Configuring authentication for Red Hat Satellite users

Procedure

1. Access Satellite Server using a web browser pointed to the fully qualified domain name:

   https://satellite.example.com/

   Copy to Clipboard Toggle word wrap
2. Enter the user name and password created during the configuration process. If a user was not created during the configuration process, the default user name is admin.

Procedure

1. Identify the fully qualified domain name of your Satellite Server:

   # hostname -f

   Copy to Clipboard Toggle word wrap

2. Access the pub directory on your Satellite Server using a web browser pointed to the fully qualified domain name:

   https://satellite.example.com/pub

   Copy to Clipboard Toggle word wrap
3. When you access Satellite for the first time, an untrusted connection warning displays in your web browser. Accept the self-signed certificate and add the Satellite URL as a security exception to override the settings. This procedure might differ depending on the browser being used. Ensure that the Satellite URL is valid before you accept the security exception.
4. Select katello-server-ca.crt.
5. Import the certificate into your browser as a certificate authority and trust it to identify websites.

CLI procedure

1. From the Satellite CLI, copy the katello-server-ca.crt file to the machine you use to access the Satellite web UI:

   # scp /var/www/html/pub/katello-server-ca.crt username@hostname:remotefile

   Copy to Clipboard Toggle word wrap
2. In the browser, import the katello-server-ca.crt certificate as a certificate authority and trust it to identify websites.

To reset the administrative user password

1. Log in to the base operating system where Satellite Server is installed.

2. Enter the following command to reset the password:

   # foreman-rake permissions:reset
   Reset to user: admin, password: qwJxBptxb7Gfcjj5

   Copy to Clipboard Toggle word wrap
3. Use this password to reset the password in the Satellite web UI.

4. Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password:

   # vi ~/.hammer/cli.modules.d/foreman.yml

   Copy to Clipboard Toggle word wrap

To set a new administrative user password

1. Log in to the base operating system where Satellite Server is installed.

2. To set the password, enter the following command:

   # foreman-rake permissions:reset password=new_password

   Copy to Clipboard Toggle word wrap

3. Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password:

   # vi ~/.hammer/cli.modules.d/foreman.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Satellite web UI, navigate to Administer > Settings, and click the General tab.
2. Enter your custom message in the Login page footer text field.
3. Click Submit.

Procedure

1. On the Identity Management server:

   1. Create a host entry for the Satellite Server system.

      For more information, see Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules.

   2. Create an entry for the HTTP service for Satellite Server. This enables access to the keytab file by creating a service principal for your Satellite Server.

      For more information on creating a service entry in Identity Management, see Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules.

2. On your Satellite Server, configure the system as client in the Identity Management domain. This includes ensuring that the system meets the necessary prerequisites, installing the necessary packages, and running the ipa-client-install utility.

   For more information, see Red Hat Enterprise Linux 9 Installing Identity Management.

   Note

   To install packages on your Satellite Server, use the satellite-installer utility.

Procedure

1. Enable access for your preferred login method:

   • To enable access to the Satellite web UI only:

     # satellite-installer \
     --foreman-ipa-authentication true

     Copy to Clipboard Toggle word wrap

   • To enable access to the Satellite web UI and the Satellite API, including Hammer CLI:

     # satellite-installer \
     --foreman-ipa-authentication-api true \
     --foreman-ipa-authentication true

     Copy to Clipboard Toggle word wrap
     Warning

     Enabling access to both the Satellite web UI and the Satellite API poses a security risk. After the Identity Management user enters kinit to receive a Kerberos ticket-granting ticket (TGT), an attacker might obtain an API session. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser.

   • To disable external authentication with Identity Management, reset the options. For example, to disable access to the Satellite API and Hammer CLI:

     # satellite-installer --reset-foreman-ipa-authentication-api

     Copy to Clipboard Toggle word wrap

2. If your Satellite Server runs in an IPv6-only network and also runs on RHEL 9.6 and earlier or RHEL 10.0, set the lookup_family_order option in the [domain/idm-server.example.com] section of the /etc/sssd/sssd.conf file:

   [domain/idm-server.example.com]
   lookup_family_order = ipv6_only

   Copy to Clipboard Toggle word wrap

   If the DNS name of the IdM server can be translated to both an IPv4 and IPv6 address but the IPv4 address is not accessible, SSSD requires lookup_family_order to translate the DNS name correctly. Without the option, IdM users are unable to use kinit to authenticate to Satellite.

