Administering Red Hat Satellite

Procedure

1. Navigate to Administer > Users.
2. Click Create User.
3. In the Login field, enter a username for the user.
4. In the Firstname and Lastname fields, enter the real first name and last name of the user.
5. In the Mail field, enter the user’s email address.
6. In the Description field, add a description of the new user.
7. Select a specific language for the user from the Language list.

8. Select a timezone for the user from the Timezone list.

   By default, Satellite Server uses the language and timezone settings of the user’s browser.

9. Set a password for the user:

   1. From the Authorized by list, select the source by which the user is authenticated.

      • INTERNAL: to enable the user to be managed inside Satellite Server.
      • LDAP or IdM: to configure external authentication as described in Chapter 13, Configuring External Authentication.
   2. Enter an initial password for the user in the Password field and the Verify field.
10. Click Submit to create the user.

Procedure

1. Navigate to Administer > Users.

2. Click the username of the user to be assigned one or more roles.

   Note

   If a user account is not listed, check that you are currently viewing the correct organization. To list all the users in Satellite, click Default Organization and then Any Organization.

3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available roles.

6. Select the roles to assign from the Roles list.

   To grant all the available permissions, select the Admin check box.

7. Click Submit.

Procedure

1. Navigate to Administer > Users.
2. From the Username column, click on the username of the required user.

3. Click on the SSH Keys tab.

   • To Add SSH key

     1. Prepare the content of the public SSH key in a clipboard.
     2. Click Add SSH Key.
     3. In the Key field, paste the public SSH key content from the clipboard.
     4. In the Name field, enter a name for the SSH key.
     5. Click Submit.

   • To Remove SSH key

     1. Click Delete on the row of the SSH key to be deleted.
     2. Click OK in the confirmation prompt.

Procedure

1. Navigate to Administer > Users.
2. Click the Username of the user you want to edit.
3. On the User tab, verify the value of the Mail field. Email notifications will be sent to the address in this field.
4. On the Email Preferences tab, select Mail Enabled.

5. Select the notifications you want the user to receive using the drop-down menus next to the notification types.

   Note

   The Audit Summary notification can be filtered by entering the required query in the Mail Query text box.

6. Click Submit.

   The user will start receiving the notification emails.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Click on the username.

3. On the Email Preferences tab, click Test email.

   A test email message is sent immediately to the user’s email address.

1. Verify the user’s email address.
2. Verify Satellite Server’s email configuration.
3. Examine firewall and mail server logs.

Procedure

1. Navigate to Administer > User Groups.
2. Click Create User group.

3. On the User Group tab, specify the name of the new user group and select group members:

   • Select the previously created user groups from the User Groups list.
   • Select users from the Users list.
4. On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Admin check box to assign all available permissions.
5. Click Submit.

Procedure

1. Navigate to Administer > User Groups.
2. Click Delete to the right of the user group you want to delete.
3. In the alert box that appears, click OK to delete a user group.

Procedure

1. Navigate to Administer > Roles.
2. Click Create Role.
3. Provide a Name for the role.
4. Click Submit to save your new role.

Procedure

1. Navigate to Administer > Roles and select Clone from the drop-down menu to the right of the required role.
2. Provide a Name for the role.
3. Click Submit to clone the role.
4. Click the name of the cloned role and navigate to Filters.
5. Edit the permissions as required.
6. Click Submit to save your new role.

Procedure

1. Navigate to Administer > Roles.
2. Select Add Filter from the drop-down list to the right of the required role.
3. Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.
4. Click the permissions you want to select from the Permission list.
5. Depending on the Resource type selected, you can select or deselect the Unlimited and Override check box. The Unlimited checkbox is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited check box, the Search field activates. In this field you can specify further filtering with use of the Red Hat Satellite 6 search syntax. See Section 5.4, “Granular Permission Filtering” for details. When you enable the Override check box, you can add additional locations and organizations to allow the role to access the resource type in the additional locations and organizations; you can also remove an already associated location and organization from the resource type to restrict access.
6. Click Next.
7. Click Submit to save changes.

Procedure

1. Navigate to Administer > Roles.
2. Click Filters to the right of the required role to get to the Filters page.

Procedure

1. Ensure that the required packages are installed. Execute the following command on the Satellite Server:

   # yum install tfm-rubygem-foreman*

2. Start the Satellite console with the following command:

   # foreman-rake console

   Insert the following code into the console:

   f = File.open('/tmp/table.html', 'w')
   
   result = Foreman::AccessControl.permissions {|a,b| a.security_block <=> b.security_block}.collect do |p|
         actions = p.actions.collect { |a| "<li>#{a}</li>" }
         "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
   end.join("\n")
   
   f.write(result)

   The above syntax creates a table of permissions and saves it to the /tmp/table.html file.

3. Press Ctrl + D to exit the Satellite console. Insert the following text at the first line of /tmp/table.html:

   <table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

   Append the following text at the end of /tmp/table.html:

   </table>

4. Open /tmp/table.html in a web browser to view the table.

Procedure

1. Navigate to Administer > Roles.
2. Select Delete from the drop-down list to the right of the role to be deleted.
3. In an alert box that appears, click OK to delete the role.

Procedure

1. Navigate to Configure > Environments.
2. Click Import environments from satellite.example.com.

3. Select the Puppet environment check box associated with the host you want to audit.

   If no Puppet environment exists, select the production environment check box.

4. Click Update.

Procedure

1. Navigate to Hosts > Policies, click New Policy and follow the wizard’s steps.
2. Enter a name for this policy, a description (optional), then click Next.

3. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

   Until BZ#1704582 is resolved, note that the Default XCCDF Profile might return an empty report.

4. Specify the scheduled time when the policy is to be applied, then click Next.

   Select Weekly, Monthly, or Custom from the Period drop-down list.

   • If you select Weekly, also select the desired day of the week from the Weekday drop-down list.
   • If you select Monthly, also specify the desired day of the month in the Day of month field.

   • If you select Custom, enter a valid Cron expression in the Cron line field.

     The Custom option allows for greater flexibility in the policy’s schedule than either the Weekly or Monthly options.

5. Select the locations to which the policy is to be applied, then click Next.
6. Select the organizations to which the policy is to be applied, then click Next.
7. Select the host groups to which the policy is to be applied, then click Submit.

Procedure

1. Navigate to Hosts > Policies.
2. Click Show Guide.

Procedure

1. Navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Edit.
3. Edit the necessary attributes.
4. Click Submit.

1. Navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Delete.
3. Click OK in the confirmation message.

1. Navigate to Hosts > All hosts.
2. Select the host or hosts to which you want to add the policy.
3. Click Select Action.
4. Select Assign Compliance Policy from the list.
5. In the new panel that opens, select the appropriate policy from the list of available policies and click Submit.

Procedure

1. Navigate to Hosts > Compliance - Tailoring Files and click New Tailoring File.
2. Enter a name in the Name text box.
3. Click Choose File, navigate to the location containing the SCAP DataStream Tailoring File and select Open.
4. Click Submit to upload the chosen Tailoring File.

Procedure

1. Navigate to Hosts > Compliance - Policies.
2. Click New Policy, or New Compliance Policy if there are existing Compliance Policies.
3. Enter a name in the Name text box, and click Next.
4. Select a Scap content from the dropdown menu.
5. Select a XCCDF Profile from the dropdown menu.
6. Select a Tailoring File from the dropdown menu.

7. Select a XCCDF Profile in Tailoring File from the dropdown menu.

   It is important to select the XCCDF Profile because Tailoring Files are able to contain multiple XCCDF Profiles.

8. Click Next.
9. Select a Period from the dropdown menu.
10. Select a Weekday from the dropdown menu, and click Next.
11. Select a Location to move it to the Selected Items window, and click Next.
12. Select an Organization to move it to the Selected Items window, and click Next.
13. Select a Hostgroup to move it to the Selected Items window, and click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > Policies.

2. Click the required policy name. The dashboard provides the following information:

   • A ring chart illustrating a high-level view of compliance of hosts with the policy.
   • A statistical breakdown of compliance of hosts with the policy, in a tabular format.
   • Links to the latest policy report for each host.

Procedure

1. In the Satellite web UI, navigate to Hosts > Reports to list all compliance reports.
2. Click View Report in the row of the specific host to view the details of an individual report.

3. Click on the rule’s title to see further details:

   • A description of the rule with instructions for bringing the host into compliance if available.
   • The rationale for the rule.
   • In some cases, a remediation script.

1. In the Satellite web UI, navigate to Hosts > Reports.
2. In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.
3. Click OK.

1. In the Satellite web UI, navigate to Hosts > Reports.
2. In the Compliance Reports window, select the compliance reports that you want to delete.
3. In the upper right of the list, select Delete reports.
4. Repeat these steps for as many pages as you want to delete.

To Estimate the Size of a Backup

1. Enter the du command to estimate the size of uncompressed directories containing Satellite databases and configuration files:

   # du -sh /var/lib/mongodb /var/lib/pgsql/data /var/lib/pulp
   480G	/var/lib/mongodb
   100G    /var/lib/pgsql/data
   100G	/var/lib/pulp
   # du -csh /var/lib/qpidd /var/lib/tftpboot /etc /root/ssl-build \
   /var/www/html/pub /opt/puppetlabs
   886M    /var/lib/qpidd
   16M     /var/lib/tftpboot
   37M	/etc
   900K	/root/ssl-build
   100K	/var/www/html/pub
   2M	/opt/puppetlabs
   942M   total

2. Calculate how much space is required to store the compressed data.

   Table 8.1, “Backup Data Compression Ratio” demonstrates compression ratio of all data items used in the backup.

   Table 8.1. Backup Data Compression Ratio

   Data type	Directory	Ratio	Example results
   MongoDB database files	/var/lib/mongodb	85 - 90 %	480 GB → 60 GB
   PostgreSQL database files	/var/lib/pgsql/data	80 - 85%	100 GB → 20 GB
   Pulp RPM files	/var/lib/pulp	(not compressed)	100 GB
   Configuration files	/var/lib/qpidd /var/lib/tftpboot /etc /root-ssl/build /var/www/html/pub /opt/puppetlabs	85%	942 MB → 141 MB

   In this example, the compressed backup data occupies 180 GB in total.

3. To calculate how much space you need to store a backup, add the total of the estimated values of compressed and uncompressed backup data and then add an extra 20% to ensure a reliable backup.

   This example requires 681 GB plus 180 GB for the uncompressed and compressed backup data, 861 GB in total. With 172 GB of extra space, 1033 GB must be allocated for the backup location.

1. Ensure that your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # foreman-maintain backup offline /var/backup_directory

   This process can take a long time to complete, because of the amount of data to copy.

1. Ensure that your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # foreman-maintain backup offline --skip-pulp-content /var/backup_directory

1. Ensure your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Create a full backup:

   # foreman-maintain backup offline  /var/backup_directory

3. Run the backup script with the --incremental argument. This creates a directory within your backup directory to store the first incremental back up.

   # foreman-maintain backup offline --incremental /var/backup_directory/full_backup  /var/backup_directory

4. Run the backup script again to create the second incremental backup. Point to your first incremental backup to indicate the starting point for the next increment. This creates a directory for the second incremental backup in your backup directory.

   # foreman-maintain backup offline --incremental /var/backup_directory/first_incremental_backup  /var/backup_directory

   If you want to point to a different version of the backup, and make a series of increments with that version of the backup as the starting point, you can do this at any time. For example, if you want to make a new incremental backup from the full backup rather than the first or second incremental backup, point to the full backup directory:

   # foreman-maintain backup offline --incremental /var/backup_directory/full_backup  /var/backup_directory

To Perform an Online Backup:

1. Ensure that your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # foreman-maintain backup online /var/backup_directory

Procedure

1. To synchronize an external Capsule, select the relevant organization and location in the web UI, or choose Any Organization and Any Location.
2. Navigate to Infrastructure > Capsules and click the name of the Capsule to synchronize.
3. On the Overview tab, select Synchronize.

