52.7. 启用 IdM 用户通过外部 IdP 进行身份验证

先决条件

• 您的 IdM 客户端和服务器使用 RHEL 8.7 或更高版本。
• 您的 IdM 客户端和服务器使用 SSSD 2.7.0 或更高版本。
• 您已在 IdM 中创建了对外部 IdP 的引用。请参阅创建对外部身份提供程序的引用。

流程

• 修改 IdM 用户条目，将 IdP 引用与用户帐户关联：

  [root@server ~]# ipa user-mod idm-user-with-external-idp \
                 --idp my-keycloak-idp \
                 --idp-user-id idm-user-with-external-idp@idm.example.com \
                 --user-auth-type=idp
  ---------------------------------
  Modified user "idm-user-with-external-idp"
  ---------------------------------
    User login: idm-user-with-external-idp
    First name: Test
    Last name: User1
    Home directory: /home/idm-user-with-external-idp
    Login shell: /bin/sh
    Principal name: idm-user-with-external-idp@idm.example.com
    Principal alias: idm-user-with-external-idp@idm.example.com
    Email address: idm-user-with-external-idp@idm.example.com
    UID: 35000003
    GID: 35000003
    User authentication types: idp
    External IdP configuration: keycloak
    External IdP user identifier: idm-user-with-external-idp@idm.example.com
    Account disabled: False
    Password: False
    Member of groups: ipausers
    Kerberos keys available: False

验证

• 验证该用户的 ipa user-show 命令的输出是否显示对 IdP 的引用：

  [root@server ~]# ipa user-show idm-user-with-external-idp
    User login: idm-user-with-external-idp
    First name: Test
    Last name: User1
    Home directory: /home/idm-user-with-external-idp
    Login shell: /bin/sh
    Principal name: idm-user-with-external-idp@idm.example.com
    Principal alias: idm-user-with-external-idp@idm.example.com
    Email address: idm-user-with-external-idp@idm.example.com
    ID: 35000003
    GID: 35000003
    User authentication types: idp
    External IdP configuration: keycloak
    External IdP user identifier: idm-user-with-external-idp@idm.example.com
    Account disabled: False
    Password: False
    Member of groups: ipausers
    Kerberos keys available: False