Server Administration Guide

Procedure 3.1. To Create an Organization:

1. Navigate to Administer → Organizations.
2. Click New Organization.
3. In the Name field, insert the name of the new organization.
4. In the Label field, insert the label of the new organization.
5. In the Description field, insert a description of the new organization.
6. Click Submit.
7. Select the hosts to assign to the new organization.
   • Click Assign All to assign all hosts with no organization to the new organization.
   • Click Manually Assign to manually select and assign the hosts with no organization.
   • Click Proceed to Edit to skip assigning hosts.
8. Specify the configuration details of the organization such as Capsule Servers, subnets or compute resources. You can modify these settings later as described in Section 3.1.4, “Editing an Organization”.
9. Click Submit.

Procedure 3.2. To Create a New Organization Debug Certificate:

1. Navigate to Administer → Organizations.
2. Select an organization for which you want to generate a debug certificate.
3. Click Generate and Download. This generates a debug certificate.
4. Save the certificate file in a secure location.

Procedure 3.3. To Use an Organization Debug Certificate in Firefox:

1. Create and download an organization certificate as described in Procedure 3.2, “To Create a New Organization Debug Certificate:”.
2. Open the X.509 certificate, for example, for the default organization: Copy to Clipboard Toggle word wrap

   $ vi 'Default Organization-key-cert.pem'

3. Copy the contents of the file from -----BEGIN RSA PRIVATE KEY----- to -----END RSA PRIVATE KEY----- inclusive, into a file called key.pem.
4. Copy the contents of the file from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- inclusive, into a file called cert.pem.
5. Enter a command as follows to create a PKCS12 format certificate and enter a password or phrase when prompted: Copy to Clipboard Toggle word wrap

   $ openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in cert.pem -inkey key.pem -out organization_label.pfx -name 'organization_name'
   Enter Export Password:
   Verifying - Enter Export Password:

6. Using the preferences tab, import the resulting pfx file into your browser: Navigate to Edit → Preferences → Advanced Tab. Select View Certificates in the Certificates view to open the Certificate Manager. On the Your Certificates tab, click Import and select the pfx file to load. You will be prompted for the password or phrase used when making the certificate.
7. Enter a URL in the following format into your browser's address bar to begin browsing for repositories: Copy to Clipboard Toggle word wrap

   http://satellite.example.com/pulp/repos/organization_label

   Pulp uses the organization label so the URL must use the organization label too.

Procedure 3.4. To Use an Organization Debug Certificate with curl:

1. Create and download an organization certificate as described in Procedure 3.2, “To Create a New Organization Debug Certificate:”.
2. Open the X.509 certificate, for example, for the default organization: Copy to Clipboard Toggle word wrap

   $ vi 'Default Organization-key-cert.pem'

3. Copy the contents of the file from -----BEGIN RSA PRIVATE KEY----- to -----END RSA PRIVATE KEY----- inclusive, into a file called key.pem.
4. Copy the contents of the file from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- inclusive, into a file called cert.pem.
5. Find a valid URL for a repository. You can use the browsing method described in the previous procedure or use the web UI. For example, using the web UI, navigate to Content → Products and select a Product by name. On the Repositories tab, select a repository by name and look for the Published At entry.
6. To use curl to access a repository, use a command as follows: Copy to Clipboard Toggle word wrap

   $ curl -k --cert cert.pem --key key.pem http://satellite.example.com/pulp/repos/Default_Organization/Library/content/dist/rhel/server/7/7Server/x86_64/sat-tools/6.2/os/

   Ensure the paths to cert.pem and key.pem are the correct absolute paths otherwise the command will fail silently.

Procedure 3.5. To Edit an Organization:

1. Navigate to Administer → Organizations.
2. Click the name of the organization to be edited.
3. Select the resource to edit from the list on the left.
4. Click the name of the desired items to add them to the Selected Items list.
5. Click Submit.

Procedure 3.6. To Remove an Organization:

1. Navigate to Administer → Organizations.
2. Select Delete from the drop-down menu to the right of the name of the organization you want to remove.
3. An alert box appears:
   Copy to Clipboard Toggle word wrap

   Delete Organization?

