Chapter 4. Identity and Access Management

Procedure

1. Deploy the mgmt-gateway service.

   Syntax

   ceph orch apply mgmt-gateway [--placement=DESTINATION_HOST] [--enable-auth=true]

   Copy to Clipboard Toggle word wrap

   Note

   The --enable-auth=true parameter is mandatory to enable SSO with the oauth2-proxy.

   Example

   [ceph: root@host01 /]# ceph orch apply mgmt-gateway --placement=host01

   Copy to Clipboard Toggle word wrap

2. Verify that the service was correctly deployed.

Procedure

1. Create a YAML file for the mgmt-gateway service.

   Example

   [root@host01 ~]# touch mgmt-gateway.yaml

   Copy to Clipboard Toggle word wrap

2. Edit the YAML file to include the following details.

   Important

   The following fields are optional: ssl_protocols, ssl_ciphers, and ssl_certificate. When omitted, the mgmt-gateway service uses a safe and secure configuration. Changing these fields are permitted but should be done with care as this can compromise the security of your system.

   Syntax

   service_type: mgmt-gateway
   placement:
     hosts:
       - ceph-node-1
   spec:
    port: 9443
    ssl_protocols:   # Optional
      - TLSv1.3
    ssl_ciphers:     # Optional
      - AES128-SHA
      - AES256-SHA
      - RC4-SHA
    ssl_cert: |   # Optional
      -----BEGIN CERTIFICATE-----
      < YOU CERT DATA HERE >
      -----END CERTIFICATE-----
    ssl_key: |
     -----BEGIN RSA PRIVATE KEY-----
      < YOU PRIV KEY DATA HERE >
     -----END RSA PRIVATE KEY-----

   Copy to Clipboard Toggle word wrap

   Important

   Use the TLSv1.3 SSL protocol. TLSv1.3 includes a set of secure ciphers by default. While TLSv1.2 is supported, it is crucial to use only a subset of secure ciphers when using this protocol. Using weak or outdated ciphers can significantly compromise the security of your system.

   Example

   service_type: mgmt-gateway
   service_id: gateway
   placement:
     hosts:
       - ceph0
   spec:
    port: 5000
    ssl_protocols:
      - TLSv1.3
      - ...
    ssl_ciphers:
      - AES128-SHA
      - AES256-SHA
      - ...
    ssl_cert: |
      -----BEGIN CERTIFICATE-----
      MIIDtTCCAp2gAwIBAgIYMC4xNzc1NDQxNjEzMzc2MjMyXzxvQ7EcMA0GCSqGSIb3
      DQEBCwUAMG0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARVdGFoMRcwFQYDVQQHDA5T
      [...]
      -----END CERTIFICATE-----
   ssl_key: |
      -----BEGIN PRIVATE KEY-----
      MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC5jdYbjtNTAKW4
      /CwQr/7wOiLGzVxChn3mmCIF3DwbL/qvTFTX2d8bDf6LjGwLYloXHscRfxszX/4h
      [...]
      -----END PRIVATE KEY-----

   Copy to Clipboard Toggle word wrap

   The following table lists fields that are specific to the mgmt-gateway service section of the spec file (ceph.deployment.service_spec.MgmtGatewaySpec).

   Expand

   Table 4.1. mgmt-gateway specific fields in the spec file

   Field	Description
   disable_https	Is a flag to disable HTTPS. If True, the server will use unsecure HTTP.
   enable_auth	Is a flag to enable SSO auth. Requires oauth2-proxy to be active for SSO authentication.
   networks	A list of network identities instructing the daemons to only bind on the particular networks in that list. In case the cluster is distributed across multiple networks, you can add multiple networks.
   placement	For the orchestrator to deploy a service, it needs to know where to deploy daemons, and how many to deploy. This is the role of a placement specification. Placement specifications can either be passed as command line arguments or in a YAML files. For more information, see Management of services using the Ceph Orchestrator.
   port	The port number on which the server will listen.
   server_tokens	Flag control server tokens in responses: on, off, build, string.
   ssl_cert	A multi-line string that contains the SSL certificate.
   ssl_key	A multi-line string that contains the SSL key.
   ssl_ciphers	List of supported secure SSL ciphers. Changing this list may reduce system security.
   ssl_prefer_server_ciphers	Prefer server ciphers over client ciphers: on, off.
   ssl_protocols	A list of supported SSL protocols (as supported by nginx).
   ssl_session_cache	Duration an SSL/TLS session is cached: off, none, [builtin[:size]], [shared:name:size].
   ssl_session_tickets	A multi-option flag to control session tickets: on, off.
   ssl_session_timeout	The duration for SSL session timeout. Syntax: time (for example, 5m).
   ssl_stapling	Flag to enable or disable SSL stapling: on, off.
   ssl_stapling_verify	Flag to control verification of SSL stapling: on, off.

   Show more

3. Apply the specification file.

   Syntax

   [root@host01 ~]# ceph orch apply -i mgmt-gateway.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Download the Red Hat Single Sign-On 7.6.0 Server on the system where IBM Storage Ceph is installed.. For download package and information, see Software Details for Red Hat Single Sign-On 7.6.0 Server on the Red Hat Customer Portal.

2. Extract the folder:

   Syntax

   [root@host01 ~]# unzip rhsso-7.6.0.zip

   Copy to Clipboard Toggle word wrap

3. Go to the standalone/configuration directory under the newly created rhsso-7.6.0 directory and open the standalone.xml file for editing

   Syntax

   [root@host01 ~]# cd standalone/configuration
   [root@host01 configuration]# vi standalone.xml

   Copy to Clipboard Toggle word wrap

4. Replace the localhost and 127.0.0.1 with the IP address of the server where the Red Hat Single-Sign On is installed.

5. From the bin directory of the newly created rhsso-7.6.0 folder, run the add-user-keycloak script to add the initial administrator user:

   Syntax

   [root@host01 bin]# ./add-user-keycloak.sh -u admin

   Copy to Clipboard Toggle word wrap

6. Optional: Users with Red Hat Enterprise Linux 8 or later might get Certificate Authority (CA) issues. Import the custom certificates from CA and move them into the keystore with the exact Java version.

   Syntax

   keytool -import -noprompt -trustcacerts -alias ca -file ../ca.cer -keystore /etc/java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.272.b10-3.el8_3.x86_64/lib/security/cacert

   Copy to Clipboard Toggle word wrap

7. Start the server. From the bin directory of rh-sso-7.6 folder, run the standalone boot script:

   [root@host01 bin]# ./standalone.sh

   Copy to Clipboard Toggle word wrap

8. Log in to the admin account in https:IP_ADDRESS:8080/auth with the new username and password created.

   Note

   You have to create an admin account only the first time that you log into the console.