Procedure

1. Edit the /etc/foreman/settings.yaml file.

   1. Change the logging level to "debug":

      :logging:
        :level: debug

   2. Select individual logging types:

      :loggers:
        :ldap:
          :enabled: true
        :permissions:
          :enabled: true
        :sql:
          :enabled: true

      For more information about loggers, see Section 12.1.2, “List of Loggers and Default Values”.

2. Restart Satellite services:

   # foreman-maintain service restart

Procedure

1. In the upper right, click Red Hat Access > Search.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.
3. In the Red Hat Search field, enter your search query. Search results display in the left-hand Recommendations list.
4. In the Recommendations list, click a solution. The solution article displays in the main panel.

Procedure

1. In the upper right, click Red Hat Access > Logs.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.
3. In the left file tree, select a log file and click the file name.
4. Click Select File. A pop-up window displays the log file contents.
5. In the log file, highlight any text sections you want to be diagnosed. The Red Hat Diagnose button displays.
6. Click Red Hat Diagnose. The system sends the highlighted information to the Red Hat Customer Portal, and provides solutions that closely match the provided log information.
7. If the solution does not match the problem, click Open a New Support Case. The support case is populated with the highlighted text from the log file. See Section 12.2.1, “Searching for Solutions”.

Procedure

1. In the upper right, click Red Hat Access > Support > New Case.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

3. The Product and Product Version fields are automatically populated. Complete the other relevant fields, as follows:

   • Summary — Provide a brief summary of the issue.

   • Description — Write a detailed description of the issue.

     Based on the summary provided, recommendations for possible solutions display in the main panel.

4. Click Next.

5. Choose the appropriate options, as follows:

   • Severity — Select the ticket urgency as 4 (low), 3 (normal), 2 (high), or 1 (urgent).
   • Case Group — Based on who needs to be notified, create case groups associated with the support case. Select Case Groups in Red Hat Satellite. Create Case Groups within the Customer Portal.

6. Attach the output of sosreport and any required files. Add a file description and click Attach.

   Note
   • If you have large log files or many Satellite tasks, it is recommended to also attach the output of foreman-debug.
   • File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.
7. Click Submit. The system uploads the case to the Customer Portal, and provides a case number for your reference.

Procedure

1. In the upper right, click Red Hat Access > Support > My Cases.
2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

3. To search for a specific support case from existing cases, do any of the following:

   • In the Search field, provide a keyword or phrase.
   • From the drop-down list, choose a specific Case Group. Your organization has defined Case Groups inside the Red Hat Customer Portal.
   • Choose a Case Status.
4. From the results, choose a specific support case and click the Case ID. The support case is ready to view.

Procedure

1. Complete the instructions from Section 12.2.4, “Viewing Support Cases”

2. In the support case, scroll down to the marked sections to do the following:

   • Attachments: - Attach a local file from the system. Add a file name to make it easier to identify.

     Note

     File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.

   • Case Discussion: - Add any updated information about the case you wish to discuss with Global Support Services. After adding information, click Add Comment.

Procedure

1. Obtain the Certificate from the LDAP Server.

   1. If you use Active Directory Certificate Services, export the Enterprise PKI CA Certificate using the Base-64 encoded X.509 format. See How to configure Active Directory authentication with TLS on Satellite 6 for information on creating and exporting a CA certificate from an Active Directory server.

   2. Download the LDAP server certificate to a temporary location on the Red Hat Enterprise Linux system where the Satellite Server is installed and remove it when finished.

      For example, /tmp/example.crt. The filename extensions .cer and .crt are only conventions and can refer to DER binary or PEM ASCII format certificates.

2. Trust the Certificate from the LDAP Server.

   Red Hat Satellite Server requires the CA certificates for LDAP authentication to be individual files in /etc/pki/tls/certs/ directory.

   1. Use the install command to install the imported certificate into the /etc/pki/tls/certs/ directory with the correct permissions:

      # install /tmp/example.crt /etc/pki/tls/certs/

   2. Enter the following command as root to trust the example.crt certificate obtained from the LDAP server:

      # ln -s example.crt /etc/pki/tls/certs/$(openssl \
      x509 -noout -hash -in \
      /etc/pki/tls/certs/example.crt).0

   3. Restart the httpd service:

      # systemctl restart httpd

Procedure

1. Set the Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

   # setsebool -P nis_enabled on

2. Navigate to Administer > LDAP Authentication.
3. Click Create Authentication Source.
4. On the LDAP server tab, enter the LDAP server’s name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS check box to enable encryption. The port should change to 636, which is the default for LDAPS.
5. On the Account tab, enter the account information and domain name details. See Section 13.1.3, “Description of LDAP Settings” for descriptions and examples.
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes. You can map login name, first name, last name, email address, and photo attributes. See Section 13.1.4, “Example Settings for LDAP Connections” for examples.
7. On the Locations tab, select locations from the left table. Selected locations are assigned to users created from the LDAP authentication source, and available after their first login.
8. On the Organizations tab, select organizations from the left table. Selected organizations are assigned to users created from the LDAP authentication source, and available after their first login.
9. Click Submit.

10. Configure new accounts for LDAP users:

    • If you did not select Onthefly Register check box, see Section 5.1.1, “Creating a User” to create user accounts manually.
    • If you selected the Onthefly Register check box, LDAP users can now log in to Satellite using their LDAP accounts and passwords. After they log in for the first time, the Satellite administrator has to assign roles to them manually. See Section 5.1.2, “Assigning Roles to a User” to assign user accounts appropriate roles in Satellite.

Procedure

1. On the IdM server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

2. To verify that you have authenticated, enter the following command:

   # klist

3. On the IdM server, create a host entry for the Satellite Server and generate a one-time password, for example:

   # ipa host-add --random hostname

   Note

   The generated one-time password must be used on the client to complete IdM-enrollment.

   For more information on host configuration properties, see About Host Entry Configuration Properties in the Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy guide.

4. Create an HTTP service for Satellite Server, for example:

   # ipa service-add servicename/hostname

   For more information on managing services, see Managing Services in the Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy guide.

5. On Satellite Server, install the IPA client:

   # yum install ipa-client

6. On Satellite Server, enter the following command as root to configure IdM-enrollment:

   # ipa-client-install --password OTP

   Replace OTP with the one-time password provided by the IdM administrator.

7. If Satellite Server is running on Red Hat Enterprise Linux 7, enter the following command:

   # subscription-manager repos --enable rhel-7-server-optional-rpms

   The installer is dependent on packages which, on Red Hat Enterprise Linux 7, are in the optional repository rhel-7-server-optional-rpms. On Red Hat Enterprise Linux 6 all necessary packages are in the base repository.

8. Set foreman-ipa-authentication to true, using the following command:

   # satellite-installer --foreman-ipa-authentication=true

9. Restart Satellite services:

   # foreman-maintain service restart

Procedure

1. On the IdM server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

2. To verify that you have authenticated, enter the following command:

   # klist

3. Create HBAC service and rule on the IdM server and link them together. The following examples use the PAM service name satellite-prod. Execute the following commands on the IdM server:

   # ipa hbacsvc-add satellite-prod
   # ipa hbacrule-add allow_satellite_prod
   # ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod

4. Add the user who is to have access to the service satellite-prod, and the hostname of the Satellite Server:

   # ipa hbacrule-add-user allow_satellite_prod --user=username
   # ipa hbacrule-add-host allow_satellite_prod --hosts=the-satellite-fqdn

   Alternatively, host groups and user groups can be added to the allow_satellite_prod rule.