4. Click OK to delete the organization.

Procedure 3.7. To Create a Location:

1. Navigate to Administer → Locations.
2. Click New Location.
3. Insert the name of the new location in the Name field. If you want to create a nested location, select a Parent location from the drop-down menu. Optionally, specify a Description of the location. Click Submit.
4. Select the hosts to assign to the new location.
   • Click Assign All to assign all hosts with no location to the new location.
   • Click Manually Assign to manually select and assign the hosts with no location.
   • Click Proceed to Edit to skip assigning hosts.
5. Specify the configuration details of the location such as Capsule Servers, subnets or compute resources. You can modify these settings later as described in Section 3.2.2, “Editing a Location”.
6. Click Submit.

Procedure 3.8. To Edit a Location:

1. Navigate to Administer → Locations.
2. Click the name of the location to be edited.
3. Select the resource to edit from the list on the left.
4. Click the name of the desired items to add them to the Selected Items list.
5. Click Submit.

Procedure 3.9. To Remove a Location:

1. Navigate to Administer → Locations.
2. Select Delete from the drop-down menu to the right of the name of the location you want to remove.
   An alert box appears:
   Copy to Clipboard Toggle word wrap

   Delete Location?

3. Click OK.

Procedure 3.10. To Create a Life Cycle Environment:

1. Select an organization from the menu in the top left hand corner.
2. Click Content → Life Cycle Environments and then click New Environment Path.
3. Insert a name and a label (automatically fills in the Name field input) for the life cycle environment. The Description field is optional.
4. Click Save to create the environment.

Procedure 3.11. To Add Environments to the Satellite Capsule Server:

1. Log in to the Satellite Server CLI as root.
2. Choose the desired Red Hat Satellite Capsule Server from the list and take note of its id:
   Copy to Clipboard Toggle word wrap

   # hammer capsule list
   

   The Satellite Capsule Server's details can be verified using the command:
   Copy to Clipboard Toggle word wrap

   # hammer capsule info --id capsule_id_number

3. Verify the list of life cycle environments available for the Red Hat Capsule Server and note down the environment id:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content available-lifecycle-environments --id capsule_id_number

   Where:
   • available-lifecycle-environments are life cycle environments that are available to the Satellite Capsule but are currently not attached to the Satellite Capsule.
4. Add the life cycle environment to the Satellite Capsule Server:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content add-lifecycle-environment --id capsule_id_number --environment-id environment_id_number

   Where:
   • capsule_id_number stands for the Satellite Capsule Server's identification number.
   • environment_id_number stands for the life cycle environment's identification number.
   Repeat this step for every life cycle environment to be added to the Capsule Server.
5. Synchronize the content from the Satellite Server's environment to the Satellite Capsule Server:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content synchronize --id capsule_id_number

   When an external Satellite Capsule Server has various life cycle environments, and only one life cycle environment needs to be synchronized, it is possible to target a specific environment by specifying the environment identification number:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content synchronize --id external_capsule_id_number --environment-id environment_id_number

Procedure 3.12. To Promote a Content View:

1. On the main menu, click Content → Content Views.
2. In the Name column, click the name of the Content View that you want to promote.
3. On the Versions tab, identify the latest version, and click Promote.
4. Identify the promotion path where you want to promote the Content View, select the appropriate life cycle environment, and click Promote Version.
5. After the promotion has completed, the Versions tab updates to display the new status of your Content Views.

Procedure 3.13. To Remove a Life Cycle Environment:

1. On the main menu, click Content → Life Cycle Environments.
2. Click the name of the life cycle environment that you want to remove, and then click Remove Environment.
3. In the confirmation dialog box, click Remove to remove the environment.

