Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 5. Configuring Kerberos SSO for Active Directory users in Satellite

If the base system of your Satellite Server is connected directly to Active Directory (AD), you can configure AD as an external authentication source for Satellite. Direct AD integration means that a Linux system is joined directly to the AD domain where the identity is stored.

AD users can log in using the following methods:

  • Username and password
  • Kerberos single sign-on
Note

You can also connect your Satellite deployment to AD in the following ways:

5.1. Configuring the Active Directory authentication source on Satellite Server

Enable Active Directory (AD) users to access Satellite by configuring the corresponding authentication provider on your Satellite Server.

Prerequisites

  • The base system of your Satellite Server must be joined to an Active Directory (AD) domain. To enable AD users to sign in with Kerberos single sign-on, use the System Security Services Daemon (SSSD) and Samba services to join the base system to the AD domain:

    Install the following packages on Satellite Server: 

    # satellite-maintain packages install adcli krb5-workstation oddjob-mkhomedir oddjob realmd samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator sssd
    Copy to Clipboard

    Specify the required software when joining the AD domain: 

    # realm join AD.EXAMPLE.COM --membership-software=samba --client-software=sssd
    Copy to Clipboard

    For more information on direct AD integration, see Connecting RHEL systems directly to AD using Samba Winbind.

Procedure

  1. Define AD realm configuration in a location where satellite-installer expects it:

    1. Create a directory named /etc/ipa/: 

      # mkdir /etc/ipa/
      Copy to Clipboard

    2. Create the /etc/ipa/default.conf file with the following contents to configure the Kerberos realm for the AD domain: 

      [global]
realm = AD.EXAMPLE.COM
      Copy to Clipboard

  2. Configure the Apache keytab for Kerberos connections:

    1. Update the /etc/samba/smb.conf file with the following settings to configure how Samba interacts with AD: 

      [global]
workgroup = AD.EXAMPLE
realm = AD.EXAMPLE.COM
kerberos method = system keytab
security = ads
      Copy to Clipboard

    2. Add the Kerberos service principal to the keytab file at /etc/httpd/conf/http.keytab: 

      # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U Administrator -s /etc/samba/smb.conf
      Copy to Clipboard

  3. Configure the System Security Services Daemon (SSSD) to use the AD access control provider to evaluate and enforce Group Policy Object (GPO) access control rules for the foreman PAM service:

    1. In the [domain/ad.example.com] section of your /etc/sssd/sssd.conf file, configure the ad_gpo_access_control and ad_gpo_map_service options as follows: 

      [domain/ad.example.com]
ad_gpo_access_control = enforcing
ad_gpo_map_service = +foreman
      Copy to Clipboard

      For more information on GPOs, see the following documents:

    2. Restart SSSD: 

      # systemctl restart sssd
      Copy to Clipboard

  4. Enable the authentication source: 

    # satellite-installer --foreman-ipa-authentication=true
    Copy to Clipboard

Verification

  • To verify that AD users can log in to Satellite by entering their credentials, log in to Satellite web UI at https://satellite.example.com. Enter the user name in the user principal name (UPN) format, for example: ad_user@AD.EXAMPLE.COM.

  • To verify that AD users can authenticate by using Kerberos single sign-on:

    • Obtain a Kerberos ticket-granting ticket (TGT) on behalf of an AD user: 

      $ kinit ad_user@AD.EXAMPLE.COM
      Copy to Clipboard

    • Verify user authentication by using your TGT: 

      $ curl -k -u : --negotiate https://satellite.example.com/users/extlogin

<html><body>You are being <a href="satellite.example.com/hosts">redirected</a>.</body></html>
      Copy to Clipboard

Troubleshooting

  • Connecting to the AD LDAP can sometimes fail with an error such as the following appearing in the logs: 

    Authentication failed with status code: {
  "error": { "message": "ERF77-7629 [Foreman::LdapException]: Error while connecting to 'server.com' LDAP server at 'ldap.example.com' during authentication ([Net::LDAP::Error]: Connection reset by peer - SSL_connect)" } }
    Copy to Clipboard

    If you see this error, verify which cipher is used for the connection: 

    # openssl s_client -connect ldap.example.com:636
    Copy to Clipboard

    If the TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 cipher is used, disable it on either the Satellite Server side or on the AD side. The TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 cipher is known to cause incompatibilities.

    For more information, see the Red Hat Knowledgebase solution API calls to Red Hat Satellite 6 fail intermittently on LDAP authentication.

Additional resources

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat