Chapter 50. Using external identity providers to authenticate to IdM

1. An IdM client user initiates OAuth 2.0 Device Authorization Grant flow, for example, by attempting to retrieve a Kerberos TGT with the kinit utility at the command line.
2. A special code and website link are sent from the Authorization Server to the IdM KDC backend.
3. The IdM client displays the link and the code to the user. In this example, the IdM client outputs the link and code on the command line.

4. The user opens the website link in a browser, which can be on another host, a mobile phone, and so on:

   1. The user enters the special code.
   2. If necessary, the user logs in to the OAuth 2.0-based IdP.
   3. The user is prompted to authorize the client to access information.
5. The user confirms access at the original device prompt. In this example, the user hits the Enter key at the command line.
6. The IdM KDC backend polls the OAuth 2.0 Authorization Server for access to user information.

Procedure

1. Authenticate as the IdM admin on an IdM server.

   [root@server ~]# kinit admin

2. Create a reference called my-keycloak-idp to an IdP based on the Keycloak template, where the --base-url option specifies the URL to the Keycloak server in the format server-name.$DOMAIN:$PORT/prefix.

   [root@server ~]# ipa idp-add my-keycloak-idp \
                    --provider keycloak --organization main \
                    --base-url keycloak.idm.example.com:8443/auth \
                    --client-id id13778
   ------------------------------------------------
   Added Identity Provider reference "my-keycloak-idp"
   ------------------------------------------------
     Identity Provider reference name: my-keycloak-idp
     Authorization URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/auth
     Device authorization URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/auth/device
     Token URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/token
     User info URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/userinfo
     Client identifier: ipa_oidc_client
     Scope: openid email
     External IdP user identifier attribute: email

Procedure

1. Authenticate as the IdM admin on an IdM server.

   [root@server ~]# kinit admin

2. Manage the IdP reference.

   • To find an IdP reference whose entry includes the string keycloak:

     [root@server ~]# ipa idp-find keycloak

   • To display an IdP reference named my-keycloak-idp:

     [root@server ~]# ipa idp-show my-keycloak-idp

   • To modify an IdP reference, use the ipa idp-mod command. For example, to change the secret for an IdP reference named my-keycloak-idp, specify the --secret option to be prompted for the secret:

     [root@server ~]# ipa idp-mod my-keycloak-idp --secret

   • To delete an IdP reference named my-keycloak-idp:

     [root@server ~]# ipa idp-del my-keycloak-idp

1. Retrieve and store an anonymous Kerberos ticket locally.
2. Request the TGT for the idm-user-with-external-idp user by using kinit with the -T option to enable Flexible Authentication via Secure Tunneling (FAST) channel to provide a secure connection between the Kerberos client and Kerberos Distribution Center (KDC).

Procedure

1. Use Anonymous PKINIT to obtain a Kerberos ticket and store it in a file named ./fast.ccache.

   $ kinit -n -c ./fast.ccache

2. Optional: View the retrieved ticket:

   $ klist -c fast.ccache
   Ticket cache: FILE:fast.ccache
   Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
   
   Valid starting       Expires              Service principal
   03/03/2024 13:36:37  03/04/2024 13:14:28  krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM

3. Begin authenticating as the IdM user, using the -T option to enable the FAST communication channel.

   [root@client ~]# kinit -T ./fast.ccache idm-user-with-external-idp
   Authenticate at https://oauth2.idp.com:8443/auth/realms/master/device?user_code=YHMQ-XKTL and press ENTER.:

4. In a browser, authenticate as the user at the website provided in the command output.
5. At the command line, press the Enter key to finish the authentication process.

Procedure

1. Attempt to log in to the IdM client via SSH.

   [user@client ~]$ ssh idm-user-with-external-idp@client.idm.example.com
   (idm-user-with-external-idp@client.idm.example.com) Authenticate at https://oauth2.idp.com:8443/auth/realms/main/device?user_code=XYFL-ROYR and press ENTER.

2. In a browser, authenticate as the user at the website provided in the command output.
3. At the command line, press the Enter key to finish the authentication process.