Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 10. Configuring Single Sign-On for the RHEL 10 web console in the IdM domain

You can integrate the RHEL web console with your Identity Management (IdM) domain to set up Single Sign-On (SSO). Grant your IdM users single-login access using their existing Kerberos credentials, which means users authenticate once and do not need to re-enter credentials to access the web console.

10.1. Prerequisites
Copy link

10.2. IdM and RHEL web console integration
Copy link

Integrating the RHEL web console with an Identity Management (IdM) domain leverages Kerberos-based authentication to provide Single Sign-On (SSO) capabilities.

You can use SSO authentication to leverage the following advantages:

  • IdM domain administrators can use the RHEL 10 web console to manage local machines.
  • Users with a Kerberos ticket in the IdM domain do not need to provide additional login credentials to access the web console.
  • All hosts known to the IdM domain are accessible via SSH from the local instance of the RHEL web console.
  • The web console server automatically switches to a certificate issued by the IdM certificate authority. This certificate is accepted by browsers and eliminates the need for manual certificate configuration.

Configuring SSO for logging into the RHEL web console requires to:

  1. Add machines to the IdM domain using the RHEL 10 web console.
  2. If you want to use Kerberos for authentication, you must obtain a Kerberos ticket on your machine.
  3. Allow administrators on the IdM server to use any command on any host.

You can join a RHEL system to an IdM domain directly in the RHEL web console. This integrates the system into the centralized identity management environment, enabling IdM users to log in.

Prerequisites

  • The IdM domain is running and reachable from the client you want to join.
  • You have the IdM domain administrator credentials.

Procedure

  1. Log in to the RHEL 10 web console.
  2. In the Configuration field of the Overview tab click Join Domain.
  3. In the Join a Domain dialog box, enter the hostname of the IdM server in the Domain Address field.
  4. In the Domain administrator name field, enter the username of the IdM administration account.
  5. In the Domain administrator password, add a password.
  6. Click Join.

Verification

  1. If the RHEL 10 web console does not display an error, the system joined to the IdM domain and you can see the domain name in the System screen.

  2. To verify that the user is a member of the domain, click the Terminal page and type the id command: 

    $ id
    Copy to Clipboard Toggle word wrap 
    euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
    Copy to Clipboard Toggle word wrap

You can log in to the RHEL web console by using Kerberos authentication. If you already have a valid Kerberos ticket from your IdM domain, you can access the console without re-entering your password.

Important

With SSO, you usually do not have any administrative privileges in the web console. This only works if you configure passwordless sudo. The web console does not prompt for a sudo password interactively.

Prerequisites

  • You have installed the RHEL 10 web console.

    For instructions, see Installing and enabling the web console.

  • If the system does not use a Kerberos ticket managed by the SSSD client, request the ticket with the kinit utility manually.

Procedure

  • Log in to the RHEL web console by entering the following URL in your web browser: 

    https://<dns_name>:9090
    Copy to Clipboard Toggle word wrap

The RHEL web console can use the Generic Security Services Application Program Interface (GSSAPI) authentication. However, the IdM framework already owns an HTTP/<server_hostname>@<realm-name> Kerberos service and its keytab. Therefore, to implement GSSAPI authentication on Identity Management (IdM) servers, create a symlink /etc/cockpit/krb5.keytab to /var/lib/ipa/gssproxy/http.keytab and then generate a certificate-key pair.

Prerequisites

  • You have root privileges.

Procedure

  1. Create a symlink: 

    # ln -s /var/lib/ipa/gssproxy/http.keytab /etc/cockpit/krb5.keytab
    Copy to Clipboard Toggle word wrap

  2. Set a certificate file Bash variable: 

    # CERT_FILE=/etc/cockpit/ws-certs.d/50-certmonger.crt
    Copy to Clipboard Toggle word wrap

  3. Set a certificate key Bash variable: 

    # KEY_FILE=/etc/cockpit/ws-certs.d/50-certmonger.key
    Copy to Clipboard Toggle word wrap

  4. Generate a certificate-key pair: 

    # ipa-getcert request -f ${CERT_FILE} -k ${KEY_FILE} -D $(hostname --fqdn)
    Copy to Clipboard Toggle word wrap

To enable administrative tasks through the RHEL web console, grant IdM system administrators appropriate sudo privileges.

Prerequisites

  • You are logged in as an IdM administrator to an IdM host.
  • You have root privileges on the host.

Procedure

  • Enable sudo access on the host: 

    # ipa-advise enable-admins-sudo | sh -ex
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top