Administering Red Hat Satellite

1. Navigate to Administer > Users.
2. Click Create User.
3. In the Login field, enter a username for the user.
4. In the Firstname and Lastname fields, enter the real first name and last name of the user.
5. In the Mail field, enter the user’s email address.
6. In the Description field, add a description of the new user.
7. Select a specific language for the user from the Language list.

8. Select a timezone for the user from the Timezone list.

   By default, Satellite Server uses the language and timezone settings of the user’s browser.

9. Set a password for the user:

   1. From the Authorized by list, select the source by which the user is authenticated.

      • INTERNAL: to enable the user to be managed inside Satellite Server.
      • EXTERNAL: to configure external authentication as described in Chapter 13, Configuring External Authentication.
   2. Enter an initial password for the user in the Password field and the Verify field.
10. Click Submit to create the user.

Procedure

1. Navigate to Administer > Users.

2. Click the username of the user to be assigned one or more roles.

   Note

   If a user account is not listed, check that you are currently viewing the correct organization. To list all the users in Satellite, click Default Organization and then Any Organization.

3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available roles.

6. Select the roles to assign from the Roles list.

   To grant all the available permissions, select the Admin check box.

7. Click Submit.

1. In the Satellite web UI, navigate to Administer > Users.
2. To the right of the user that you want to impersonate, from the list in the Actions column, select Impersonate.

Procedure

1. Navigate to Administer > Users.
2. From the Username column, click on the username of the required user.

3. Click on the SSH Keys tab.

   • To Add SSH key

     1. Prepare the content of the public SSH key in a clipboard.
     2. Click Add SSH Key.
     3. In the Key field, paste the public SSH key content from the clipboard.
     4. In the Name field, enter a name for the SSH key.
     5. Click Submit.

   • To Remove SSH key

     1. Click Delete on the row of the SSH key to be deleted.
     2. Click OK in the confirmation prompt.

Procedure

1. Navigate to Administer > Users.
2. Click the Username of the user you want to edit.
3. On the User tab, verify the value of the Mail field. Email notifications will be sent to the address in this field.
4. On the Email Preferences tab, select Mail Enabled.

5. Select the notifications you want the user to receive using the drop-down menus next to the notification types.

   Note

   The Audit Summary notification can be filtered by entering the required query in the Mail Query text box.

6. Click Submit.

   The user will start receiving the notification emails.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Click on the username.

3. On the Email Preferences tab, click Test email.

   A test email message is sent immediately to the user’s email address.

1. Verify the user’s email address.
2. Verify Satellite Server’s email configuration.
3. Examine firewall and mail server logs.

Procedure

1. Navigate to Administer > User Groups.
2. Click Create User group.

3. On the User Group tab, specify the name of the new user group and select group members:

   • Select the previously created user groups from the User Groups list.
   • Select users from the Users list.
4. On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Admin check box to assign all available permissions.
5. Click Submit.

Procedure

1. Navigate to Administer > User Groups.
2. Click Delete to the right of the user group you want to delete.
3. In the alert box that appears, click OK to delete a user group.

Procedure

1. Navigate to Administer > Roles.
2. Click Create Role.
3. Provide a Name for the role.
4. Click Submit to save your new role.

Procedure

1. Navigate to Administer > Roles and select Clone from the drop-down menu to the right of the required role.
2. Provide a Name for the role.
3. Click Submit to clone the role.
4. Click the name of the cloned role and navigate to Filters.
5. Edit the permissions as required.
6. Click Submit to save your new role.

Procedure

1. Navigate to Administer > Roles.
2. Select Add Filter from the drop-down list to the right of the required role.
3. Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.
4. Click the permissions you want to select from the Permission list.
5. Depending on the Resource type selected, you can select or deselect the Unlimited and Override check box. The Unlimited checkbox is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited check box, the Search field activates. In this field you can specify further filtering with use of the Red Hat Satellite 6 search syntax. See Section 5.4, “Granular Permission Filtering” for details. When you enable the Override check box, you can add additional locations and organizations to allow the role to access the resource type in the additional locations and organizations; you can also remove an already associated location and organization from the resource type to restrict access.
6. Click Next.
7. Click Submit to save changes.