5. To check the status of the rule, execute:

   # ipa hbacrule-find satellite-prod
   # ipa hbactest --user=username --host=the-satellite-fqdn --service=satellite-prod

6. Ensure the allow_all rule is disabled on the IdM server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

7. Configure the IdM integration with the Satellite Server as described in Section 13.2.1, “Configuring IdM Authentication on Satellite Server”. On the Satellite Server, define the PAM service as root:

   # satellite-installer --foreman-pam-service=satellite-prod

Procedure

1. Install the required packages:

   # yum install sssd adcli realmd ipa-python-compat krb5-workstation samba-common-tools

2. Enroll Satellite Server with the AD server. You may need to have administrator permissions to perform the following command:

   # realm join -v EXAMPLE.ORG

Procedure

1. Create the /etc/ipa/ directory and the default.conf file:

   # mkdir /etc/ipa
   # touch /etc/ipa/default.conf

2. To the default.conf file, add the following content:

   [global]
   server = unused
   realm = EXAMPLE.ORG

3. Create the /etc/net-keytab.conf file with the following content:

   [global]
   workgroup = EXAMPLE
   realm = EXAMPLE.ORG
   kerberos method = system keytab
   security = ads

4. Determine the effective user ID of the Apache user:

   # id apache

   Apache user must not have access to the keytab file.

5. Create the /etc/gssproxy/00-http.conf file with the following content:

   [service/HTTP]
   mechs = krb5
   cred_store = keytab:/etc/krb5.keytab
   cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
   euid = ID_of_Apache_User

6. Insert the following line at the beginning of the /etc/krb5.conf file:

   includedir /var/lib/sss/pubconf/krb5.include.d/

7. Create a keytab entry:

   # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf
   # chown root.apache /etc/httpd/conf/http.keytab
   # chmod 640 /etc/httpd/conf/http.keytab

8. Enable IPA authenication in Satellite:

   # satellite-installer --foreman-ipa-authentication=true

9. Start and enable the gssproxy service:

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

10. Configure the Apache server to use the gssproxy service:

    1. Create the /etc/systemd/system/httpd.service file with the following content:

       .include /lib/systemd/system/httpd.service
       [Service]
       Environment=GSS_USE_PROXY=1

    2. Apply changes to the service:

       # systemctl daemon-reload

11. Start and enable the httpd service:

    # systemctl restart httpd.service

12. Verify that SSO is working as expected.

    With a running Apache server, users making HTTP requests against the server are authenticated if the client has a valid Kerberos ticket.

    1. Retrieve the Kerberos ticket of the LDAP user, using the following command:

       # kinit ldapuser

    2. View the Kerberos ticket, using the following command:

       # klist

    3. View output from successful SSO-based authentication, using the following command:

       # curl -k -u : --negotiate https://satellite.example.com/users/extlogin
       <html><body>You are being <a href="https://satellite.example.com/users/4-ldapuserexample-com/edit">redirected</a>.</body></html>

Procedure

1. Enable HBAC:

   1. Create an external group and add the AD group to it.
   2. Add the new external group to a POSIX group.
   3. Use the POSIX group in a HBAC rule.

2. Configure sssd to transfer additional attributes of AD users.

   • Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf.

     For example:

     [nss]
     user_attributes=+mail, +sn, +givenname
     
     [domain/EXAMPLE]
     ldap_user_extra_attrs=mail, sn, givenname

To Adjust Timeout Settings:

1. Navigate to Administer > Settings.
2. Enter %_timeout in the search box and click Search. The search should return four settings, including a description.
3. In the Value column, click the icon next to a number to edit it.
4. Enter the desired value in seconds, and click Save.

To Disable Checking for Services:

1. Navigate to Administer > Settings.
2. Enter check_services_before_actions in the search box and click Search.
3. In the Value column, click the icon to edit the value.
4. From the drop-down menu, select false.
5. Click Save.

To Create a Bookmark:

1. Navigate to the page where you want to create a bookmark.
2. In the Search field, enter the search query you want to save.
3. Select the arrow to the right of the Search button and then select Bookmark this search.
4. In the Name field, enter a name for the new bookmark.
5. In the Search query field, ensure your search query is correct.

6. Ensure the Public check box is set correctly:

   • Select the Public check box to set the bookmark as public and visible to all users.
   • Clear the Public check box to set the bookmark as private and only visible to the user who created it.
7. Click Submit.

To Delete a Bookmark:

1. Navigate to Administer > Bookmarks.
2. On the Bookmarks page, click Delete for the Bookmark you want to delete.
3. When the confirmation window opens, click OK to confirm the deletion.