Procedure

1. On the Identity Management server, configure HBAC control. For more information, see Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules.

   1. Create a HBAC service for Satellite Server.

   2. Create a new HBAC rule to define the required access control. Add the following Identity Management entities to the HBAC rule:

      1. The HBAC service for Satellite Server
      2. The Satellite Server host
      3. The users or user groups to whom you want to grant access
   3. Make sure the default Identity Management allow_all rule is disabled. For information about how to disable allow_all without disrupting other services, see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

2. On your Satellite Server, load the host-based access control rules from Identity Management:

   # satellite-installer --foreman-pam-service foreman-prod

   Copy to Clipboard Toggle word wrap

Procedure

1. Authenticate as a user defined in Identity Management to obtain a Kerberos ticket-granting ticket (TGT):

   $ kinit Identity_Management_user

   Copy to Clipboard Toggle word wrap
   Warning

   If you enabled access to the Satellite API and the Satellite web UI when you were configuring Identity Management as the authentication provider for Satellite, an attacker might now obtain an API session after the user receives the Kerberos TGT. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser.

2. If Hammer is not configured to negotiate authentication, initiate an authentication session manually:

   $ hammer auth login negotiate

   Copy to Clipboard Toggle word wrap

Procedure

1. Obtain the Kerberos ticket granting ticket (TGT):

   $ kinit user
   Password for user@EXAMPLE.COM:

   Copy to Clipboard Toggle word wrap
2. In Mozilla Firefox, go to the URL of your Satellite Server.
3. You are logged in automatically.

1. In your browser address bar, enter the URL of your Satellite Server.
2. Enter your username and password.

Procedure

1. Enable the Chrome browser to use Kerberos authentication:

   $ google-chrome --auth-server-whitelist="*.example.com" --auth-negotiate-delegate-whitelist="*.example.com"

   Copy to Clipboard Toggle word wrap
   Note

   Instead of allowlisting the whole domain, you can also allowlist a specific Satellite Server.

2. Obtain the Kerberos ticket-granting ticket (TGT):

   $ kinit user
   Password for user@EXAMPLE.COM:

   Copy to Clipboard Toggle word wrap
3. In Chrome, go to the URL of your Satellite Server.
4. You are logged in automatically.

1. In your browser address bar, enter the URL of your Satellite Server.
2. Enter your username and password.

1. Enable HBAC:

   1. Create an external group and add the AD group to it.
   2. Add the new external group to a POSIX group.
   3. Use the POSIX group in a HBAC rule.

1. Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf. For example:

   [domain/EXAMPLE.com]
   ...
   krb5_store_password_if_offline = True
   ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname
   
   [nss]
   user_attributes=+email, +firstname, +lastname
   
   [ifp]
   allowed_uids = ipaapi, root
   user_attributes=+email, +firstname, +lastname

   Copy to Clipboard Toggle word wrap

2. Clear the SSSD cache:

   1. Stop SSSD:

      # systemctl stop sssd

      Copy to Clipboard Toggle word wrap

   2. Clear the cache:

      # sss_cache -E

      Copy to Clipboard Toggle word wrap

   3. Start SSSD:

      # systemctl start sssd

      Copy to Clipboard Toggle word wrap

3. Verify the AD attributes value by using the dbus-send command on your Satellite Server and on your Identity Management server. Make sure that both outputs match.

   # dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname

   Copy to Clipboard Toggle word wrap

1. Choose the authentication method you want Red Hat Single Sign-On users to use when authenticating to Satellite:

   • If you want users to authenticate by using the Satellite web UI:

     1. Create a client for Satellite. Use foreman-openidc as the application name.

        # keycloak-httpd-client-install --app-name foreman-openidc \
        --keycloak-server-url "https://rhsso.example.com" \
        --keycloak-admin-username "admin" \
        --keycloak-realm "Satellite_Realm" \
        --keycloak-admin-realm master \
        --keycloak-auth-role root-admin \
        -t openidc -l /users/extlogin --force

        Copy to Clipboard Toggle word wrap

     2. Configure Satellite to use Red Hat Single Sign-On as an authentication source for Satellite web UI:

        # satellite-installer --foreman-keycloak true \
        --foreman-keycloak-app-name "foreman-openidc" \
        --foreman-keycloak-realm "Satellite_Realm"