Procedure 3.14. To remove a life cycle environment from Capsule Server:

1. Log in to the Satellite Server CLI as the root user.
2. Choose the desired Capsule Server from the list and take note of its id:
   Copy to Clipboard Toggle word wrap

   # hammer capsule list

   The Capsule Server's details can be verified using the command:
   Copy to Clipboard Toggle word wrap

   # hammer capsule info --id capsule_id_number

3. Verify the list of life cycle environments currently attached to the Capsule Server and take note of the environment id:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content lifecycle-environments --id capsule_id_number

4. Remove the life cycle environment from Capsule Server:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content remove-lifecycle-environment --id capsule_id_number --environment-id environment_id

   Where:
   • capsule_id_number is Capsule Server's identification number.
   • environment_id is the life cycle environment's identification number.
   Repeat this step for every life cycle environment to be removed from the Capsule Server.
5. Synchronize the content from the Satellite Server's environment to Capsule Server:
   Copy to Clipboard Toggle word wrap

   # hammer capsule content synchronize --id capsule_id_number

Procedure 4.1. To Create a User:

1. Navigate to Administer → Users and then click New User.
2. On the User tab, enter the required details.
3. On the Locations tab, select the required locations for this user.
4. On the Organizations tab, select organizations accessible to this user. The current active organization is selected by default. If you specify multiple organizations, you can select the default organization for user login from the drop-down list.
5. On the Roles tab, select the required roles for this user. Active roles are displayed in the right panel.
6. Click Submit to create the user.

Procedure 4.2. To Edit an Existing User:

1. Navigate to Administer → Users.
2. Click the user name of the user to be altered. General information about the user will appear on the right.
3. In the User tab, you can modify the user's user name, first name, surname, email address, default location, default organization, language, and password.
4. In the Locations tab, you can modify the user's assigned locations.
5. In the Organizations tab, you can modify the user's assigned organizations.
6. In the Roles tab, you can modify the user's assigned roles.
7. Click Save to save your changes.

Procedure 4.3. To Assign a Role to a User:

1. Navigate to Administer → Users. If a user account created is not listed, check that you are currently viewing the right organization. To list all users in Satellite, click Default Organization and then Any Organization. The organization view is changed to Any Context.
2. Click the user name of the user that you want to modify. General information about the user appears on the right.
3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available role assignments.
6. Select role you want to assign to the user in the Roles list. The list contains the predefined roles, as well as any custom roles, see Table 4.1, “Predefined Roles Available in Red Hat Satellite”. Alternatively, select the Administrator check box to assign all available permissions to the selected user.
7. Click Save.

Procedure 4.4. To Configure Email Notifications:

1. Navigate to Administer → Users.
2. Click the Username of the user you want to edit.
3. On the User tab, check the Email address field. Ensure that it contains a valid email address. The address will be associated with the user account, and the notifications selected in the following steps will be sent there.
4. Click the Email Preferences tab and select Mail enabled to enable email notifications.
5. Select the notifications you want the user to receive.
   • Audit summary is a summary of all activity audited by the Satellite Server. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates. Enter a query in the associated query field to narrow the audit activity included.
   • Host built is a notification sent when a host is built. To enable these notifications, select Subscribe from the drop-down menu.
   • Host errata advisory is a summary of applicable and installable errata for hosts managed by the user. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • OpenSCAP policy summary is a summary of OpenSCAP policy reports and their results. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Promote errata is a notification sent only after a Content View promotion. It contains a summary of errata applicable and installable to hosts registered to the promoted Content View. This allows you to monitor what updates have been applied to which hosts. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet error state is a notification sent after a host reports an error related to Puppet. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet summary is a summary of Puppet reports. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Sync errata is a notification sent only after synchronizing a repository. It contains a summary of new errata introduced by the synchronization. To enable these notifications, select Subscribe from the drop-down menu.
6. Click Submit.

Procedure 4.5. To Remove a User:

1. On the main menu, click Administer → Users to open the Users page.
2. Click the Delete link to the right of the user name you want to delete.
3. In the alert box, click OK to delete the user.

Procedure 4.7. To Create a Role:

1. Navigate to Administer → Roles.
2. Click New Role.
3. Provide a Name for the role.
4. Click Submit to save your new role.

Procedure 4.8. To Add Permissions to a Role:

1. Navigate to Administer → Roles.
2. Select Add Filter from the drop-down list to the right of the required role.
3. Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.
4. Click the permissions you want to select from the Permission list.
5. Select whether the permission is Unlimited. This option is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited check box, the Search field activates. In this field you can specify further filtering with use of the Red Hat Satellite 6 search syntax. See Section 4.4, “Granular Permission Filtering” for details.
6. Click Next.
7. Click Submit to save changes.

