Chapter 5. Configuring External Authentication

Procedure

1. Obtain the CA certificate from the LDAP Server:

   1. If you use Active Directory Certificate Services, export the Enterprise PKI CA Certificate using the Base64 encoded X.509 format. See How to configure Active Directory authentication with TLS on Satellite for information on creating and exporting a CA certificate from an Active Directory server.

   2. Download the LDAP server certificate to a temporary location on the Satellite Server, such as /tmp/example.crt. You will remove the certificate when finished.

      The filename extensions .cer and .crt are only conventions and can refer to DER binary or PEM ASCII format certificates.

2. Add the LDAP server certificate to the system truststore:

   1. Import the certificate:

      # cp /tmp/example.crt /etc/pki/tls/source/anchors

      Copy to Clipboard Toggle word wrap

   2. Update the certificate authority truststore:

      # update-ca-trust extract

      Copy to Clipboard Toggle word wrap
3. Delete the downloaded LDAP certificate from the temporary location on your Satellite Server.

Procedure

1. Set the Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

   # setsebool -P nis_enabled on

   Copy to Clipboard Toggle word wrap
2. In the Satellite web UI, navigate to Administer > Authentication Sources.
3. Click Create LDAP Authentication Source.
4. On the LDAP server tab, enter the LDAP server’s name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS checkbox to enable encryption. The port should change to 636, which is the default for LDAPS.
5. On the Account tab, enter the account information and domain name details. See Section 5.1.3, “Description of LDAP Settings” for descriptions and examples.
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes. You can map login name, first name, last name, email address, and photo attributes. See Section 5.1.4, “Example Settings for LDAP Connections” for examples.
7. On the Locations tab, select locations from the left table. Selected locations are assigned to users created from the LDAP authentication source, and available after their first login.
8. On the Organizations tab, select organizations from the left table. Selected organizations are assigned to users created from the LDAP authentication source, and available after their first login.
9. Click Submit.

10. Configure new accounts for LDAP users:

    • If you did not select Automatically Create Accounts In Satellite checkbox, see Creating a User in Administering Red Hat Satellite to create user accounts manually.
    • If you selected the Automatically Create Accounts In Satellite checkbox, LDAP users can now log in to Satellite using their LDAP accounts and passwords. After they log in for the first time, the Satellite administrator has to assign roles to them manually. For more information on assigning user accounts appropriate roles in Satellite, see Assigning Roles to a User in Administering Red Hat Satellite.

Procedure

1. On the Red Hat Identity Management server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

   Copy to Clipboard Toggle word wrap

2. To verify that you have authenticated, enter the following command:

   # klist

   Copy to Clipboard Toggle word wrap

3. On the Red Hat Identity Management server, create a host entry for Satellite Server and generate a one-time password, for example:

   # ipa host-add --random hostname

   Copy to Clipboard Toggle word wrap
   Note

   The generated one-time password must be used on the client to complete Red Hat Identity Management-enrollment.

   For more information on host configuration properties, see Host entry in IdM LDAP in Configuring and managing Identity Management.

4. Create an HTTP service for Satellite Server, for example:

   # ipa service-add HTTP/hostname

   Copy to Clipboard Toggle word wrap

   For more information on managing services, see Red Hat Enterprise Linux 8 Accessing Identity Management Services guide.

5. On Satellite Server, install the IPA client:

   Warning

   This command might restart Satellite services during the installation of the package. For more information about installing and updating packages on Satellite, see Managing Packages on the Base Operating System of Satellite Server or Capsule Server in Administering Red Hat Satellite.

   # satellite-maintain packages install ipa-client

   Copy to Clipboard Toggle word wrap

6. On Satellite Server, enter the following command as root to configure Red Hat Identity Management-enrollment:

   # ipa-client-install --password OTP

   Copy to Clipboard Toggle word wrap

   Replace OTP with the one-time password provided by the Red Hat Identity Management administrator.

7. Set Red Hat Identity Management as the authentication provider, using one of the following commands:

   • If you only want to enable access to the Satellite web UI but not the Satellite API, enter:

     # satellite-installer \
     --foreman-ipa-authentication=true

     Copy to Clipboard Toggle word wrap

   • If you want to enable access both to the Satellite web UI and the Satellite API, enter:

     # satellite-installer \
     --foreman-ipa-authentication-api=true \
     --foreman-ipa-authentication=true

     Copy to Clipboard Toggle word wrap
     Warning

     Enabling access to both the Satellite API and the Satellite web UI can lead to security problems. After an IdM user receives a Kerberos ticket-granting ticket (TGT) by entering kinit user_name, an attacker can obtain an API session. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser.