        Copy to Clipboard Toggle word wrap

   • If you want users to authenticate by using the Hammer CLI:

     1. Create a client for Satellite. Use hammer-openidc as the application name.

        # keycloak-httpd-client-install --app-name hammer-openidc \
        --keycloak-server-url "https://rhsso.example.com" \
        --keycloak-admin-username "admin" \
        --keycloak-realm "Satellite_Realm" \
        --keycloak-admin-realm master \
        --keycloak-auth-role root-admin \
        -t openidc -l /users/extlogin --force

        Copy to Clipboard Toggle word wrap

     2. Configure Satellite to use Red Hat Single Sign-On as an authentication source for Hammer CLI:

        # satellite-installer --foreman-keycloak true \
        --foreman-keycloak-app-name "hammer-openidc" \
        --foreman-keycloak-realm "Satellite_Realm"

        Copy to Clipboard Toggle word wrap

2. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

1. Go to the realm created for Satellite users. Navigate to Clients and click the Satellite client.

2. Configure access type:

   • If you are configuring a client that will provide Satellite web UI authentication, select confidential from the Access Type list.
   • If you are configuring a client that will provide Hammer CLI authentication, select public from the Access Type list.

3. Configure Valid redirect URI addresses:

   • If you are configuring a client that will provide Satellite web UI authentication:

     • You will see a pre-defined URI: https://satellite.example.com/users/extlogin/redirect_uri. Do not change or remove this URI.
     • Add another URI below the pre-defined URI: https://satellite.example.com/users/extlogin

   • If you are configuring a client that will provide Hammer CLI authentication:

     • You will see a pre-defined URI: https://satellite.example.com/users/extlogin/redirect_uri. Do not change or remove this URI.
     • Add another URI below the pre-defined URI: urn:ietf:wg:oauth:2.0:oob
4. Click Save.

5. On the Mappers tab, click Create to add an audience mapper.

   1. From the Mapper Type list, select Audience.
   2. From the Included Client Audience list, select the Satellite client.
6. Click Save.

7. On the Mappers tab, click Create to add a group mapper so that you can specify authorization in Satellite based on group membership.

   1. From the Mapper Type list, select Group Membership.
   2. In the Token Claim Name field, enter groups.
   3. Set the Full group path setting to OFF.
8. Click Save.

1. Navigate to Administer > Settings.

2. On the Authentication tab, configure the following settings:

   1. Authorize login delegation: Set to Yes.
   2. Authorize login delegation auth source user autocreate: Set to External.
   3. Login delegation logout URL: Set to https://satellite.example.com/users/extlogout.
   4. OIDC Algorithm: For example, set to RS256.
   5. OIDC Audience: Set to the client ID for Red Hat Single Sign-On.
   6. OIDC Issuer: Set to https://rhsso.example.com/auth/realms/Satellite_Realm.
   7. OIDC JWKs URL: Set to https://rhsso.example.com/auth/realms/Satellite_Realm/protocol/openid-connect/certs.

3. Navigate to Administer > Authentication Sources.

   1. From the External menu, select Edit.
   2. On the Locations tab, add the locations that you want to be able to use the Red Hat Single Sign-On authentication source.
   3. On the Organizations tab, add the organizations that you want to be able to use the Red Hat Single Sign-On authentication source.
   4. Click Submit.

1. Set the login delegation to true so that users can authenticate using the Open IDC protocol:

   $ hammer settings set --name authorize_login_delegation --value true

   Copy to Clipboard Toggle word wrap

2. Set the login delegation logout URL:

   $ hammer settings set --name login_delegation_logout_url \
   --value https://satellite.example.com/users/extlogout

   Copy to Clipboard Toggle word wrap

3. Set the algorithm for encoding: For example, to use the RS256 algorithm:

   $ hammer settings set --name oidc_algorithm --value 'RS256'

   Copy to Clipboard Toggle word wrap

4. Add the value for the Hammer client in the Open IDC audience:

   $ hammer settings set --name oidc_audience \
   --value "['satellite.example.com-hammer-openidc']"

   Copy to Clipboard Toggle word wrap

5. Set the value for the Open IDC issuer:

   $ hammer settings set --name oidc_issuer \
   --value "https://rhsso.example.com/auth/realms/Satellite_Realm"

