Este contenido no está disponible en el idioma seleccionado.
Chapter 2. Configuring Red Hat Identity management
You can configure Red Hat OpenStack Platform with federated user management with the following features:
- Red Hat Identity Management (IdM) is external to Red Hat OpenStack Platform
- Red Hat IdM is the source of all user and group information
- Red Hat Single Signon (RH-SSO) is configured to use Red Hat IdM for user Federation
2.1. Creating the IdM service account for RH-SSO
If you use anonomous binds, some information that is essential for Red Hat Single Sign-On (RH-SSO) is withheld for security reasons. As a result, you need provide the appropriate privileges for RH-SSO in the forma a dedicated account to query the IdM LDAP server for this information:
LDAP_URL="ldaps://$FED_IPA_HOST"
DIR_MGR_DN="cn=Directory Manager"
SERVICE_NAME="rhsso"
SERVICE_DN="uid=$service_name,cn=sysaccounts,cn=etc,$FED_IPA_BASE_DN"
$ ldapmodify -H "${LDAP_URL}" -x -D "${DIR_MGR_DN}" -w <_FED_IPA_ADMIN_PASSWD_> <<EOF
dn: ${SERVICE_DN}
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: ${SERVICE_NAME}
userPassword: <_FED_IPA_RHSSO_SERVICE_PASSWD_>
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
EOF
You can use the configure-federation script to perform the above step: $ ./configure-federation create-ipa-service-account
2.2. Creating a test user
Create a user account in IdM for testing:
Procedure
Create a user
jdoein IdM:$ipa user-add --first John --last Doe --email jdoe@example.com jdoe
Assign a password to the user:
$ipa passwd jdoe
2.3. Creating an IdM group for OpenStack users
You must have an IdM group openstack-users to map to the Keystone group federated_users. Map the test user to this group.
Create the openstack-users group in Red Hat Identity Management (IdM):
Procedure
Ensure that the
openstack-usersgroup does not exist:$ ipa group-show openstack-users ipa: ERROR: openstack-users: group not found
Add the openstack-users group to IdM:
ipa group-add openstack-users
Add the test users to the
openstack-usersgroup:ipa group-add-member --users jdoe openstack-users
Verify that the
openstack-usersgroup exists and has the test user as a member:$ ipa group-show openstack-users Group name: openstack-users GID: 331400001 Member users: jdoe