1. List all available permissions:

   # hammer filter available-permissions

2. Add permissions to a role:

   # hammer filter create \
   --role role_name \
   --permission-ids perm_ID1,perm_ID2...

Procedure

1. Navigate to Administer > Roles.
2. Click Filters to the right of the required role to get to the Filters page.

Procedure

1. Ensure that the required packages are installed. Execute the following command on the Satellite Server:

   # satellite-maintain packages install foreman-console

2. Start the Satellite console with the following command:

   # foreman-rake console

   Insert the following code into the console:

   f = File.open('/tmp/table.html', 'w')
   
   result = Foreman::AccessControl.permissions {|a,b| a.security_block <=> b.security_block}.collect do |p|
         actions = p.actions.collect { |a| "<li>#{a}</li>" }
         "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
   end.join("\n")
   
   f.write(result)

   The above syntax creates a table of permissions and saves it to the /tmp/table.html file.

3. Press Ctrl + D to exit the Satellite console. Insert the following text at the first line of /tmp/table.html:

   <table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

   Append the following text at the end of /tmp/table.html:

   </table>

4. Open /tmp/table.html in a web browser to view the table.

Procedure

1. Navigate to Administer > Roles.
2. Select Delete from the drop-down list to the right of the role to be deleted.
3. In an alert box that appears, click OK to delete the role.

Procedure

1. In the Satellite web UI, navigate to Configure > Environments.
2. Click Import environments from satellite.example.com.

3. Select the Puppet environment check box associated with the host you want to audit.

   If no Puppet environment exists, select the production environment check box. The Puppet classes that you require for OpenSCAP are in the production environment by default.

4. Click Update.

Procedure

1. Navigate to Hosts > Policies, and select whether you want a manual, Ansible, or Puppet deployment.
2. Enter a name for this policy, a description (optional), then click Next.

3. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

   Until BZ#1704582 is resolved, note that the Default XCCDF Profile might return an empty report.

4. Specify the scheduled time when the policy is to be applied, then click Next.

   Select Weekly, Monthly, or Custom from the Period list.

   • If you select Weekly, also select the desired day of the week from the Weekday list.
   • If you select Monthly, also specify the desired day of the month in the Day of month field.

   • If you select Custom, enter a valid Cron expression in the Cron line field.

     The Custom option allows for greater flexibility in the policy’s schedule than either the Weekly or Monthly options.

5. Select the locations to which the policy is to be applied, then click Next.
6. Select the organizations to which the policy is to be applied, then click Next.
7. Select the host groups to which the policy is to be applied, then click Submit.

Procedure

1. Navigate to Hosts > Policies.
2. Click Show Guide.

Procedure

1. Navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Edit.
3. Edit the necessary attributes.
4. Click Submit.

1. Navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Delete.
3. Click OK in the confirmation message.

Procedure

1. Navigate to Hosts > Compliance - Tailoring Files and click New Tailoring File.
2. Enter a name in the Name text box.
3. Click Choose File, navigate to the location containing the SCAP DataStream Tailoring File and select Open.
4. Click Submit to upload the chosen Tailoring File.

Procedure

1. Navigate to Hosts > Compliance - Policies.
2. Click New Policy, or New Compliance Policy if there are existing Compliance Policies.
3. Enter a name in the Name text box, and click Next.
4. Select a Scap content from the dropdown menu.
5. Select a XCCDF Profile from the dropdown menu.
6. Select a Tailoring File from the dropdown menu.

7. Select a XCCDF Profile in Tailoring File from the dropdown menu.

   It is important to select the XCCDF Profile because Tailoring Files are able to contain multiple XCCDF Profiles.

8. Click Next.
9. Select a Period from the dropdown menu.
10. Select a Weekday from the dropdown menu, and click Next.
11. Select a Location to move it to the Selected Items window, and click Next.
12. Select an Organization to move it to the Selected Items window, and click Next.
13. Select a Hostgroup to move it to the Selected Items window, and click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > Policies.

2. Click the required policy name. The dashboard provides the following information:

   • A ring chart illustrating a high-level view of compliance of hosts with the policy.
   • A statistical breakdown of compliance of hosts with the policy, in a tabular format.
   • Links to the latest policy report for each host.

Procedure

1. In the Satellite web UI, navigate to Hosts > Reports to list all compliance reports.
2. Click View Report in the row of the specific host to view the details of an individual report.

3. Click on the rule’s title to see further details:

   • A description of the rule with instructions for bringing the host into compliance if available.
   • The rationale for the rule.
   • In some cases, a remediation script.

1. In the Satellite web UI, navigate to Hosts > Reports.
2. In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.
3. Click OK.

1. In the Satellite web UI, navigate to Hosts > Reports.
2. In the Compliance Reports window, select the compliance reports that you want to delete.
3. In the upper right of the list, select Delete reports.
4. Repeat these steps for as many pages as you want to delete.

Procedure

1. To synchronize an external Capsule, select the relevant organization and location in the web UI, or choose Any Organization and Any Location.
2. Navigate to Infrastructure > Capsules and click the name of the Capsule to synchronize.
3. On the Overview tab, select Synchronize.

Procedure

1. Obtain the Certificate from the LDAP Server.

   1. If you use Active Directory Certificate Services, export the Enterprise PKI CA Certificate using the Base-64 encoded X.509 format. See How to configure Active Directory authentication with TLS on Satellite 6 for information on creating and exporting a CA certificate from an Active Directory server.

   2. Download the LDAP server certificate to a temporary location on the Red Hat Enterprise Linux system where the Satellite Server is installed and remove it when finished.

      For example, /tmp/example.crt. The filename extensions .cer and .crt are only conventions and can refer to DER binary or PEM ASCII format certificates.

2. Trust the Certificate from the LDAP Server.

   Red Hat Satellite Server requires the CA certificates for LDAP authentication to be individual files in /etc/pki/tls/certs/ directory.

   1. Use the install command to install the imported certificate into the /etc/pki/tls/certs/ directory with the correct permissions:

      # install /tmp/example.crt /etc/pki/tls/certs/

   2. Enter the following command as root to trust the example.crt certificate obtained from the LDAP server:

      # ln -s example.crt /etc/pki/tls/certs/$(openssl \
      x509 -noout -hash -in \
      /etc/pki/tls/certs/example.crt).0

   3. Restart the httpd service:

      # systemctl restart httpd

Procedure

1. Set the Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

   # setsebool -P nis_enabled on

2. Navigate to Administer > LDAP Authentication.
3. Click Create Authentication Source.
4. On the LDAP server tab, enter the LDAP server’s name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS check box to enable encryption. The port should change to 636, which is the default for LDAPS.
5. On the Account tab, enter the account information and domain name details. See Section 13.1.3, “Description of LDAP Settings” for descriptions and examples.
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes. You can map login name, first name, last name, email address, and photo attributes. See Section 13.1.4, “Example Settings for LDAP Connections” for examples.
7. On the Locations tab, select locations from the left table. Selected locations are assigned to users created from the LDAP authentication source, and available after their first login.
8. On the Organizations tab, select organizations from the left table. Selected organizations are assigned to users created from the LDAP authentication source, and available after their first login.
9. Click Submit.

10. Configure new accounts for LDAP users:

    • If you did not select Automatically Create Accounts In Satellite check box, see Section 5.1.1, “Creating a User” to create user accounts manually.
    • If you selected the Automatically Create Accounts In Satellite check box, LDAP users can now log in to Satellite using their LDAP accounts and passwords. After they log in for the first time, the Satellite administrator has to assign roles to them manually. See Section 5.1.2, “Assigning Roles to a User” to assign user accounts appropriate roles in Satellite.

Procedure

1. On the Red Hat Identity Management server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

2. To verify that you have authenticated, enter the following command:

   # klist

3. On the Red Hat Identity Management server, create a host entry for the Satellite Server and generate a one-time password, for example:

   # ipa host-add --random hostname

   Note

   The generated one-time password must be used on the client to complete Red Hat Identity Management-enrollment.

   For more information on host configuration properties, see About Host Entry Configuration Properties in the Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy guide.

4. Create an HTTP service for Satellite Server, for example:

   # ipa service-add HTTP/hostname

   For more information on managing services, see Managing Services in the Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy guide.

5. On Satellite Server, install the IPA client:

   Warning

   This command might restart Satellite services during the installation of the package. For more information about installing and updating packages on Satellite, see Section 11.5, “Managing Packages on the Base Operating System of Satellite or Capsule”.

   # satellite-maintain packages install ipa-client

6. On Satellite Server, enter the following command as root to configure Red Hat Identity Management-enrollment:

   # ipa-client-install --password OTP

   Replace OTP with the one-time password provided by the Red Hat Identity Management administrator.