Procedure 4.9. To View Permissions Associated with a Role:

1. Navigate to Administer → Roles.
2. Click Filters to the right of the required role to get to the Filters page.

Procedure 4.10. To Create a Complete Permission Table:

1. Ensure that the required packages are installed. Execute the following command on the Satellite Server:
   Copy to Clipboard Toggle word wrap

   # yum install tfm-rubygem-foreman*

2. Start the Satellite console with the following command:
   Copy to Clipboard Toggle word wrap

   # foreman-rake console

   Insert the following code into the console:
   Copy to Clipboard Toggle word wrap

   f = File.open('/tmp/table.html', 'w')
   
   result = Foreman::AccessControl.permissions.sort {|a,b| a.security_block <=> b.security_block}.collect do |p|
         actions = p.actions.collect { |a| "<li>#{a}</li>" }
         "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
   end.join("\n")
   
   f.write(result)

   The above syntax creates a table of permissions and saves it to the /tmp/table.html file.
3. Press Ctrl+D to exit the Satellite console. Insert the following text at the first line of /tmp/table.html:
   Copy to Clipboard Toggle word wrap

   <table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

   Append the following text at the end of /tmp/table.html:
   Copy to Clipboard Toggle word wrap

   </table>

4. Open /tmp/table.html in a web browser to view the table.

Procedure 4.11. To Remove a Role:

1. Navigate to Administer → Roles.
2. Select Delete from the drop-down list to the right of the role to be deleted.
3. In an alert box that appears, click OK to delete the role.

Procedure 5.8. Rename a Satellite Server

1. On the Satellite Server, run the katello-change-hostname script, providing the host's new name, and Satellite credentials.
   Copy to Clipboard Toggle word wrap

   # katello-change-hostname new_satellite --username admin \
   --password password

   The message **** Hostname change complete! **** confirms that the rename completed successfully.
2. (Optional) If you have obtained a new X.509 certificate for the Satellite Server's new host name, run the Satellite installation script to install the certificate. For more information on installing a custom X.509 certificate, see Configuring Satellite Server with a Custom Server Certificate in the Installation Guide.
3. On all Capsule Servers and hosts registered to the Satellite Server, reinstall the bootstrap RPM and re-register them to the Satellite Server. Substitute the example organization and environment values with those matching your environment.
   1. Copy to Clipboard Toggle word wrap

      # yum remove -y katello-ca-consumer*
      

   2. Copy to Clipboard Toggle word wrap

      # rpm -Uvh http://new-satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
      

   3. Copy to Clipboard Toggle word wrap

      # subscription-manager register --org="Default_Organization" \
      --environment="Library" \
      --force
      

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For details, see Running Jobs on Satellite Hosts in the Host Configuration Guide.
4. Reattach subscriptions to all Capsule Servers and hosts registered to the Satellite Server, then refresh the subscription.
   1. Copy to Clipboard Toggle word wrap

      # subscription-manager refresh
      

   2. Copy to Clipboard Toggle word wrap

      # yum repolist
      

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For details, see Running Jobs on Satellite Hosts in the Host Configuration Guide.
5. On all Capsule Servers, re-run the Satellite installation script to update references to the new host name.
   Copy to Clipboard Toggle word wrap

   # satellite-installer --capsule-parent-fqdn new-satellite.example.com \
   --foreman-proxy-foreman-base-url  https://new-satellite.example.com \
   --foreman-proxy-trusted-hosts new-satellite.example.com

Procedure 5.9. Rename a Capsule Server

1. On the Satellite Server, create a new certificates archive file.
   1. If you are using the default Satellite Server certificate:
      Copy to Clipboard Toggle word wrap

      # capsule-certs-generate --capsule-fqdn "new-capsule.example.com" \
      --certs-tar "new-capsule.example.com-certs.tar"
      

   2. If you are using a custom X.509 certificate on the Capsule Server, see Create the Capsule Server's Certificate Archive File in the Installation Guide.
2. On the Satellite Server, copy the certificates archive file to the Capsule Server, providing the root user’s password when prompted. In this example the archive file is copied to the root user’s home directory, but you may prefer to copy it elsewhere.
   Copy to Clipboard Toggle word wrap

