Chapter 4. Additional Configuration

Procedure 4.1. Configuring Single Sign-On for Red Hat Enterprise Linux Virtual Machines

1. Log in to the Red Hat Enterprise Linux virtual machine.
2. Enable the required channel:
   • For Red Hat Enterprise Linux 6

     # subscription-manager repos --enable=rhel-6-server-rhev-agent-rpms

     Copy to Clipboard Toggle word wrap
   • For Red Hat Enterprise Linux 7

     # subscription-manager repos --enable=rhel-7-server-rh-common-rpms

     Copy to Clipboard Toggle word wrap
3. Download and install the guest agent packages:

   # yum install rhevm-guest-agent-common

   Copy to Clipboard Toggle word wrap
4. Install the single sign-on packages:

   # yum install rhevm-guest-agent-pam-module
   # yum install rhevm-guest-agent-gdm-plugin

   Copy to Clipboard Toggle word wrap
5. Install the IPA packages:

   # yum install ipa-client

   Copy to Clipboard Toggle word wrap
6. Run the following command and follow the prompts to configure ipa-client and join the virtual machine to the domain:

   # ipa-client-install --permit --mkhomedir

   Copy to Clipboard Toggle word wrap

   Note

   In environments that use DNS obfuscation, this command should be:

   # ipa-client-install --domain=FQDN --server==FQDN

   Copy to Clipboard Toggle word wrap
7. For Red Hat Enterprise Linux 7.2, run:

   # authconfig --enablenis --update

   Copy to Clipboard Toggle word wrap

   Note

   Red Hat Enterprise Linux 7.2 has a new version of the System Security Services Daemon (SSSD) which introduces configuration that is incompatible with the Red Hat Enterprise Virtualization Manager guest agent single sign-on implementation. The command will ensure that single sign-on works.
8. Fetch the details of an IPA user:

   # getent passwd IPA_user_name

   Copy to Clipboard Toggle word wrap
   This will return something like this:

   some-ipa-user:*:936600010:936600001::/home/some-ipa-user:/bin/sh

   Copy to Clipboard Toggle word wrap
   You will need this information in the next step to create a home directory for some-ipa-user.
9. Set up a home directory for the IPA user:
   1. Create the new user's home directory:

      # mkdir /home/some-ipa-user

      Copy to Clipboard Toggle word wrap
   2. Give the new user ownership of the new user's home directory:

      # chown 935500010:936600001 /home/some-ipa-user

      Copy to Clipboard Toggle word wrap

Procedure 4.2. Configuring Single Sign-On for Red Hat Enterprise Linux Virtual Machines

1. Log in to the Red Hat Enterprise Linux virtual machine.
2. Enable the Red Hat Enterprise Virtualization Agent channel:

   • For Red Hat Enterprise Linux 6

     # subscription-manager repos --enable=rhel-6-server-rhev-agent-rpms

     Copy to Clipboard Toggle word wrap
   • For Red Hat Enterprise Linux 7

     # subscription-manager repos --enable=rhel-7-server-rh-common-rpms

     Copy to Clipboard Toggle word wrap
3. Download and install the guest agent packages:

   # yum install rhevm-guest-agent-common

   Copy to Clipboard Toggle word wrap
4. Install the single sign-on packages:

   # yum install rhev-agent-gdm-plugin-rhevcred

   Copy to Clipboard Toggle word wrap
5. Install the Samba client packages:

   # yum install samba-client samba-winbind samba-winbind-clients

   Copy to Clipboard Toggle word wrap
6. On the virtual machine, modify the /etc/samba/smb.conf file to contain the following, replacing DOMAIN with the short domain name and REALM.LOCAL with the Active Directory realm:

   [global]
      workgroup = DOMAIN
      realm = REALM.LOCAL
      log level = 2
      syslog = 0
      server string = Linux File Server
      security = ads
      log file = /var/log/samba/%m
      max log size = 50
      printcap name = cups
      printing = cups
      winbind enum users = Yes
      winbind enum groups = Yes
      winbind use default domain = true
      winbind separator = +
      idmap uid = 1000000-2000000
      idmap gid = 1000000-2000000
      template shell = /bin/bash

   Copy to Clipboard Toggle word wrap
7. Join the virtual machine to the domain:

   net ads join -U user_name

   Copy to Clipboard Toggle word wrap
8. Start the winbind service and ensure it starts on boot:

   # service winbind start
   # chkconfig winbind on

   Copy to Clipboard Toggle word wrap
9. Verify that the system can communicate with Active Directory:
   1. Verify that a trust relationship has been created:

      # wbinfo -t

      Copy to Clipboard Toggle word wrap
   2. Verify that you can list users:

      # wbinfo -u

      Copy to Clipboard Toggle word wrap
   3. Verify that you can list groups:

      # wbinfo -g

      Copy to Clipboard Toggle word wrap
10. Configure the NSS and PAM stack:
    1. Open the Authentication Configuration window:

       # authconfig-tui

       Copy to Clipboard Toggle word wrap
    2. Select the Use Winbind check box, select Next and press Enter.
    3. Select the OK button and press Enter.

Procedure 4.3. Configuring Single Sign-On for Windows Virtual Machines

1. Select the Windows virtual machine. Ensure the machine is powered up.
2. Click Change CD.
3. Select RHEV-toolsSetup.iso from the list of images.
4. Click OK.
5. Click the Console icon and log in to the virtual machine.
6. On the virtual machine, locate the CD drive to access the contents of the guest tools ISO file and launch RHEV-ToolsSetup.exe. After the tools have been installed, you will be prompted to restart the machine to apply the changes.

Procedure 4.4. Disabling Single Sign-On for Virtual Machines

1. Select a virtual machine and click Edit.
2. Click the Console tab.
3. Select the Disable Single Sign On check box.
4. Click OK.