Re: How can we improve the Changes Process?

On Чцв, 02 ліп 2026, Neal Gompa wrote:
>On Thu, Jul 2, 2026 at 3:56 AM Alexander Bokovoy <[email protected]> wrote:
>>
>> On Чцв, 02 ліп 2026, Adam Williamson wrote:
>> >On Wed, 2026-07-01 at 06:13 -0400, Neal Gompa wrote:
>> >> I mean, this one is mostly the fault of FreeIPA. It isn't designed for
>> >> community projects, and shoehorning it into Fedora has resulted in
>> >> this flaw. It won't be fixed because no corporate customer of IdM
>> >> needs it, since the model works for business deployments.
>> >>
>> >> It isn't going to get fixed because IdM doesn't consider Fedora an
>> >> important customer/stakeholder/etc for feature development.
>> >
>> >I don't think this is accurate at all. AFAIK FreeIPA has all the 2FA
>> >support we could ever use - it supports far more sophisticated setups
>> >than we've ever even tried. Alexander gives talks about this stuff
>> >constantly. AFAIK the issues are rather with Ipsilon being ancient and
>> >unmaintained, and integration into trickier workflows like fedpkg
>> >(since most 2FA things tend to assume you're in a web browser), none of
>> >which FreeIPA can do anything about.
>>
>> I have been working on solving those problems as well. It is a bit
>> frustrating to see no reaction from Fedora Infrastructure folks, though.
>>
>> For Ipsilon migration we were originally thinking about moving to
>> Keycloak but that doesn't solve a problem as Keycloak would need to gain
>> knowledge about IPA-specific features too. We have done some work on
>> that (ipa-tuura project) and even merged most of what we have in
>> Keycloak 26, but it still lacks few critical bits. And we don't have it
>> packaged in Fedora or cannot ship in RHEL directly.
>>
>> Then for IPA to IPA trust we need an integrated OAuth2 endpoint in
>> IPA. This was my focus for past several months and now we have Ahdapa,
>> https://ahdapa.dev/, which provides all required integration and can be
>> used by Fedora Infrastructure too. I showed it to nirik at the Flock
>> this year.
>>
>> So things are coming but your are right that most of the parts are
>> outside of FreeIPA.
>>
>
>Ipsilon has nothing to do with MFA reset codes, but it looks like
>Ahdapa is supposed to replace what Noggin does too? The website
>indicates it gives the ability for users to edit IPA properties like
>noggin does.
>
>Does this mean that we're getting another frontend change?

No. Ahdapa is a general purpose OAuth2 IdP, not specific to Fedora use
case. It can have UI parts enabled/disabled. Noggin, for example,
doesn't utilize Ipsilon for login purposes, the rest of Fedora
infrastructure does.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new