   # scp /root/new-capsule.example.com-certs.tar root@capsule.example.com:
   

3. On the Capsule Server, run the katello-change-hostname script, providing the host's new name, Satellite credentials, and certificates archive filename.
   Copy to Clipboard Toggle word wrap

   # katello-change-hostname new_capsule --username admin \
   --password password \
   --certs-tar new-capsule.example.com-certs.tar

   The message **** Hostname change complete! **** confirms that the rename completed successfully.
4. (Optional) If you have obtained a new X.509 certificate in the Capsule Server's new host name, run the Satellite installation script to install the certificate. For more information on installing a custom X.509 certificate, see Configuring Satellite Server with a Custom Server Certificate in the Installation Guide.
5. On all hosts registered to the Capsule Server, reinstall the bootstrap RPM and re-register them to the Capsule Server. Substitute the example organization and environment values with those matching your environment.
   1. Copy to Clipboard Toggle word wrap

      # yum remove -y katello-ca-consumer*
      

   2. Copy to Clipboard Toggle word wrap

      # rpm -Uvh http://new-capsule.example.com/pub/katello-ca-consumer-latest.noarch.rpm
      

   3. Copy to Clipboard Toggle word wrap

      # subscription-manager register --org="Default_Organization" \
      --environment="Library" \
      --force
      

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For details, see Running Jobs on Satellite Hosts in the Host Configuration Guide.
6. Reattach subscriptions to all hosts registered to the Capsule Server, then refresh the subscription.
   1. Copy to Clipboard Toggle word wrap

      # subscription-manager refresh
      

   2. Copy to Clipboard Toggle word wrap

      # yum repolist
      

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For details, see Running Jobs on Satellite Hosts in the Host Configuration Guide.
7. Edit the Capsule Server's name.
   1. In the Satellite web UI, navigate to Infrastructure → Capsules.
   2. Find the Capsule Server in the list, and click Edit in that row.
   3. Edit the Name and URL fields to match the Capsule Server's new host name, then click Submit.
8. On your DNS server, add a record for the Capsule Server's new host name, and delete the record for the previous host name.

Procedure 6.1. To Search for Solutions from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access → Search.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.
3. In the Red Hat Search field, enter your search query. Search results display in the left-hand Recommendations list.
4. In the Recommendations list, click a solution. The solution article displays in the main panel.

Procedure 6.2. To Use the Logs Diagnostic Tool from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access → Logs.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.
3. In the left file tree, select a log file and click the file name.
4. Click Select File. A pop-up window displays the log file contents.
5. In the log file, highlight any text sections you want diagnosed. The Red Hat Diagnose button displays.
6. Click Red Hat Diagnose. The system sends the highlighted information to the Red Hat Customer Portal, and provides solutions that closely match the provided log information.
7. If a solution does the following:
   • Matches the problem, click the solution and follow the required steps to troubleshoot the issue.
   • Does not match the problem, click Open a New Support Case. The support case is populated with the highlighted text from the log file. See Section 6.5.5, “Creating Support Cases Using the Red Hat Access Plug-in”.

Procedure 6.3. To View Existing Support Cases from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access → Support → My Cases.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.
3. To search for a specific support case from existing cases, do any of the following:
   1. In the Search field, provide a key word or phrase.
   2. From the drop-down list, choose a specific Case Group. Your organization has defined Case Groups inside the Red Hat Customer Portal.
   3. Choose a Case Status.
4. From the results, choose a specific support case and click the Case ID. The support case is ready to view.

Procedure 6.4.  To Update Support Cases from the Red Hat Satellite Server Web UI:

1. Complete the instructions from Section 6.5.3, “Viewing Existing Support Cases Using the Red Hat Access Plug-in”
2. In the support case, scroll down to the marked sections to do the following:
   • Attachments: - Attach a local file from the system. Add a file name to make it easier to identify.

     Note

     File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.
   • Case Discussion: - Add any updated information about the case you wish to discuss with Global Support Services. After adding information, click Add Comment.

