{"id":13551178,"url":"https://github.com/ubccr/mokey","last_synced_at":"2025-06-12T14:32:22.651Z","repository":{"id":32053018,"uuid":"35624691","full_name":"ubccr/mokey","owner":"ubccr","description":"FreeIPA self-service account management portal","archived":false,"fork":false,"pushed_at":"2025-05-01T00:18:01.000Z","size":3258,"stargazers_count":200,"open_issues_count":26,"forks_count":46,"subscribers_count":14,"default_branch":"main","last_synced_at":"2025-05-01T01:26:42.140Z","etag":null,"topics":["freeipa","password-manager","self-service"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ubccr.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS.rst","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-05-14T17:12:45.000Z","updated_at":"2025-05-01T00:18:05.000Z","dependencies_parsed_at":"2022-08-02T01:09:46.014Z","dependency_job_id":"f65024a2-68ad-4f4c-a8ba-1f9b5c067163","html_url":"https://github.com/ubccr/mokey","commit_stats":null,"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"purl":"pkg:github/ubccr/mokey","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ubccr%2Fmokey","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ubccr%2Fmokey/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ubccr%2Fmokey/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ubccr%2Fmokey/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ubccr","download_url":"https://codeload.github.com/ubccr/mokey/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ubccr%2Fmokey/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259482598,"owners_count":22864775,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["freeipa","password-manager","self-service"],"created_at":"2024-08-01T12:01:43.698Z","updated_at":"2025-06-12T14:32:22.632Z","avatar_url":"https://github.com/ubccr.png","language":"HTML","funding_links":[],"categories":["Go","others","Domain Management"],"sub_categories":["Screen Sharing"],"readme":"# FreeIPA self-service account management tool\n\n## What is mokey?\n\nmokey is web application that provides self-service user account management\ntools for [FreeIPA](https://www.freeipa.org). The motivation for this project was\nto implement the self-service account creation and password reset functionality\nmissing in FreeIPA.  This feature is not provided by default in FreeIPA, see\n[here](https://www.freeipa.org/page/Self-Service_Password_Reset) for more info\nand the rationale behind this decision. mokey is not a FreeIPA plugin but a\ncomplete standalone application that uses the FreeIPA JSON API.  mokey requires\nno changes to the underlying LDAP schema and uses a MariaDB database to store\naccess tokens. The user experience and web interface can be customized to fit\nthe requirements of an organization's look and feel. mokey is written in Go and\nreleased under a modified BSD license.\n\n## Project status\n\nmokey should be considered alpha software and used at your own risk. There are\ninherent security risks in providing features like self-service password resets\nand can make your systems vulnerable to abuse.\n\n## Features\n\n- Account Signup\n- Forgot/Change Password\n- Add/Remove SSH Public Keys\n- Add/Remove TOTP Tokens\n- Enable/Disable Two-Factor Authentication\n- Hydra Consent/Login Endpoint for OAuth/OpenID Connect\n- Easy to install and configure (requires no FreeIPA/LDAP schema changes)\n\n## Requirements\n\n- FreeIPA v4.6.8 or greater\n- Linux x86_64 \n- Redis (optional)\n- Hydra v1.0.0 (optional)\n\n## Install\n\nNote: mokey needs to be installed on a machine already enrolled in FreeIPA.\nIt's also recommended to have the ipa-admintools package installed. Enrolling a\nhost in FreeIPA is outside the scope of this document.\n\nTo install mokey download a copy of the pre-compiled binary [here](https://github.com/ubccr/mokey/releases).\n\ntar.gz archive:\n\n```\n$ tar xvzf mokey-VERSION-linux-x86_64.tar.gz \n```\n\ndeb, rpm packages:\n\n```\n$ sudo dpkg -i mokey_VERSION_amd64.deb\n\n$ sudo rpm -ivh mokey-VERSION-amd64.rpm\n```\n\n## Setup and configuration\n\nCreate a user account and role in FreeIPA with the \"Modify users and Reset\npasswords\" privilege. This user account will be used by the mokey application\nto reset users passwords. The \"Modify Users\" permission also needs to have the\n\"ipauserauthtype\" enabled. Run the following commands (requires ipa-admintools\nto be installed):\n\n```\n$ mkdir /etc/mokey/private\n$ kinit adminuser\n$ ipa role-add 'Mokey User Manager' --desc='Mokey User management'\n$ ipa role-add-privilege 'Mokey User Manager' --privilege='User Administrators'\n$ ipa user-add mokeyapp --first Mokey --last App\n$ ipa role-add-member 'Mokey User Manager' --users=mokeyapp\n$ ipa permission-mod 'System: Modify Users' --includedattrs=ipauserauthtype\n$ ipa-getkeytab -s [your.ipa-master.server] -p mokeyapp -k /etc/mokey/private/mokeyapp.keytab\n$ chmod 640 /etc/mokey/private/mokeyapp.keytab\n$ chgrp mokey /etc/mokey/private/mokeyapp.keytab\n```\n\nEdit mokey configuration file and set path to keytab file. The values for\n`token_secret` and `csrf_secret` will be automatically generated for you if\nleft blank. Set these secret values if you'd like sessions to persist after a restart.\nFor other site specific config options [see here](https://github.com/ubccr/mokey/blob/main/mokey.toml.sample):\n\n```\n$ vim /etc/mokey/mokey.toml\n# Path to keytab file\nkeytab = \"/etc/mokey/private/mokeyapp.keytab\"\n\n# Secret key for branca tokens. Must be 32 bytes. To generate run:\n#    openssl rand -hex 32 \ntoken_secret = \"\"\n\n# CSRF token secret key. Should be a random string\ncsrf_secret = \"\"\n```\n\nIt's highly recommended to run mokey using HTTPS. You'll need an SSL\ncert/private_key either using FreeIPA's PKI, self-signed, or from a commercial\ncertificate authority. Creating SSL certs is outside the scope of this\ndocument. You can also run mokey behind haproxy or Apache/Nginx.\n\nStart mokey service:\n\n```\n$ systemctl restart mokey\n$ systemctl enable mokey\n```\n\n## SSH Public Key Management\n\nmokey allows users to add/remove ssh public keys. Servers that are enrolled in\nFreeIPA can be configured to have sshd lookup users public keys in LDAP by\nadding the following lines in /etc/ssh/sshd_config and restarting sshd:\n\n    AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys\n    AuthorizedKeysCommandUser nobody\n\n## Hydra Consent and Login Endpoint for OAuth/OpenID Connect\n\nmokey implements the login/consent flow for handling challenge requests from\nHydra. This serves as the bridge between Hydra and FreeIPA identity provider.\nFor more information on Hydra and the login/consent flow see [here](https://www.ory.sh/docs/hydra/oauth2).\n\nTo configure the Hydra login/consent flow set the following variables in\n`/etc/mokey/mokey.toml`:\n\n```\n[hydra]\nadmin_url = \"http://127.0.0.1:4445\"\nlogin_timeout = 86400\nfake_tls_termination = true\n```\n\nAny OAuth clients configured in Hydra will be authenticated via mokey using\nFreeIPA as the identity provider. For an example OAuth 2.0/OIDC client\napplication see [here](examples/mokey-oidc/main.go).\n\n## Building from source\n\nFirst, you will need Go v1.21 or greater. Clone the repository:\n\n```\n$ git clone https://github.com/ubccr/mokey\n$ cd mokey\n$ go build .\n```\n\n## License\n\nmokey is released under a BSD style license. See the LICENSE file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fubccr%2Fmokey","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fubccr%2Fmokey","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fubccr%2Fmokey/lists"}