8. Restart Satellite services:

   # satellite-maintain service restart

   Copy to Clipboard Toggle word wrap

Procedure

1. On the Red Hat Identity Management server, to authenticate, enter the following command and enter your password when prompted:

   # kinit admin

   Copy to Clipboard Toggle word wrap

2. To verify that you have authenticated, enter the following command:

   # klist

   Copy to Clipboard Toggle word wrap

3. Create HBAC service and rule on the Red Hat Identity Management server and link them together. The following examples use the PAM service name satellite-prod. Execute the following commands on the Red Hat Identity Management server:

   # ipa hbacsvc-add satellite-prod
   # ipa hbacrule-add allow_satellite_prod
   # ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod

   Copy to Clipboard Toggle word wrap

4. Add the user who is to have access to the service satellite-prod, and the hostname of Satellite Server:

   # ipa hbacrule-add-user allow_satellite_prod --user=username
   # ipa hbacrule-add-host allow_satellite_prod --hosts=satellite.example.com

   Copy to Clipboard Toggle word wrap

   Alternatively, host groups and user groups can be added to the allow_satellite_prod rule.

5. To check the status of the rule, execute:

   # ipa hbacrule-find satellite-prod
   # ipa hbactest --user=username --host=satellite.example.com --service=satellite-prod

   Copy to Clipboard Toggle word wrap
6. Ensure the allow_all rule is disabled on the Red Hat Identity Management server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

7. Configure the Red Hat Identity Management integration with Satellite Server as described in Section 5.2.1, “Configuring Red Hat Identity Management Authentication on Satellite Server”. On Satellite Server, define the PAM service as root:

   # satellite-installer --foreman-pam-service=satellite-prod

   Copy to Clipboard Toggle word wrap

Procedure

1. Define AD realm configuration in a location where satellite-installer expects it:

   1. Create a directory named /etc/ipa/:

      # mkdir /etc/ipa/

      Copy to Clipboard Toggle word wrap

   2. Create the /etc/ipa/default.conf file with the following contents to configure the Kerberos realm for the AD domain:

      [global]
      realm = AD.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

2. Configure the Apache keytab for Kerberos connections:

   1. Update the /etc/samba/smb.conf file with the following settings to configure how Samba interacts with AD:

      [global]
      workgroup = AD.EXAMPLE
      realm = AD.EXAMPLE.COM
      kerberos method = system keytab
      security = ads

      Copy to Clipboard Toggle word wrap

   2. Add the Kerberos service principal to the keytab file at /etc/httpd/conf/http.keytab:

      # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U Administrator -s /etc/samba/smb.conf

      Copy to Clipboard Toggle word wrap

3. Configure the System Security Services Daemon (SSSD) to use the AD access control provider to evaluate and enforce Group Policy Object (GPO) access control rules for the foreman PAM service:

   1. In the [domain/ad.example.com] section of your /etc/sssd/sssd.conf file, configure the ad_gpo_access_control and ad_gpo_map_service options as follows:

      [domain/ad.example.com]
      ad_gpo_access_control = enforcing
      ad_gpo_map_service = +foreman

      Copy to Clipboard Toggle word wrap

      For more information on GPOs, see the following documents:

      • How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 9)
      • How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 8)

   2. Restart SSSD:

      # systemctl restart sssd

      Copy to Clipboard Toggle word wrap

4. Enable the authentication source:

   # satellite-installer --foreman-ipa-authentication=true

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable HBAC:

   1. Create an external group and add the AD group to it.
   2. Add the new external group to a POSIX group.
   3. Use the POSIX group in a HBAC rule.

2. Configure sssd to transfer additional attributes of AD users.

   • Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf. For example:

     [nss]
     user_attributes=+mail, +sn, +givenname
     [domain/EXAMPLE.com]
     ...
     krb5_store_password_if_offline = True
     ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname
     
     [ifp]
     allowed_uids = ipaapi, root
     user_attributes=+email, +firstname, +lastname

     Copy to Clipboard Toggle word wrap

   • Verify the AD attributes value.

     # dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname

     Copy to Clipboard Toggle word wrap

1. Users authenticate to Satellite using the Satellite web UI.
2. Users authenticate to Satellite using the Satellite CLI.

Procedure

1. On Satellite Server, install the following packages:

   # satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml

   Copy to Clipboard Toggle word wrap

2. Register Satellite to Red Hat Single Sign-On as a client. Note that you the registration process for logging in using the web UI and the CLI are different.

   • If you want you users to authenticate to Satellite using the web UI, create a client as follows:

     # keycloak-httpd-client-install --app-name foreman-openidc \
     --keycloak-server-url "https://RHSSO.example.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Copy to Clipboard Toggle word wrap

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

     Then, configure Satellite to use Red Hat Single Sign-On as an authentication source:

     # satellite-installer --foreman-keycloak true \
     --foreman-keycloak-app-name "foreman-openidc" \
     --foreman-keycloak-realm "Satellite_Realm"

     Copy to Clipboard Toggle word wrap

   • If you want your users to authenticate to Satellite using the CLI, create a client as follows:

     # keycloak-httpd-client-install --app-name hammer-openidc \
     --keycloak-server-url "https://RHSSO.example.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Copy to Clipboard Toggle word wrap

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

3. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to Clients and click the Satellite client.

2. Configure access type:

   • If you want your users to authenticate to Satellite using the Satellite web UI, from the Access Type list, select confidential.
   • If you want your users to authenticate to Satellite using the CLI, from the Access Type list, select public.

3. In the Valid redirect URI fields, add a valid redirect URI.

   • If you want your users to authenticate to Satellite using the Satellite web UI, in the blank field below the existing URI, enter a URI in the form https://satellite.example.com/users/extlogin. Note that you must add the string /users/extlogin after the Satellite FQDN.

     After completing this step, the Satellite client for logging in using the Satellite web UI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     https://satellite.example.com/users/extlogin

     Copy to Clipboard Toggle word wrap

   • If you want your users to authenticate to Satellite using the CLI, in the blank field below the existing URI, enter urn:ietf:wg:oauth:2.0:oob.

     After completing this step, the Satellite client for logging in using the CLI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     urn:ietf:wg:oauth:2.0:oob

     Copy to Clipboard Toggle word wrap
4. Click Save.
5. Click the Mappers tab and click Create to add an audience mapper.
6. In the Name field, enter a name for the audience mapper.
7. From the Mapper Type list, select Audience.
8. From the Included Client Audience list, select the Satellite client.
9. Click Save.
10. Click Create to add a group mapper so that you can specify authorization in Satellite based on group membership.
11. In the Name field, enter a name for the group mapper.
12. From the Mapper Type list, select Group Membership.
13. In the Token Claim Name field, enter groups.
14. Set the Full group path setting to OFF.
15. Click Save.

Procedure

1. To authenticate to the Satellite CLI using the code grant type, enter the following command:

   # hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://RHSSO.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://RHSSO.example.com/auth' \
   --oidc-client-id 'satellite.example.com-foreman-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   Copy to Clipboard Toggle word wrap

   The command prompts you to enter a success code.

2. To retrieve the success code, navigate to the URL that the command returns and provide the required information.
3. Copy the success code that the web UI returns.
4. In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Satellite CLI.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.
2. Click Create User Group.
3. In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.
4. Do not add users and user groups to the right-hand columns. Click the Roles tab.
5. Select the Administer checkbox.
6. Click the External Groups tab.
7. Click Add external user group.
8. In the Name field, enter the name of the Active Directory group.
9. From the list, select EXTERNAL.

1. Users authenticate to Satellite using the Satellite web UI.
2. Users authenticate to Satellite using the Satellite CLI.

Procedure

1. On Satellite Server, install the following packages:

   # satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml

   Copy to Clipboard Toggle word wrap

2. Register Satellite to Red Hat Single Sign-On as a client. Note that you the registration process for logging in using the web UI and the CLI are different.