   Copy to Clipboard Toggle word wrap

6. Set the value for Open IDC Java Web Token (JWT):

   $ hammer settings set --name oidc_jwks_url \
   --value "https://rhsso.example.com/auth/realms/Satellite_Realm/protocol/openid-connect/certs"

   Copy to Clipboard Toggle word wrap

7. Retrieve the ID of the Red Hat Single Sign-On authentication source:

   $ hammer auth-source external list

   Copy to Clipboard Toggle word wrap

8. Set the location and organization:

   $ hammer auth-source external update \
   --id My_Authentication_Source_ID \
   --location-ids My_Location_ID \
   --organization-ids My_Organization_ID

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to the Satellite realm.
2. Navigate to Authentication.
3. On the Policies tab, click the OTP Policy tab. Ensure that the Supported Applications field includes FreeOTP or Google Authenticator.
4. Configure the OTP settings to suit your requirements.
5. On Required Actions tab, enable the Set as default action setting for the Configure OTP action.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.

2. Click Create User Group.

   1. In the Name field, enter a name for the user group. Enter a name that is different from the Active Directory user group name.
   2. Do not add any users or user groups to the new group in Satellite web UI.
3. On the Roles tab, select Administer.

4. On the External Groups tab, click Add external user group.

   1. In the Name field, enter the name of the Active Directory group.
   2. From the Auth Source drop-down menu, select EXTERNAL.
5. Click Submit.

1. In your browser, log in to Satellite. Satellite redirects you to the Red Hat Single Sign-On login screen.
2. Enter your username and password, and click Log In.
3. On your first login attempt, Red Hat Single Sign-On requests you to configure your client by scanning the bar code and entering your PIN. Once authenticated, your browser redirects you back to Satellite and logs you in.

1. Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml:

   :foreman:
     :use_sessions: true

   Copy to Clipboard Toggle word wrap

2. Initiate an authentication session with hammer auth login oauth:

   $ hammer auth login oauth \
   --oidc-token-endpoint 'https://rhsso.example.com/auth/realms/Satellite_realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://rhsso.example.com/auth' \
   --oidc-client-id 'satellite.example.com-hammer-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   Copy to Clipboard Toggle word wrap

1. Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml:

   :foreman:
     :use_sessions: true

   Copy to Clipboard Toggle word wrap

2. Initiate an authentication session by using --two-factor with hammer auth login oauth:

   $ hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://rhsso.example.com/auth/realms/Satellite_realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://rhsso.example.com/auth' \
   --oidc-client-id 'satellite.example.com-hammer-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   Copy to Clipboard Toggle word wrap
3. You will be prompted to enter a success code. To retrieve the success code, navigate to the URL that the command returns.
4. Enter the success code in CLI.

1. Choose the authentication method you want Red Hat build of Keycloak users to use when authenticating to Satellite:

   • If you want users to authenticate by using the Satellite web UI:

     1. Create a client for Satellite. Use foreman-openidc as the application name.

        # keycloak-httpd-client-install --app-name foreman-openidc \
        --keycloak-server-url "https://rhbk.example.com:8443" \
        --keycloak-admin-username "admin" \
        --keycloak-realm "Satellite_Realm" \
        --keycloak-admin-realm master \
        --keycloak-auth-role root-admin \
        -t openidc -l /users/extlogin --force

        Copy to Clipboard Toggle word wrap

     2. Configure Satellite to use Red Hat build of Keycloak as an authentication source for Satellite web UI:

        # satellite-installer --foreman-keycloak true \
        --foreman-keycloak-app-name "foreman-openidc" \
        --foreman-keycloak-realm "Satellite_Realm"

        Copy to Clipboard Toggle word wrap

   • If you want users to authenticate by using the Hammer CLI:

     1. Create a client for Satellite. Use hammer-openidc as the application name.

        # keycloak-httpd-client-install --app-name hammer-openidc \
        --keycloak-server-url "https://rhbk.example.com:8443" \
        --keycloak-admin-username "admin" \
        --keycloak-realm "Satellite_Realm" \
        --keycloak-admin-realm master \
        --keycloak-auth-role root-admin \
        -t openidc -l /users/extlogin --force