Procedure 6.5. To Create a New Support Case Using the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access → Support → New Case.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.
3. The Product and Product Version fields are automatically populated. Complete the other relevant fields, as follows:
   • Summary — Provide a brief summary of the issue.
   • Description — Write a detailed description of the issue.
   Based on the summary provided, recommendations for possible solutions display in the main panel.
4. Click Next.
5. Choose the appropriate options, as follows:
   • Severity — Select the ticket urgency as 4 (low), 3 (normal), 2 (high), or 1 (urgent).
   • Case Group — Based on who needs to be notified, create case groups associated with the support case. Select Case Groups in Red Hat Satellite. Create Case Groups within the Customer Portal.
6. Attach the output of sosreport and any required files. Add a file description and click Attach.

   Note

   • If you have large log files or many Satellite tasks, it is recommended to also attach the output of foreman-debug.
   • File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.
7. Click Submit. The system uploads the case to the Customer Portal, and provides a case number for your reference.

Procedure 8.1. To Configure LDAP Authentication:

1. Set the allow Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

   • For Red Hat Enterprise Linux 6: Copy to Clipboard Toggle word wrap

     # setsebool -P allow_ypbind on

   • For Red Hat Enterprise Linux 7: Copy to Clipboard Toggle word wrap

     # setsebool -P nis_enabled on

2. Navigate to Administer → LDAP Authentication.
3. Click New authentication source.
4. On the LDAP server tab, enter the LDAP server's name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS check box to enable encryption. The port should change to 636, which is the default for LDAPS.
5. On the Account tab, enter the account information and domain name details. See Section 8.1.3, “LDAP Setting Descriptions and Examples” for descriptions and examples.
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes. You can map Login name, First name, Surname, Email address, and Photo attributes. See Section 8.1.3, “LDAP Setting Descriptions and Examples” for examples.
7. On the Locations tab, select locations from the left table. Selected locations will be assigned to users created from the LDAP authentication source, and available after their first login.
8. On the Organizations tab, select organizations from the left table. Selected organizations will be assigned to users created from the LDAP authentication source, and available after their first login.
9. Click Submit.

Procedure 8.2. To Configure IdM Authentication on the Satellite Server:

1. On the IdM server, create a host entry for the Satellite Server and generate a one-time password, for example:
   Copy to Clipboard Toggle word wrap

   # ipa host-add --random hostname

   Note

   The generated one-time password must be used on the client to complete IdM-enrollment.
   For more information on host configuration properties, see Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy Guide^[5].
2. Create an HTTP service for the Satellite Server, for example:
   Copy to Clipboard Toggle word wrap

   # ipa service-add servicename/hostname

   For more information on managing services, see Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy Guide^[6].
3. On the Satellite Server, execute the following command as root to configure IdM-enrollment:
   Copy to Clipboard Toggle word wrap

   # ipa-client-install --password OTP

   Replace OTP with the one-time password provided by the IdM administrator.
4. If the Satellite Server is running on Red Hat Enterprise Linux 7, execute the following command:
   Copy to Clipboard Toggle word wrap

   # subscription-manager repos --enable rhel-7-server-optional-rpms

   The installer is dependent on packages which, on Red Hat Enterprise Linux 7, are in the optional repository rhel-7-server-optional-rpms. On Red Hat Enterprise Linux 6 all necessary packages are in the base repository.
5. Execute the following command:
   Copy to Clipboard Toggle word wrap

   # satellite-installer --foreman-ipa-authentication=true

   This command is not limited to a fresh Satellite installation; you can use it to modify an existing Satellite installation.
6. Restart Katello services:
   Copy to Clipboard Toggle word wrap

   # katello-service restart

Procedure 8.3. To Configure HBAC:

1. Create HBAC service and rule on the IdM server and link them together. The following examples use the PAM service name satellite-prod. Execute the following commands on the IdM server:
   Copy to Clipboard Toggle word wrap

   $ ipa hbacsvc-add satellite-prod
   $ ipa hbacrule-add allow_satellite_prod
   $ ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod
   

2. Add the user who is to have access to the service satellite-prod, and the host name of the Satellite Server:
   Copy to Clipboard Toggle word wrap