   • If you want you users to authenticate to Satellite using the web UI, create a client as follows:

     # keycloak-httpd-client-install --app-name foreman-openidc \
     --keycloak-server-url "https://RHSSO.example.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Copy to Clipboard Toggle word wrap

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

     Then, configure Satellite to use Red Hat Single Sign-On as an authentication source:

     # satellite-installer --foreman-keycloak true \
     --foreman-keycloak-app-name "foreman-openidc" \
     --foreman-keycloak-realm "Satellite_Realm"

     Copy to Clipboard Toggle word wrap

   • If you want your users to authenticate to Satellite using the CLI, create a client as follows:

     # keycloak-httpd-client-install --app-name hammer-openidc \
     --keycloak-server-url "https://RHSSO.example.com" \
     --keycloak-admin-username "admin" \
     --keycloak-realm "Satellite_Realm" \
     --keycloak-admin-realm master \
     --keycloak-auth-role root-admin \
     -t openidc -l /users/extlogin --force

     Copy to Clipboard Toggle word wrap

     Enter the password for the administer account when prompted. This command creates a client for Satellite in Red Hat Single Sign-On.

3. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to Clients and click the Satellite client.

2. Configure access type:

   • If you want your users to authenticate to Satellite using the Satellite web UI, from the Access Type list, select confidential.
   • If you want your users to authenticate to Satellite using the CLI, from the Access Type list, select public.

3. In the Valid redirect URI fields, add a valid redirect URI.

   • If you want your users to authenticate to Satellite using the Satellite web UI, in the blank field below the existing URI, enter a URI in the form https://satellite.example.com/users/extlogin. Note that you must add the string /users/extlogin after the Satellite FQDN.

     After completing this step, the Satellite client for logging in using the Satellite web UI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     https://satellite.example.com/users/extlogin

     Copy to Clipboard Toggle word wrap

   • If you want your users to authenticate to Satellite using the CLI, in the blank field below the existing URI, enter urn:ietf:wg:oauth:2.0:oob.

     After completing this step, the Satellite client for logging in using the CLI must have the following Valid Redirect URIs:

     https://satellite.example.com/users/extlogin/redirect_uri
     urn:ietf:wg:oauth:2.0:oob

     Copy to Clipboard Toggle word wrap
4. Click Save.
5. Click the Mappers tab and click Create to add an audience mapper.
6. In the Name field, enter a name for the audience mapper.
7. From the Mapper Type list, select Audience.
8. From the Included Client Audience list, select the Satellite client.
9. Click Save.
10. Click Create to add a group mapper so that you can specify authorization in Satellite based on group membership.
11. In the Name field, enter a name for the group mapper.
12. From the Mapper Type list, select Group Membership.
13. In the Token Claim Name field, enter groups.
14. Set the Full group path setting to OFF.
15. Click Save.

Procedure

1. In the Red Hat Single Sign-On web UI, navigate to the Satellite realm.
2. Navigate to Authentication, and click the OTP Policy tab.
3. Ensure that the Supported Applications field includes FreeOTP or Google Authenticator.
4. Configure the OTP settings to suit your requirements.
5. Optional: If you want to use TOTP authentication as a default authentication method for all users, click the Flows tab, and to the right of the OTP Form setting, select REQUIRED.
6. Click the Required Actions tab.
7. To the right of the Configure OTP row, select the Default Action checkbox.

Procedure

1. Log in to Satellite, Satellite redirects you to the Red Hat Single Sign-On login screen.
2. Enter your username and password, and click Log In.
3. The first attempt to log in, Red Hat Single Sign-On requests you to configure your client by scanning the barcode and entering the pin displayed.
4. After you configure your client and enter a valid PIN, Red Hat Single Sign-On redirects you to Satellite and logs you in.

Procedure

1. To authenticate to the Satellite CLI using the code grant type, enter the following command:

   # hammer auth login oauth \
   --two-factor \
   --oidc-token-endpoint 'https://RHSSO.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
   --oidc-authorization-endpoint 'https://RHSSO.example.com/auth' \
   --oidc-client-id 'satellite.example.com-foreman-openidc' \
   --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

   Copy to Clipboard Toggle word wrap

   The command prompts you to enter a success code.

2. To retrieve the success code, navigate to the URL that the command returns and provide the required information.
3. Copy the success code that the web UI returns.
4. In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Satellite CLI.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.
2. Click Create User Group.
3. In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.
4. Do not add users and user groups to the right-hand columns. Click the Roles tab.
5. Select the Administer checkbox.
6. Click the External Groups tab.
7. Click Add external user group.
8. In the Name field, enter the name of the Active Directory group.
9. From the list, select EXTERNAL.