        Copy to Clipboard Toggle word wrap

     2. Configure Satellite to use Red Hat build of Keycloak as an authentication source for Hammer CLI:

        # satellite-installer --foreman-keycloak true \
        --foreman-keycloak-app-name "hammer-openidc" \
        --foreman-keycloak-realm "Satellite_Realm"

        Copy to Clipboard Toggle word wrap

2. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

1. Go to the realm created for Satellite users.
2. Navigate to Clients and click the Satellite client.

3. On the Settings tab for the Satellite client, configure the access type and redirect addresses:

   • If you are configuring a client that will provide Satellite web UI authentication:

     1. Enable Client authentication.
     2. You will see a pre-defined URI: https://satellite.example.com/users/extlogin/redirect_uri. Do not change or remove this URI.
     3. Add another URI below the pre-defined URI: https://satellite.example.com/users/extlogin

   • If you are configuring a client that will provide Hammer CLI authentication:

     1. Ensure Client authentication is disabled.
     2. You will see a pre-defined URI: https://satellite.example.com/users/extlogin/redirect_uri. Do not change or remove this URI.
     3. Add another URI below the pre-defined URI: urn:ietf:wg:oauth:2.0:oob

4. On the Client Scopes tab for the Satellite client, locate the client scope dedicated to the Satellite client named client-name-dedicated. Start editing the client scope.

   1. On the Mappers tab for client-name-dedicated, add a new mapper by configuration. Select the Audience mapper type.

      1. From the Included Client Audience list, select the Satellite client.
      2. Enable Add to ID token.
      3. Click Save.

   2. Add another mapper by configuration. Select the Group Membership mapper type. This adds a group mapper so that you can specify authorization in Satellite based on group membership.

      1. In the Token Claim Name field, enter groups.
      2. Disable Full group path.
      3. Click Save.

1. Navigate to Administer > Settings.

2. On the Authentication tab, configure the following settings:

   1. Authorize login delegation: Set to Yes.
   2. Authorize login delegation auth source user autocreate: Set to External.
   3. Login delegation logout URL: Set to https://satellite.example.com/users/extlogout.
   4. OIDC Algorithm: For example, set to RS256.
   5. OIDC Audience: Set to the client ID for Red Hat build of Keycloak.

   6. OIDC Issuer:

      • Set to https://rhbk.example.com:8443/realms/Satellite_Realm if you initialized your Red Hat build of Keycloak server without the --http-relative-path=/auth context path.
      • Set to https://rhbk.example.com:8443/auth/realms/Satellite_Realm if you initialized your Red Hat build of Keycloak server with the --http-relative-path=/auth context path.

   7. OIDC JWKs URL:

      • Set to https://rhbk.example.com:8443/realms/Satellite_Realm/protocol/openid-connect/certs if you initialized your Red Hat build of Keycloak server without the --http-relative-path=/auth context path.
      • Set to https://rhbk.example.com:8443/auth/realms/Satellite_Realm/protocol/openid-connect/certs if you initialized your Red Hat build of Keycloak server with the --http-relative-path=/auth context path.

3. Navigate to Administer > Authentication Sources.

   1. From the External menu, select Edit.
   2. On the Locations tab, add the locations that you want to be able to use the Red Hat build of Keycloak authentication source.
   3. On the Organizations tab, add the organizations that you want to be able to use the Red Hat build of Keycloak authentication source.
   4. Click Submit.

1. Set the login delegation to true so that users can authenticate using the Open IDC protocol:

   $ hammer settings set --name authorize_login_delegation --value true

   Copy to Clipboard Toggle word wrap

2. Set the login delegation logout URL:

   $ hammer settings set --name login_delegation_logout_url \
   --value https://satellite.example.com/users/extlogout

   Copy to Clipboard Toggle word wrap

3. Set the algorithm for encoding: For example, to use the RS256 algorithm:

   $ hammer settings set --name oidc_algorithm --value 'RS256'

   Copy to Clipboard Toggle word wrap

4. Add the value for the Hammer client in the Open IDC audience:

   $ hammer settings set --name oidc_audience \
   --value "['satellite.example.com-hammer-openidc']"

   Copy to Clipboard Toggle word wrap

5. Set the value for the Open IDC issuer:

   • If you initialized your Red Hat build of Keycloak server without the --http-relative-path=/auth context path:

     $ hammer settings set --name oidc_issuer \
     --value "https://rhbk.example.com:8443/realms/Satellite_Realm"