   $ ipa hbacrule-add-user allow_satellite_prod --user=username
   $ ipa hbacrule-add-host allow_satellite_prod --hosts=the-satellite-fqdn

   Alternatively, host groups and user groups can be added to the allow_satellite_prod rule.
3. To check the status of the rule, execute:
   Copy to Clipboard Toggle word wrap

   $ ipa hbacrule-find satellite-prod
   $ ipa hbactest --user=username --host=the-satellite-fqdn --service=satellite-prod
   

4. Ensure the allow_all rule is disabled on the IdM server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal^[8].
5. Configure the IdM integration with the Satellite Server as described in Procedure 8.2, “To Configure IdM Authentication on the Satellite Server:”. On the Satellite Server, define the PAM service as root:
   Copy to Clipboard Toggle word wrap

   # satellite-installer --foreman-pam-service=satellite-prod
   

Procedure 8.4. To Enroll the Satellite Server with the AD Server:

1. Install the required packages:
   Copy to Clipboard Toggle word wrap

   # yum install sssd adcli realmd ipa-python

2. Enroll the Satellite Server with the AD server. You may need to have administrator permissions to perform the following command:
   Copy to Clipboard Toggle word wrap

   # realm join -v EXAMPLE.ORG

Procedure 8.5. To Configure Direct AD Integration with GSS-proxy:

1. Create the /etc/ipa/default.conf file with the following content:
   Copy to Clipboard Toggle word wrap

   [global]
   server = unused
   realm = EXAMPLE.ORG

2. Create the /etc/net-keytab.conf file with the following content:
   Copy to Clipboard Toggle word wrap

   [global]
   workgroup = EXAMPLE
   realm = EXAMPLE.ORG
   kerberos method = system keytab
   security = ads

3. Create the /etc/gssproxy/00-http.conf file with the following content:
   Copy to Clipboard Toggle word wrap

   [service/HTTP]
   mechs = krb5
   cred_store = keytab:/etc/krb5.keytab
   cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
   euid = 48

4. Insert the following line at the beginning of the /etc/krb5.conf file:
   Copy to Clipboard Toggle word wrap

   includedir /var/lib/sss/pubconf/krb5.include.d/

5. Enable IPA authentication in Satellite:
   Copy to Clipboard Toggle word wrap

   # satellite-installer --foreman-ipa-authentication=true

6. Start and enable the gssproxy service:
   Copy to Clipboard Toggle word wrap

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

7. Configure Apache HTTPD Server to use the gssproxy service:
   1. Create the /etc/systemd/system/httpd.service file with the following content:
      Copy to Clipboard Toggle word wrap

      .include /lib/systemd/system/httpd.service
        [Service]
        Environment=GSS_USE_PROXY=1

   2. Apply changes to the service:
      Copy to Clipboard Toggle word wrap

      # systemctl daemon-reload

8. Start and enable the httpd service:
   Copy to Clipboard Toggle word wrap

   # systemctl restart httpd.service

   With a running Apache HTTP Server, users making HTTP requests against the server are authenticated if the client has a valid Kerberos ticket.

Procedure 8.7. To configure the Satellite Server or Capsule Server for IdM Realm Support:

1. On the Satellite Server or Capsule Server, install the following packages:
   Copy to Clipboard Toggle word wrap

   # yum install ipa-client foreman-proxy ipa-admintools

2. Configure the Satellite Server (or Capsule Server) as an IdM client:
   Copy to Clipboard Toggle word wrap

   # ipa-client-install

3. Create a realm-capsule user and the relevant roles in Red Hat Identity Management on the Satellite Server or Capsule Server:
   Copy to Clipboard Toggle word wrap

   # foreman-prepare-realm admin realm-capsule

   Running foreman-prepare-realm will prepare an IdM server for use with the Capsule Server. It creates a dedicated role with the permissions needed for Satellite, creates a user with that role and retrieves the keytab file. You will need your Identity Management server configuration details on this step.
   If the command successfully executes, you should be able to see the following command output:
   Copy to Clipboard Toggle word wrap

   Keytab successfully retrieved and stored in: freeipa.keytab
   Realm Proxy User:    realm-capsule
   Realm Proxy Keytab:  /root/freeipa.keytab
   

   Note

   To configure Satellite Server and at least one external Capsule Server for IdM Realm support with the same principal and realm, you must copy the /root/freeipa.keytab file to all the previously joined Capsule Servers after running the foreman-prepare-realm script.

