irq-freeipa-mcp

MCP server for FreeIPA identity management. Provides 36 tools for managing users, groups, sudo rules, HBAC rules, certificates, hosts, and SSSD cache.

Setup

npm install
npm run build

Configure credentials:

cp config.yaml.example config.yaml   # non-sensitive settings
cp .env.example .env                  # passwords (required)

Passwords must be set via environment variables in .env — they are ignored if placed in config.yaml.

MCP Configuration

{
  "mcpServers": {
    "irq-freeipa": {
      "command": "node",
      "args": ["/path/to/irq-freeipa-mcp/build/index.js"]
    }
  }
}

Tools

Category	Tools	Examples
User Management	freeipa_user_find, freeipa_user_show, freeipa_user_add, freeipa_check_user_groups	Search, create, inspect users
Group Management	freeipa_group_find, freeipa_group_add_member, freeipa_group_remove_member	Manage group membership
Sudo Rules	freeipa_sudorule_find, _show, _add, _enable, _disable, _add_user, _add_host, _add_command, freeipa_sudocmdgroup_add, _add_member	Create and configure sudo policies
HBAC Rules	freeipa_hbacrule_find, _show, _add, _enable, _disable, _add_user, _add_host, _add_service	Host-based access control
Certificates	freeipa_service_add, freeipa_cert_request	Service principals and TLS certs
Hosts	freeipa_host_find, freeipa_host_add	Manage FreeIPA hosts
SSSD Cache	freeipa_clear_sssd_cache, _update_sssd_timeout, _check_sssd_status, _invalidate_user_cache, _test_ssh_connectivity	Remote cache management via SSH
Utility	freeipa_ping, freeipa_get_server_info	Connection testing

All tools include descriptive inputSchema definitions — your MCP client will display parameter docs automatically.

Configuration Reference

config.yaml — non-sensitive settings (server hostnames, timeouts, SSSD domain/timeouts).

.env — credentials only:

FREEIPA_PASSWORD=your-freeipa-password
SSH_PASSWORD=your-ssh-password

Environment variables override config.yaml. See config.yaml.example and .env.example for all options.

License

MIT