Buscar

Este contenido no está disponible en el idioma seleccionado.

Chapter 7. Deploying SSSD Containers With Different Configurations

download PDF

As a system administrator, you can deploy multiple unprivileged SSSD containers that each use a specific identity provider, such as Identity Management or Active Directory. This enables other application containers to use only their preferred identity source.

7.1. Prerequisites

  • To use the services provided by the SSSD container from other containers, the client container’s rhel7 base image must include the sssd-client package. However, the default rhel7 base image does not include this package.

    If you need to use the SSSD services from other containers, create your own image for the client container based on the default rhel7 base image and include sssd-client. For details, see Creating Docker images.

7.2. Starting the SSSD Container and Joining It to an Identity Resource

To start an SSSD container and join it to an identity resource, such as Active Directory:

  1. Start the SSSD container by using the atomic install command. For example:

    # atomic install --opt1='--dns=192.0.2.1 --dns-search=idm.example.com --hostname=server.ad.example.com -e SSSD_CONTAINER_TYPE=application --net=default' --name=ad_sssd rhel7/sssd realm join -v ad.example.com

    The previous example creates an SSSD application container named ad_sssd. Pass the DNS server IP address, search domain, host name, and realm join command to atomic install to automatically join SSSD running in the container to the Active Directory domain.

    Repeat this step for each identity provider for which you want to provide an SSSD container.

  2. Start the container. For example:

    # atomic run ad_sssd

7.3. Passing the SSSD Cache to an Application Container

To use the SSSD cache in an application container, pass the relevant directories to the docker run command when you start the application container:

# docker run --rm --name=<container_name> -v=/var/lib/sssd_container/<sssd-container-name>/client/etc/krb5.conf.d:/etc/krb5.conf.d -v=/var/lib/sssd_container/<sssd-container-name>/client/var/lib/sss/pipes/:/var/lib/sss/pipes/ <image_name>

This maps the directories of the SSSD container to the corresponding directory inside the application container.

The application running in the container is now able to authenticate using, for example, the kinit utility or the mod_auth_gssapi module.

Red Hat logoGithubRedditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

© 2024 Red Hat, Inc.