   Copy to Clipboard Toggle word wrap

   # scp /root/freeipa.keytab your_username@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

4. Move the /root/freeipa.keytab to the /etc/foreman-proxy directory and set the ownership settings to the user foreman-proxy:
   Copy to Clipboard Toggle word wrap

   # mv /root/freeipa.keytab /etc/foreman-proxy
   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab
   

5. Configure the realm based on whether you are using Satellite Server or Capsule Server:
   • If you are using the integrated capsule Server in the Satellite Server, use satellite-installer to configure the realm:
     Copy to Clipboard Toggle word wrap

     # satellite-installer --foreman-proxy-realm true \
     --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
     --foreman-proxy-realm-principal 'realm-capsule@EXAMPLE.COM' \
     --foreman-proxy-realm-provider freeipa
     

     Note

     You can also run these options when you first configure the Red Hat Satellite Server.
   • If you are using an independent Capsule Server, use satellite-installer --scenario-capsule to configure the realm:
     Copy to Clipboard Toggle word wrap

     # satellite-installer --scenario-capsule --realm true \
     --realm-keytab /etc/foreman-proxy/freeipa.keytab \
     --realm-principal 'realm-capsule@EXAMPLE.COM' \
     --realm-provider freeipa
     

6. Make sure that the most updated versions of the ca-certificates package is installed and trust the IdM Certificate Authority:
   Copy to Clipboard Toggle word wrap

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust enable
   # update-ca-trust
   

7. (Optional) If you are configuring IdM on an already existing Satellite Server or Capsule Server, the following steps should also be taken to make sure that the configuration changes take effect:
   1. Restart the foreman-proxy service:
      Copy to Clipboard Toggle word wrap

      # service foreman-proxy restart

   2. Log in to the Satellite Server and click Infrastructure → Capsules.
   3. Click on the drop-down menu on the right-hand side of the Capsule Server you have configured for IdM and choose Refresh Features.
8. Finally, create a new realm entry in the Satellite Server user interface:
   1. Click Infrastructure → Realms and on the right-hand corner of the main page, click New Realm.
   2. Fill in the fields in the following subtabs:
      1. On the Realm subtab, provide the realm name, the type of realm to use and the realm proxy.
      2. On the Locations subtab, choose the locations where the new realm is intended for use.
      3. On the Organizations subtab, choose the organizations where the new realm is intended for use.
   3. Click Submit.

Procedure 8.8. To Add Hosts to an IdM Host Group:

1. On the IdM server, create a host group:
   Copy to Clipboard Toggle word wrap

   # ipa hostgroup-add hostgroup_name
   Description: hostgroup_description
   ----------------------------
   Added hostgroup "hostgroup_name"
   ----------------------------
   Host-group: hostgroup_name
   Description: hostgroup_description

   Where:
   1. hostgroup_name is the host group's name.
   2. hostgroup_description is the host group's description.
2. Create an automembership rule:
   Copy to Clipboard Toggle word wrap

   # ipa automember-add --type=hostgroup automember_rule
   ----------------------------------
   Added automember rule "automember_rule"
   ----------------------------------
   Automember Rule: automember_rule

   Where:
   1. automember-add flags the group as an automember group.
   2. --type=hostgroup identifies that the target group is a host group, not a user group.
   3. automember_rule is the name you wish to identify the automember rule by.
3. Define an automembership condition based on the userclass attribute:
   Copy to Clipboard Toggle word wrap

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------
   

   Where:
   1. automember-add-condition allows you to add regular expression conditions to identify group members.
   2. --key=userclass specifies the key attribute as userclass.
   3. --type=hostgroup identifies that the target group is a host group, not a user group.
   4. --inclusive-regex=^webserver is a regular expression pattern to identify matching values.
   5. hostgroup_name is the target host group's name.