Chapter 3. Configuring Kerberos SSO with Identity Management in Satellite

Procedure

1. On the Identity Management server:

   1. Create a host entry for the Satellite Server system.

      For more information, see Red Hat Enterprise Linux 8 Configuring and managing Identity Management or Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules.

   2. Create an entry for the HTTP service for Satellite Server. This enables access to the keytab file by creating a service principal for your Satellite Server.

      For more information on creating a service entry in Identity Management, see Red Hat Enterprise Linux 8 Managing IdM users, groups, hosts, and access control rules or Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules.

2. On your Satellite Server, configure the system as client in the Identity Management domain. This includes ensuring that the system meets the necessary prerequisites, installing the necessary packages, and running the ipa-client-install utility.

   For more information, see Red Hat Enterprise Linux 8 Installing Identity Management or Red Hat Enterprise Linux 9 Installing Identity Management.

Procedure

1. On the Identity Management server, configure HBAC control. For more information, see Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules or Red Hat Enterprise Linux 8 Managing IdM users, groups, hosts, and access control rules.

   1. Create a HBAC service for Satellite Server.

   2. Create a new HBAC rule to define the required access control. Add the following Identity Management entities to the HBAC rule:

      1. The HBAC service for Satellite Server
      2. The Satellite Server host
      3. The users or user groups to whom you want to grant access
   3. Make sure the default Identity Management allow_all rule is disabled. For information about how to disable allow_all without disrupting other services, see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

2. On your Satellite Server, load the host-based access control rules from Identity Management:

   # satellite-installer --foreman-pam-service=foreman-prod

Procedure

1. Authenticate as a user defined in Identity Management to obtain a Kerberos ticket-granting ticket (TGT):

   $ kinit Identity_Management_user

   Warning

   If you enabled access to the Satellite API and the Satellite web UI when you were configuring Identity Management as the authentication provider for Satellite, an attacker might now obtain an API session after the user receives the Kerberos TGT. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser.

2. If Hammer is not configured to negotiate authentication, initiate an authentication session manually:

   $ hammer auth login negotiate

Procedure

1. Obtain the Kerberos ticket granting ticket (TGT):

   $ kinit user
   Password for user@EXAMPLE.COM:

2. In Mozilla Firefox, go to the URL of your Satellite Server.
3. You are logged in automatically.

1. In your browser address bar, enter the URL of your Satellite Server.
2. Enter your username and password.

Procedure

1. Enable the Chrome browser to use Kerberos authentication:

   $ google-chrome --auth-server-whitelist="*.example.com" --auth-negotiate-delegate-whitelist="*.example.com"

   Note

   Instead of allowlisting the whole domain, you can also allowlist a specific Satellite Server.

2. Obtain the Kerberos ticket-granting ticket (TGT):

   $ kinit user
   Password for user@EXAMPLE.COM:

3. In Chrome, go to the URL of your Satellite Server.
4. You are logged in automatically.

1. In your browser address bar, enter the URL of your Satellite Server.
2. Enter your username and password.

1. Enable HBAC:

   1. Create an external group and add the AD group to it.
   2. Add the new external group to a POSIX group.
   3. Use the POSIX group in a HBAC rule.

1. Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf. For example:

   [domain/EXAMPLE.com]
   ...
   krb5_store_password_if_offline = True
   ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname
   
   [nss]
   user_attributes=+email, +firstname, +lastname
   
   [ifp]
   allowed_uids = ipaapi, root
   user_attributes=+email, +firstname, +lastname

2. Clear the SSSD cache:

   1. Stop SSSD:

      # systemctl stop sssd

   2. Clear the cache:

      # sss_cache -E

   3. Start SSSD:

      # systemctl start sssd

3. Verify the AD attributes value by using the dbus-send command on your Satellite Server and on your Identity Management server. Make sure that both outputs match.

   # dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname