URL — LDAP Server Url
  • --ldap-bind-dn-template LDAP_BIND_DN_TEMPLATE — LDAP Bind DN Template
  • --ldap-tls-level LDAP_TLS_LEVEL — LDAP TLS level
  • --ldap-base-dn LDAP_BASE_DN — LDAP Base DN
  • --krb — Configure Kerberos authentication
  • --krb-httpd-keytab KRB_HTTPD_KEYTAB — Kerberos keytab location for HTTPD
  • --pam — Configure PAM authentication
  • --pam-service PAM_SERVICE — PAM service name to use for authentication
  • --testauth — Configure testing environment authentication

🧚 INFO PROVIDER OPTIONS 🧚

  • --info-ldap — Use LDAP to populate user attrs
  • --info-ldap-server-url INFO_LDAP_SERVER_URL — LDAP Server Url
  • --info-ldap-bind-dn INFO_LDAP_BIND_DN — LDAP Bind DN
  • --info-ldap-bind-pwd INFO_LDAP_BIND_PWD — LDAP Bind Password
  • --info-ldap-user-dn-template INFO_LDAP_USER_DN_TEMPLATE — LDAP User DN Template
  • --info-ldap-base-dn INFO_LDAP_BASE_DN — LDAP Base DN
  • --info-nss — Use passwd data to populate user attrs
  • --info-sssd — Use DBus to populate user attrs from SSSD. SSSD must be pre-configured for at least one domain.
  • --info-sssd-domain INFO_SSSD_DOMAIN — SSSD domain to enable for attribute passthrough (default is all)

🍓 ENVIRONMENT HELPER OPTIONS 🍓

  • --ipa — Helper for IPA joined machines. This configures Ipsilon for Kerberos authentication.

🔥 EXIT STATUS 🔥

  • 0 if the installation was successful ✨
  • 1 if an error occurred 😭

🦋 SEE ALSO 🦋

ipsilon(7), ipsilon-client-install(1)

and that's the whole page bestie, you ate 💅 this one's from Ipsilon, version 3.0.1 — go configure something gorgeous 🌸✨

📦 where this page comes from