Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 2. Configure Red Hat Identity Management

In this example, IdM is situated externally to the OpenStack Red Hat OpenStack Platform director deployment and is the source of all user and group information. RH-SSO will be configured to use IdM as its User Federation, and will then perform LDAP searches against IdM to obtain user and group information.

2.1. Create the IdM Service Account for RH-SSO
링크 복사

Although IdM allows anonymous binds, some information is withheld for security reasons. Some of this information withheld during anonymous binds is essential for RH-SSO user federation; consequently, RH-SSO will need to bind to the IdM LDAP server with enough privileges to successfully query the required information. As a result, you will need to create a dedicated service account for RH-SSO in IdM. IdM does not natively provide a command to do this, but you can use the ldapmodify command. For example: 

ldap_url="ldaps://$FED_IPA_HOST"
dir_mgr_dn="cn=Directory Manager"
service_name="rhsso"
service_dn="uid=$service_name,cn=sysaccounts,cn=etc,$FED_IPA_BASE_DN"

$ ldapmodify -H "$ldap_url" -x -D "$dir_mgr_dn" -w "$FED_IPA_ADMIN_PASSWD" <<EOF
dn: $service_dn
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: $service_name
userPassword: $FED_IPA_RHSSO_SERVICE_PASSWD
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0

EOF
Copy to Clipboard Toggle word wrap
Note

You can use the configure-federation script to perform the above step: 

$ ./configure-federation create-ipa-service-account
Copy to Clipboard Toggle word wrap

2.2. Create a test user
링크 복사

You will also need a test user account in IdM. You can either use an existing user or create a new one; the examples in this guide use "John Doe" with a uid of jdoe. You can create the jdoe user in IdM: 

$ ipa user-add --first John --last Doe --email jdoe@example.com jdoe
Copy to Clipboard Toggle word wrap

Assign a password to the user: 

$ ipa passwd jdoe
Copy to Clipboard Toggle word wrap

2.3. Create an IdM group for OpenStack Users
링크 복사

Create the openstack-users group in IdM.

  1. Make sure the openstack-users group does not already exist: 

    $ ipa group-show openstack-users
ipa: ERROR: openstack-users: group not found
    Copy to Clipboard Toggle word wrap

  2. Add the openstack-users group to IdM: 

    $ ipa group-add openstack-users
    Copy to Clipboard Toggle word wrap

  3. Add the test user to the openstack-users group: 

    $ ipa group-add-member --users jdoe openstack-users
    Copy to Clipboard Toggle word wrap

  4. Verify that the openstack-users group exists and has the test user as a member: 

    $ ipa group-show openstack-users
  Group name: openstack-users
  GID: 331400001
  Member users: jdoe
    Copy to Clipboard Toggle word wrap
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat