2.2. Using Ansible to configure the IdM server for smart card authentication

Procedure

1. If your CA certificates are stored in files of a different format, such as DER, convert them to PEM format:

   # openssl x509 -in <filename>.der -inform DER -out <filename>.pem -outform PEM

   The IdM Certificate Authority certificate is in PEM format and is located in the /etc/ipa/ca.crt file.

2. Optional: Use the openssl x509 utility to view the contents of the files in the PEM format to check that the Issuer and Subject values are correct:

   # openssl x509 -noout -text -in root-ca.pem | more

3. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

4. Create a subdirectory dedicated to the CA certificates:

   $ mkdir SmartCard/

5. For convenience, copy all the required certificates to the ~/MyPlaybooks/SmartCard/ directory:

   # cp /tmp/root-ca.pem ~/MyPlaybooks/SmartCard/
   # cp /tmp/intermediate-ca.pem ~/MyPlaybooks/SmartCard/
   # cp /etc/ipa/ca.crt ~/MyPlaybooks/SmartCard/ipa-ca.crt

6. In your Ansible inventory file, specify the following:

   • The IdM servers that you want to configure for smart card authentication.
   • The IdM administrator password.

   • The paths to the certificates of the CAs in the following order:

     • The root CA certificate file
     • The intermediate CA certificates files
     • The IdM CA certificate file

   The file can look as follows:

   [ipaserver]
   ipaserver.idm.example.com
   
   [ipareplicas]
   ipareplica1.idm.example.com
   ipareplica2.idm.example.com
   
   [ipacluster:children]
   ipaserver
   ipareplicas
   
   [ipacluster:vars]
   ipaadmin_password= "{{ ipaadmin_password }}"
   ipasmartcard_server_ca_certs=/home/<user_name>/MyPlaybooks/SmartCard/root-ca.pem,/home/<user_name>/MyPlaybooks/SmartCard/intermediate-ca.pem,/home/<user_name>/MyPlaybooks/SmartCard/ipa-ca.crt

7. Create an install-smartcard-server.yml playbook with the following content:

   ---
   - name: Playbook to set up smart card authentication for an IdM server
     hosts: ipaserver
     become: true
   
     roles:
     - role: ipasmartcard_server
       state: present

8. Save the file.

   For example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

9. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory install-smartcard-server.yml

   The ipasmartcard_server Ansible role performs the following actions:

   • It configures the IdM Apache HTTP Server.
   • It enables Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) on the Key Distribution Center (KDC).
   • It configures the IdM Web UI to accept smart card authorization requests.

10. Optional: If the certificate authority that issued the user certificate does not provide any Online Certificate Status Protocol (OCSP) responder, you may need to disable OCSP check for authentication to the IdM Web UI:

    1. Connect to the IdM server as root:

       ssh root@ipaserver.idm.example.com

    2. Set the SSLOCSPEnable parameter to off in the /etc/httpd/conf.d/ssl.conf file:

       SSLOCSPEnable off

    3. Restart the Apache daemon (httpd) for the changes to take effect immediately:

       # systemctl restart httpd

    警告

    Do not disable the OCSP check if you only use user certificates issued by the IdM CA. OCSP responders are part of IdM.

    For instructions on how to keep the OCSP check enabled, and yet prevent a user certificate from being rejected by the IdM server if it does not contain the information about the location at which the CA that issued the user certificate listens for OCSP service requests, see the SSLOCSPDefaultResponder directive in Apache mod_ssl configuration options.

    The server listed in the inventory file is now configured for smart card authentication.

    注意

    To enable smart card authentication in the whole topology, set the hosts variable in the Ansible playbook to ipacluster:

    ---
    - name: Playbook to set up smartcard for IPA server and replicas
      hosts: ipacluster
    [...]