7. If Satellite Server is running on Red Hat Enterprise Linux 7, execute the following command:

   # subscription-manager repos --enable rhel-7-server-optional-rpms

   The installer is dependent on packages which, on Red Hat Enterprise Linux 7, are in the optional repository rhel-7-server-optional-rpms.

8. Set foreman-ipa-authentication to true, using the following command:

   # satellite-installer --foreman-ipa-authentication=true

9. Restart the satellite-maintain services:

   # satellite-maintain service restart

Procedure

1. On the Red Hat Identity Management server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

2. To verify that you have authenticated, enter the following command:

   # klist

3. Create HBAC service and rule on the Red Hat Identity Management server and link them together. The following examples use the PAM service name satellite-prod. Execute the following commands on the Red Hat Identity Management server:

   # ipa hbacsvc-add satellite-prod
   # ipa hbacrule-add allow_satellite_prod
   # ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod

4. Add the user who is to have access to the service satellite-prod, and the hostname of the Satellite Server:

   # ipa hbacrule-add-user allow_satellite_prod --user=username
   # ipa hbacrule-add-host allow_satellite_prod --hosts=satellite.example.com

   Alternatively, host groups and user groups can be added to the allowsatellite_prod_ rule.

5. To check the status of the rule, execute:

   # ipa hbacrule-find satellite-prod
   # ipa hbactest --user=username --host=satellite.example.com --service=satellite-prod

6. Ensure the allow_all rule is disabled on the Red Hat Identity Management server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

7. Configure the Red Hat Identity Management integration with the Satellite Server as described in Section 13.2.1, “Configuring Red Hat Identity Management Authentication on Satellite Server”. On the Satellite Server, define the PAM service as root:

   # satellite-installer --foreman-pam-service=satellite-prod

Procedure

1. Install the required packages:

   # satellite-maintain packages install sssd adcli realmd ipa-python-compat krb5-workstation samba-common-tools

2. Enroll Satellite Server with the AD server. You may need to have administrator permissions to perform the following command:

   # realm join -v EXAMPLE.ORG

Procedure

1. Create the /etc/ipa/ directory and the default.conf file:

   # mkdir /etc/ipa
   # touch /etc/ipa/default.conf

2. To the default.conf file, add the following content:

   [global]
   server = unused
   realm = EXAMPLE.ORG

3. Create the /etc/net-keytab.conf file with the following content:

   [global]
   workgroup = EXAMPLE
   realm = EXAMPLE.ORG
   kerberos method = system keytab
   security = ads

4. Determine the effective user ID of the Apache user:

   # id apache

   Apache user must not have access to the keytab file.

5. Create the /etc/gssproxy/00-http.conf file with the following content:

   [service/HTTP]
   mechs = krb5
   cred_store = keytab:/etc/krb5.keytab
   cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
   euid = ID_of_Apache_User

6. Create a keytab entry:

   # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf
   # chown root.apache /etc/httpd/conf/http.keytab
   # chmod 640 /etc/httpd/conf/http.keytab

7. Enable IPA authenication in Satellite:

   # satellite-installer --foreman-ipa-authentication=true

8. Start and enable the gssproxy service:

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

9. Configure the Apache server to use the gssproxy service:

   1. Create the /etc/systemd/system/httpd.service file with the following content:

      .include /lib/systemd/system/httpd.service
      [Service]
      Environment=GSS_USE_PROXY=1

   2. Apply changes to the service:

      # systemctl daemon-reload

10. Start and enable the httpd service:

    # systemctl restart httpd.service

11. Verify that SSO is working as expected.

    With a running Apache server, users making HTTP requests against the server are authenticated if the client has a valid Kerberos ticket.

    1. Retrieve the Kerberos ticket of the LDAP user, using the following command:

       # kinit ldapuser

    2. View the Kerberos ticket, using the following command:

       # klist

    3. View output from successful SSO-based authentication, using the following command:

       # curl -k -u : --negotiate https://satellite.example.com/users/extlogin

       This returns the following response:

       <html><body>You are being <a href="https://satellite.example.com/users/4-ldapuserexample-com/edit">redirected</a>.</body></html>

Procedure

1. Enable HBAC:

   1. Create an external group and add the AD group to it.
   2. Add the new external group to a POSIX group.
   3. Use the POSIX group in a HBAC rule.

2. Configure sssd to transfer additional attributes of AD users.

   • Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf.

     For example:

     [nss]
     user_attributes=+mail, +sn, +givenname
     
     [domain/EXAMPLE]
     ldap_user_extra_attrs=mail, sn, givenname

1. Users authenticate to Satellite using the Satellite web UI.
2. Users authenticate to Satellite using the Satellite CLI.

Procedure

1. On the Satellite server, install the following packages:

   # satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install

2. Register Satellite to Red Hat Single Sign-On as a client. Note that you the registration process for logging in using the web UI and the CLI are different. You can register two clients Satellite clients to Red Hat Single Sign-On to be able to log in to Satellite from the web UI and the CLI.

   • If you want you users to authenticate to Satellite using the web UI, create a client as follows:

     # keycloak-httpd-client-install --app-name foreman-openidc \
     --keycloak-server-url "https://RHSSO.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

     Then, configure Satellite to use Red Hat Single Sign-On as an authentication source:

     # satellite-installer --foreman-keycloak true \
     --foreman-keycloak-app-name "foreman-openidc" \
     --foreman-keycloak-realm "Satellite_Realm"

   • If you want your users to authenticate to Satellite using the CLI, create a client as follows:

     # keycloak-httpd-client-install --app-name hammer-openidc \
     --keycloak-server-url "https://RHSSO.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

3. Restart the httpd service:

   # systemctl restart httpd

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to Clients and click the Satellite client.

2. Configure access type:

   • If you want your users to authenticate to Satellite using the web UI, from the Access Type list, select confidential.
   • If you want your users to authenticate to Satellite using the CLI, from the Access Type list, select public.

3. In the Valid redirect URI fields, add a valid redirect URI.

   • If you want your users to authenticate to Satellite using the web UI, in the blank field below the existing URI, enter a URI in the form https://satellite.example.com/users/extlogin. Note that you must add the string /users/extlogin after the Satellite FQDN.

     After completing this step, the Satellite client for logging in using the web UI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     https://satellite.example.com/users/extlogin

   • If you want your users to authenticate to Satellite using the CLI, in the blank field below the existing URI, enter urn:ietf:wg:oauth:2.0:oob.

     After completing this step, the Satellite client for logging in using the CLI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     urn:ietf:wg:oauth:2.0:oob

4. Click Save.
5. Click the Mappers tab and click Create to add an audience mapper.
6. In the Name field, enter a name for the audience mapper.
7. From the Mapper Type list, select Audience.
8. From the Included Client Audience list, select the Satellite client.
9. Click Save.
10. Click Create to add a group mapper so that you can specify authorization in Satellite based on group membership.
11. In the Name field, enter a name for the group mapper.
12. From the Mapper Type list, select Group Membership.
13. In the Token Claim Name field, enter groups.
14. Set the Full group path setting to OFF.
15. Click Save.

Procedure

1. To authenticate to the Satellite CLI using the code grant type, enter the following command:

   # hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://RHSSO.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://RHSSO.example.com/auth' \
   --oidc-client-id 'satellite.example.com-foreman-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   The command prompts you to enter a success code.

2. To retrieve the success code, navigate to the URL that the command returns and provide the required information.
3. Copy the success code that the web UI returns.
4. In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Satellite CLI.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups, and click the Create User Group button.
2. In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.
3. Do not add users and user groups to the right-hand columns. Click the Roles tab.
4. Select the Administer check box.
5. Click the External Groups tab.
6. Click Add external user group.
7. In the Name field, enter the name of the Active Directory group.
8. From the list, select EXTERNAL.

1. Users authenticate to Satellite using the Satellite web UI.
2. Users authenticate to Satellite using the Satellite CLI.

Procedure

1. On the Satellite server, install the following packages:

   # satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install

2. Register Satellite to Red Hat Single Sign-On as a client. Note that you the registration process for logging in using the web UI and the CLI are different. You can register two clients Satellite clients to Red Hat Single Sign-On to be able to log in to Satellite from the web UI and the CLI.

   • If you want you users to authenticate to Satellite using the web UI, create a client as follows:

     # keycloak-httpd-client-install --app-name foreman-openidc \
     --keycloak-server-url "https://RHSSO.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

     Then, configure Satellite to use Red Hat Single Sign-On as an authentication source:

     # satellite-installer --foreman-keycloak true \
     --foreman-keycloak-app-name "foreman-openidc" \
     --foreman-keycloak-realm "Satellite_Realm"

   • If you want your users to authenticate to Satellite using the CLI, create a client as follows:

     # keycloak-httpd-client-install --app-name hammer-openidc \
     --keycloak-server-url "https://RHSSO.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

3. Restart the httpd service:

   # systemctl restart httpd

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to Clients and click the Satellite client.

