Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

13.3.3. Configuring Direct AD Integration with GSS-proxy

In the Satellite CLI, configure the direct Active Directory integration with GSS-proxy.

Prerequisite

Procedure

  1. Create the /etc/ipa/ directory and the default.conf file: 

    # mkdir /etc/ipa
# touch /etc/ipa/default.conf
    Copy to Clipboard Toggle word wrap

  2. To the default.conf file, add the following content: 

    [global]
server = unused
realm = EXAMPLE.ORG
    Copy to Clipboard Toggle word wrap

  3. Create the /etc/net-keytab.conf file with the following content: 

    [global]
workgroup = EXAMPLE
realm = EXAMPLE.ORG
kerberos method = system keytab
security = ads
    Copy to Clipboard Toggle word wrap

  4. Determine the effective user ID of the Apache user: 

    # id apache
    Copy to Clipboard Toggle word wrap

    Apache user must not have access to the keytab file.

  5. Create the /etc/gssproxy/00-http.conf file with the following content: 

    [service/HTTP]
mechs = krb5
cred_store = keytab:/etc/krb5.keytab
cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
euid = ID_of_Apache_User
    Copy to Clipboard Toggle word wrap

  6. Create a keytab entry: 

    # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf
# chown root.apache /etc/httpd/conf/http.keytab
# chmod 640 /etc/httpd/conf/http.keytab
    Copy to Clipboard Toggle word wrap

  7. Enable IPA authenication in Satellite: 

    # satellite-installer --foreman-ipa-authentication=true
    Copy to Clipboard Toggle word wrap

  8. Start and enable the gssproxy service: 

    # systemctl restart gssproxy.service
# systemctl enable gssproxy.service
    Copy to Clipboard Toggle word wrap

  9. Configure the Apache server to use the gssproxy service:

    1. Create the /etc/systemd/system/httpd.service file with the following content: 

      .include /lib/systemd/system/httpd.service
[Service]
Environment=GSS_USE_PROXY=1
      Copy to Clipboard Toggle word wrap

    2. Apply changes to the service: 

      # systemctl daemon-reload
      Copy to Clipboard Toggle word wrap

  10. Start and enable the httpd service: 

    # systemctl restart httpd.service
    Copy to Clipboard Toggle word wrap

  11. Verify that SSO is working as expected.

    With a running Apache server, users making HTTP requests against the server are authenticated if the client has a valid Kerberos ticket.

    1. Retrieve the Kerberos ticket of the LDAP user, using the following command: 

      # kinit ldapuser
      Copy to Clipboard Toggle word wrap

    2. View the Kerberos ticket, using the following command: 

      # klist
      Copy to Clipboard Toggle word wrap

    3. View output from successful SSO-based authentication, using the following command: 

      # curl -k -u : --negotiate https://satellite.example.com/users/extlogin
      Copy to Clipboard Toggle word wrap

      This returns the following response: 

      <html><body>You are being <a href="https://satellite.example.com/users/4-ldapuserexample-com/edit">redirected</a>.</body></html>
      Copy to Clipboard Toggle word wrap
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat