Seeding FreeIPA, Where Teardown Starts Revoking
Five providers in this module put the directory back exactly as they found it. FreeIPA cannot: the realm’s own CA issued ten real certificates, and a CA has no delete, so teardown revokes them instead.
Seeding Authentik, Where the Directory Is Only the Floor
Authentik was already in my homelab doing single sign-on, so there was no licence cap to design around. Three hundred users turned out to be the least interesting thing the provider seeds.
Eight Okta Users, and Everything That Changed Around Them
I opened the Okta provider expecting to write the ten-user post again with better numbers. The eight users are the same eight users. Nearly everything around them has been replaced.
Seeding Entra ID When There Is Nothing to Paste
Okta, Authentik, FreeIPA and PingOne all hand me a token to paste into a config file. Entra hands me nothing, so the seeder has to solve its own access problem before it can create a single user.
Active Directory Test Data, a Year and Six Providers Later
In August 2025 I published a module that filled a lab domain and tore it down again. Its three commands still run, and almost nothing underneath them survived the move into TestEnvironment.
Test Data That Breaks Scripts on Purpose
I built a lab by hand to test an RC4 migration script, and every run came back clean. The two accounts it should have caught were invisible, because my fixture held the same wrong assumption as the filter.
Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu
Every login in the house resolved against one thin client, and the only spare machine ran Ubuntu. The second server became a container, and a bad image tag left me a replica that looked healthy.
Hardening FreeIPA Before the First Client Joins
The rule a fresh FreeIPA install ships lets every account reach every service on every host, and it is on. That set my order: harden first, enroll second, then argue with each distro about sudo.
Standing Up FreeIPA When Everything in the Lab Is Linux
My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.
Proxmox Can Do This Itself
Six posts of proxying applications that cannot do SSO. Proxmox speaks OpenID Connect natively, so the right move was to get out of the way, and small disagreements made that harder.