搜索

19.5.3. 在 Manager 中配置 Apache

download PDF
  1. 在 Manager 中配置 Apache。

    # yum install mod_auth_openidc
  2. /etc/ httpd /conf.d 中创建一个新的 httpd 配置文件 ovirt-openidc.conf,其内容如下:

    LoadModule auth_openidc_module modules/mod_auth_openidc.so
    
    OIDCProviderMetadataURL https://SSO.example.com/auth/realms/master/.well-known/openid-configuration
    OIDCSSLValidateServer Off
    
    OIDCClientID ovirt-engine
    OIDCClientSecret <client_SSO _generated_key>
    OIDCRedirectURI https://rhvm.example.com/ovirt-engine/callback
    OIDCDefaultURL https://rhvm.example.com/ovirt-engine/login?scope=ovirt-app-admin+ovirt-app-portal+ovirt-ext%3Dauth%3Asequence-priority%3D%7E
    
    # maps the prefered_username claim to the REMOTE_USER environment variable:
    
    OIDCRemoteUserClaim <preferred_username>
    OIDCCryptoPassphrase <random1234>
    
    <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/callback>
        <If "req('Authorization') !~ /^(Bearer|Basic)/i">
    
          Require valid-user
          AuthType openid-connect
    
          ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>"
        </If>
    </LocationMatch>
    
    OIDCOAuthIntrospectionEndpoint https://SSO.example.com/auth/realms/master/protocol/openid-connect/token/introspect
    OIDCOAuthSSLValidateServer    Off
    OIDCOAuthIntrospectionEndpointParams token_type_hint=access_token
    OIDCOAuthClientID ovirt-engine
    OIDCOAuthClientSecret <client_SSO _generated_key>
    OIDCOAuthRemoteUserClaim sub
    
    <LocationMatch ^/ovirt-engine/(api$|api/)>
       AuthType oauth20
       Require valid-user
    </LocationMatch>
  3. 要保存配置更改,请重启 httpdovirt-engine

    # systemctl restart httpd
    # systemctl restart ovirt-engine
  4. /etc/ovirt-engine/extensions.d/ 中创建文件 openidc-authn.properties,其内容如下:

    ovirt.engine.extension.name = openidc-authn
    ovirt.engine.extension.bindings.method = jbossmodule
    ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.misc
    ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension
    ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn
    ovirt.engine.aaa.authn.profile.name = openidchttp
    ovirt.engine.aaa.authn.authz.plugin = openidc-authz
    ovirt.engine.aaa.authn.mapping.plugin = openidc-http-mapping
    config.artifact.name = HEADER
    config.artifact.arg = OIDC_CLAIM_preferred_username
  5. /etc/ovirt-engine/extensions.d/ 中创建文件 openidc-http-mapping.properties,其内容如下:

    ovirt.engine.extension.name = openidc-http-mapping
    ovirt.engine.extension.bindings.method = jbossmodule
    ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.misc
    ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.misc.mapping.MappingExtension
    ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Mapping
    config.mapAuthRecord.type = regex
    config.mapAuthRecord.regex.mustMatch = false
    config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$
    config.mapAuthRecord.regex.replacement = ${user}${at}${suffix}
  6. /etc/ovirt-engine/extensions.d/ 中创建文件 openidc-authz.properties,其内容如下:

    ovirt.engine.extension.name = openidc-authz
    ovirt.engine.extension.bindings.method = jbossmodule
    ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.misc
    ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.misc.http.AuthzExtension
    ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz
    config.artifact.name.arg = OIDC_CLAIM_preferred_username
    config.artifact.groups.arg = OIDC_CLAIM_groups
  7. /etc/ovirt-engine/engine.conf.d/ 中创建文件 99-enable-external-auth.conf,其内容如下:

    ENGINE_SSO_ENABLE_EXTERNAL_SSO=true
    ENGINE_SSO_EXTERNAL_SSO_LOGOUT_URI="${ENGINE_URI}/callback"
    EXTERNAL_OIDC_USER_INFO_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/userinfo
    EXTERNAL_OIDC_TOKEN_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/token
    EXTERNAL_OIDC_LOGOUT_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/logout
    EXTERNAL_OIDC_CLIENT_ID=ovirt-engine
    EXTERNAL_OIDC_CLIENT_SECRET="<client_SSO _generated_key>"
    EXTERNAL_OIDC_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
    EXTERNAL_OIDC_HTTPS_PKI_TRUST_STORE_PASSWORD=""
    EXTERNAL_OIDC_SSL_VERIFY_CHAIN=false
    EXTERNAL_OIDC_SSL_VERIFY_HOST=false
Red Hat logoGithubRedditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

© 2024 Red Hat, Inc.