     Copy to Clipboard Toggle word wrap

   • If you initialized your Red Hat build of Keycloak server with the --http-relative-path=/auth context path:

     $ hammer settings set --name oidc_issuer \
     --value "https://rhbk.example.com:8443/auth/realms/Satellite_Realm"

     Copy to Clipboard Toggle word wrap

6. Set the value for Open IDC Java Web Token (JWT):

   • If you initialized your Red Hat build of Keycloak server without the --http-relative-path=/auth context path:

     $ hammer settings set --name oidc_jwks_url \
     --value "https://rhbk.example.com:8443/realms/Satellite_Realm/protocol/openid-connect/certs"

     Copy to Clipboard Toggle word wrap

   • If you initialized your Red Hat build of Keycloak server with the --http-relative-path=/auth context path:

     $ hammer settings set --name oidc_jwks_url \
     --value "https://rhbk.example.com:8443/auth/realms/Satellite_Realm/protocol/openid-connect/certs"

     Copy to Clipboard Toggle word wrap

7. Retrieve the ID of the Red Hat build of Keycloak authentication source:

   $ hammer auth-source external list

   Copy to Clipboard Toggle word wrap

8. Set the location and organization:

   $ hammer auth-source external update \
   --id My_Authentication_Source_ID \
   --location-ids My_Location_ID \
   --organization-ids My_Organization_ID

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Red Hat build of Keycloak web UI, navigate to the Satellite realm.
2. Navigate to Authentication.
3. On the Policies tab, click the OTP Policy tab. Ensure that the Supported Applications field includes FreeOTP or Google Authenticator.
4. Configure the OTP settings to suit your requirements.
5. On Required Actions tab, enable the Set as default action setting for the Configure OTP action.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.

2. Click Create User Group.

   1. In the Name field, enter a name for the user group. Enter a name that is different from the Active Directory user group name.
   2. Do not add any users or user groups to the new group in Satellite web UI.
3. On the Roles tab, select Administer.

4. On the External Groups tab, click Add external user group.

   1. In the Name field, enter the name of the Active Directory group.
   2. From the Auth Source drop-down menu, select EXTERNAL.
5. Click Submit.

1. In your browser, log in to Satellite. Satellite redirects you to the Red Hat build of Keycloak login screen.
2. Enter your username and password, and click Log In.
3. On your first login attempt, Red Hat build of Keycloak requests you to configure your client by scanning the bar code and entering your PIN. Once authenticated, your browser redirects you back to Satellite and logs you in.

1. Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml:

   :foreman:
     :use_sessions: true

   Copy to Clipboard Toggle word wrap

2. Initiate an authentication session with hammer auth login oauth:

   • If you initialized your Red Hat build of Keycloak server without the --http-relative-path=/auth context path:

     $ hammer auth login oauth \
     --oidc-token-endpoint 'https://rhbk.example.com:8443/realms/Satellite_realm/protocol/openid-connect/token' \
     --oidc-authorization-endpoint 'https://rhbk.example.com:8443' \
     --oidc-client-id 'satellite.example.com-hammer-openidc' \
     --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

     Copy to Clipboard Toggle word wrap

   • If you initialized your Red Hat build of Keycloak server with the --http-relative-path=/auth context path:

     $ hammer auth login oauth \
     --oidc-token-endpoint 'https://rhbk.example.com:8443/auth/realms/Satellite_realm/protocol/openid-connect/token' \
     --oidc-authorization-endpoint 'https://rhbk.example.com:8443/auth' \
     --oidc-client-id 'satellite.example.com-hammer-openidc' \
     --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

     Copy to Clipboard Toggle word wrap

1. Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml:

   :foreman:
     :use_sessions: true

   Copy to Clipboard Toggle word wrap

2. Initiate an authentication session by using --two-factor with hammer auth login oauth:

   $ hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://rhbk.example.com:8443/auth/realms/Satellite_realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://rhbk.example.com:8443/auth' \
   --oidc-client-id 'satellite.example.com-hammer-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   Copy to Clipboard Toggle word wrap
3. You will be prompted to enter a success code. To retrieve the success code, navigate to the URL that the command returns.
4. Enter the success code in CLI.

Procedure

1. Define AD realm configuration in a location where satellite-installer expects it:

   1. Create a directory named /etc/ipa/:

      # mkdir /etc/ipa/

      Copy to Clipboard Toggle word wrap

   2. Create the /etc/ipa/default.conf file with the following contents to configure the Kerberos realm for the AD domain:

      [global]
      realm = AD.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

2. Configure the Apache keytab for Kerberos connections:

   1. Update the /etc/samba/smb.conf file with the following settings to configure how Samba interacts with AD:

      [global]
      workgroup = AD.EXAMPLE
      realm = AD.EXAMPLE.COM
      kerberos method = system keytab
      security = ads

      Copy to Clipboard Toggle word wrap

   2. Add the Kerberos service principal to the keytab file at /etc/httpd/conf/http.keytab:

      # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab create HTTP -U Administrator -s /etc/samba/smb.conf

      Copy to Clipboard Toggle word wrap
      Note

      The net ads keytab create command was introduced in Samba version 4.21.1. If your system uses an earlier version of Samba, use the net ads keytab add command.

3. Configure the System Security Services Daemon (SSSD) on your Satellite Server:

   1. Configure the AD access control provider to evaluate and enforce Group Policy Object (GPO) access control rules for the foreman PAM service. In the [domain/ad.example.com] section of your /etc/sssd/sssd.conf file, set the ad_gpo_access_control and ad_gpo_map_service options as follows:

      [domain/ad.example.com]
      ad_gpo_access_control = enforcing
      ad_gpo_map_service = +foreman

      Copy to Clipboard Toggle word wrap

      For more information on GPOs, see How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 9).

   2. If your Satellite Server runs in an IPv6-only network and also runs on RHEL 9.6 and earlier or RHEL 10.0, set the lookup_family_order option in the [domain/ad.example.com] section of the /etc/sssd/sssd.conf file:

      [domain/ad.example.com]
      lookup_family_order = ipv6_only

      Copy to Clipboard Toggle word wrap

      If the DNS name of the AD server can be translated to both an IPv4 and IPv6 address but the IPv4 address is not accessible, SSSD requires lookup_family_order to translate the DNS name correctly. Without the option, AD users are unable to use kinit to authenticate to Satellite.

   3. Restart SSSD:

      # systemctl restart sssd

      Copy to Clipboard Toggle word wrap

4. Enable the authentication source:

   # satellite-installer --foreman-ipa-authentication true

   Copy to Clipboard Toggle word wrap

Procedure

1. Obtain the CA certificate from the LDAP Server:

   1. If you use Active Directory Certificate Services, export the Enterprise PKI CA Certificate using the Base64 encoded X.509 format. See How to configure Active Directory authentication with TLS on Satellite for information on creating and exporting a CA certificate from an Active Directory server.

   2. Download the LDAP server certificate to a temporary location on the Satellite Server, such as /tmp/example.crt. You will remove the certificate when finished.

      The filename extensions .cer and .crt are only conventions and can refer to DER binary or PEM ASCII format certificates.

2. Add the LDAP server certificate to the system truststore:

   1. Import the certificate:

      # cp /tmp/example.crt /etc/pki/ca-trust/source/anchors

      Copy to Clipboard Toggle word wrap

   2. Update the certificate authority truststore:

      # update-ca-trust extract

      Copy to Clipboard Toggle word wrap
3. Delete the downloaded LDAP certificate from the temporary location on your Satellite Server.

4. Restart Satellite services:

   # satellite-maintain service restart

   Copy to Clipboard Toggle word wrap

Procedure

1. On your Satellite Server, enable the Network Information System (NIS) service so that SELinux does not block outgoing LDAP connections:

   # setsebool -P nis_enabled on

   Copy to Clipboard Toggle word wrap
2. In the Satellite web UI, navigate to Administer > Authentication Sources.
3. From the LDAP menu, select Create.

4. On the LDAP server tab, enter the details of your LDAP server.

   For TLS encrypted connections, select LDAPS to enable encryption.

5. On the Account tab, enter the account information and domain name details. For more information, see the following sections:

   • Section 7.3, “Example settings for LDAP connections”
   • Section 7.4, “Example LDAP filters”
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes.
7. On the Locations tab, select the locations you want Satellite to assign to users created from the LDAP authentication source. These locations are available to users after they log in for the first time.
8. On the Organizations tab, select the organizations you want Satellite to assign to users created from the LDAP authentication source. These locations are available to users after they log in for the first time.
9. Click Submit.