Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time group membership in a FreeIPA directory — adding users to IPA groups at checkout and removing them at checkin, with no standing group membership.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with access to your FreeIPA server
Configure checkout and checkin routines from the access-broker-examples repository
Register FreeIPA as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out group membership and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to your FreeIPA server
A FreeIPA service account with permissions to add and remove group members (ipa group-add-member)
ipa CLI tools or Kerberos-capable LDAP client available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker uses the FreeIPA API or ipa CLI to manage group membership. At checkout, Britive adds the user to the target IPA group. At checkin (or on expiry), the membership is removed — no standing access remains.

User → Britive Console → Access Broker → FreeIPA API → IPA group (add/remove member)

Onboarding the Application

Configure the broker for FreeIPA group management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under FreeIPA/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker with your Britive tenant.

Configure the broker scripts

Clone the examples repository and copy the scripts to your broker:

git clone https://github.com/britive/access-broker-examples.git
# Copy FreeIPA/permissions/ scripts to your broker's scripts directory

Create a FreeIPA service account

Create a dedicated FreeIPA user or service account with the necessary privileges to manage group membership. Store credentials in the Britive Secrets Store.

Register FreeIPA in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Define the resource type as FreeIPA and enter the IPA server hostname and domain.

Verify broker connectivity

Confirm the broker can reach the FreeIPA server and authenticate via Kerberos or the IPA API.

Using Shell

Key environment variables used by the broker scripts:

IPA_HOST=ipa.example.com
IPA_DOMAIN=example.com
IPA_ADMIN_USER=britive-svc
IPA_ADMIN_PASSWORD=...   # From Britive Secrets Store
IPA_GROUP=target-group
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples FreeIPA/ directory for the full script set.

Using Terraform

resource "britive_resource_manager_resource_type" "freeipa" {
  name        = "FreeIPA"
  description = "FreeIPA identity management server"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "domain"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "ipa" {
  name          = "freeipa-prod"
  resource_type = britive_resource_manager_resource_type.freeipa.name

  parameter_values = {
    hostname = "ipa.example.com"
    domain   = "example.com"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `FreeIPA-Admins-Access`)
Expiration	Set a max session duration (e.g., `4h`)

Associate resources

Under Associations, select the FreeIPA resource and target group.

Add a permission

Under Permissions, select the group membership checkout/checkin permission.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "ipa_admins" {
  name                = "FreeIPA-Admins-Access"
  expiration_duration = 14400000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "ipa_group" {
  profile_id = britive_resource_manager_profile.ipa_admins.id
  name       = "FreeIPA-GroupMembership"
  version    = "latest"

  variables {
    name              = "IPA_GROUP"
    value             = "admins"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm IPA group membership

ipa group-show admins

Confirm your username appears in the member list.

Check in

Return to My Access → click Check In. Run ipa group-show admins again — your user should no longer appear.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Kerberos ticket or API auth failed	Verify the service account credentials and Kerberos configuration on the broker
Group not found	Incorrect group name in variable	Check the `IPA_GROUP` variable matches the exact FreeIPA group name
Membership not removed	Checkin routine error	Check broker logs for `ipa group-remove-member` errors

Next Steps

Britive documentation

Last updated on July 8, 2026

Manage Group Memberships