2. Configure access type:

   • If you want your users to authenticate to Satellite using the web UI, from the Access Type list, select confidential.
   • If you want your users to authenticate to Satellite using the CLI, from the Access Type list, select public.

3. In the Valid redirect URI fields, add a valid redirect URI.

   • If you want your users to authenticate to Satellite using the web UI, in the blank field below the existing URI, enter a URI in the form https://satellite.example.com/users/extlogin. Note that you must add the string /users/extlogin after the Satellite FQDN.

     After completing this step, the Satellite client for logging in using the web UI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     https://satellite.example.com/users/extlogin

   • If you want your users to authenticate to Satellite using the CLI, in the blank field below the existing URI, enter urn:ietf:wg:oauth:2.0:oob.

     After completing this step, the Satellite client for logging in using the CLI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     urn:ietf:wg:oauth:2.0:oob

4. Click Save.
5. Click the Mappers tab and click Create to add an audience mapper.
6. In the Name field, enter a name for the audience mapper.
7. From the Mapper Type list, select Audience.
8. From the Included Client Audience list, select the Satellite client.
9. Click Save.
10. Click Create to add a group mapper so that you can specify authorization in Satellite based on group membership.
11. In the Name field, enter a name for the group mapper.
12. From the Mapper Type list, select Group Membership.
13. In the Token Claim Name field, enter groups.
14. Set the Full group path setting to OFF.
15. Click Save.

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to the Satellite realm.
2. Navigate to Authentication, and click the OTP Policy tab.
3. Ensure that the Supported Applications field includes FreeOTP or Google Authenticator.
4. Configure the OTP settings to suit your requirements.
5. Optional: If you want to use TOTP authentication as a default authentication method for all users, click the Flows tab, and to the right of the OTP Form setting, select REQUIRED.
6. Click the Required Actions tab.
7. To the right of the Configure OTP row, select the Default Action check box.

Procedure

1. Log in to Satellite, Satellite redirects you to the Red Hat Single Sign-On login screen.
2. Enter your username and password, and click Log In.
3. The first attempt to log in, Red Hat Single Sign-On requests you to configure your client by scanning the barcode and entering the pin displayed.
4. After you configure your client and enter a valid PIN, Red Hat Single Sign-On redirects you to Satellite and logs you in.

Procedure

1. To authenticate to the Satellite CLI using the code grant type, enter the following command:

   # hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://RHSSO.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://RHSSO.example.com/auth' \
   --oidc-client-id 'satellite.example.com-foreman-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   The command prompts you to enter a success code.

2. To retrieve the success code, navigate to the URL that the command returns and provide the required information.
3. Copy the success code that the web UI returns.
4. In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Satellite CLI.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups, and click the Create User Group button.
2. In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.
3. Do not add users and user groups to the right-hand columns. Click the Roles tab.
4. Select the Administer check box.
5. Click the External Groups tab.
6. Click Add external user group.
7. In the Name field, enter the name of the Active Directory group.
8. From the list, select EXTERNAL.

To Adjust Timeout Settings:

1. Navigate to Administer > Settings.
2. Enter %_timeout in the search box and click Search. The search should return four settings, including a description.
3. In the Value column, click the icon next to a number to edit it.
4. Enter the desired value in seconds, and click Save.

To Disable Checking for Services:

1. Navigate to Administer > Settings.
2. Enter check_services_before_actions in the search box and click Search.
3. In the Value column, click the icon to edit the value.
4. From the drop-down menu, select false.
5. Click Save.

To Create a Bookmark:

1. Navigate to the page where you want to create a bookmark.
2. In the Search field, enter the search query you want to save.
3. Select the arrow to the right of the Search button and then select Bookmark this search.
4. In the Name field, enter a name for the new bookmark.
5. In the Search query field, ensure your search query is correct.

6. Ensure the Public check box is set correctly:

   • Select the Public check box to set the bookmark as public and visible to all users.
   • Clear the Public check box to set the bookmark as private and only visible to the user who created it.
7. Click Submit.

To Delete a Bookmark:

1. Navigate to Administer > Bookmarks.
2. On the Bookmarks page, click Delete for the Bookmark you want to delete.
3. When the confirmation window opens, click OK to confirm the deletion.