Chapter 6. Configuring Kerberos SSO for Active Directory users in Satellite

Procedure

1. Install the following packages on Satellite Server:

   # satellite-maintain packages install adcli krb5-workstation oddjob-mkhomedir oddjob realmd samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator sssd

2. Join the system to the AD domain, specifying the required software:

   # realm join AD.EXAMPLE.COM --membership-software=samba --client-software=sssd

Procedure

1. Define AD realm configuration in a location where Satellite expects it:

   1. Create a directory named /etc/ipa/:

      # mkdir /etc/ipa/

   2. Create the /etc/ipa/default.conf file with the following contents to configure the Kerberos realm for the AD domain:

      [global]
      realm = AD.EXAMPLE.COM

2. Configure the Apache keytab for Kerberos connections:

   1. Update the /etc/samba/smb.conf file with the following settings to configure how Samba interacts with AD:

      [global]
      workgroup = AD.EXAMPLE
      realm = AD.EXAMPLE.COM
      kerberos method = system keytab
      security = ads

   2. Add the Kerberos service principal to the keytab file at /etc/httpd/conf/http.keytab:

      # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab create HTTP -U Administrator -s /etc/samba/smb.conf

      Note

      The net ads keytab create command was introduced in Samba version 4.21.1. If your system uses an earlier version of Samba, use the net ads keytab add command.

3. Configure the System Security Services Daemon (SSSD) on your Satellite Server:

   1. Configure the AD access control provider to evaluate and enforce Group Policy Object (GPO) access control rules for the foreman PAM service. In the [domain/ad.example.com] section of your /etc/sssd/sssd.conf file, set the ad_gpo_access_control and ad_gpo_map_service options as follows:

      [domain/ad.example.com]
      ad_gpo_access_control = enforcing
      ad_gpo_map_service = +foreman

      For more information on GPOs, see How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 9).

   2. If your Satellite Server runs in an IPv6-only network and also runs on RHEL 9.6 and earlier or RHEL 10.0, set the lookup_family_order option in the [domain/ad.example.com] section of the /etc/sssd/sssd.conf file:

      [domain/ad.example.com]
      lookup_family_order = ipv6_only

      If the DNS name of the AD server can be translated to both an IPv4 and IPv6 address but the IPv4 address is not accessible, SSSD requires lookup_family_order to translate the DNS name correctly. Without the option, AD users are unable to use kinit to authenticate to Satellite.

   3. Restart SSSD:

      # systemctl restart sssd

4. Enable the authentication source:

   # satellite-installer --foreman-ipa-authentication true