Configuring authentication for Red Hat Satellite users Red Hat Satellite 6.16 Configure authentication for Satellite users and enable authentication features such as SSO, OTP, or 2FA Red Hat Satellite Documentation Team satellite-doc-list@redhat.com

Commands:
https:// satellite.example.com /
hostname -f
https:// satellite.example.com /pub
scp /var/www/html/pub/katello-server-ca.crt username@hostname:remotefile
foreman-rake permissions:reset Reset to user: admin, password: qwJxBptxb7Gfcjj5
vi ~/.hammer/cli.modules.d/foreman.yml
foreman-rake permissions:reset password= new_password
vi ~/.hammer/cli.modules.d/foreman.yml
id admin
kinit admin
klist
ipa host-add --random satellite-server.example.com -------------------------------------------------- Added host "satellite-server.example.com" -------------------------------------------------- Host name: satellite-server.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: ipa-server.example.com
ipa service-add HTTP/ satellite-server.example.com
satellite-maintain packages install ipa-client
ipa-client-install --password 'W5YpARl=7M.n'
id admin
satellite-installer --foreman-ipa-authentication=true
satellite-installer --foreman-ipa-authentication-api=true --foreman-ipa-authentication=true
satellite-installer --reset-foreman-ipa-authentication-api
satellite-installer --foreman-pam-service=foreman-prod
kinit admin
klist
ipa hbacsvc-add satellite-prod
ipa hbacrule-add allow-satellite-prod
ipa hbacrule-add-service allow-satellite-prod --hbacsvcs=satellite-prod
ipa hbacrule-add-host allow-satellite-prod --hosts= satellite.example.com
ipa hbacrule-add-user allow-satellite-prod --user= ipa-user
ipa hbacrule-find satellite-prod ipa hbactest --user= ipa-user --host= satellite.example.com --service=satellite-prod
ipa hbacrule-disable allow_all
satellite-installer --foreman-pam-service=satellite-prod
:foreman: :use_sessions: true
:foreman: :default_auth_type: 'Negotiate_Auth' :use_sessions: true
kinit Identity_Management_user
hammer auth login negotiate
hammer host list
kinit user Password for user@EXAMPLE.COM:
google-chrome --auth-server-whitelist="*. example.com " --auth-negotiate-delegate-whitelist="*. example.com "
kinit user Password for user@EXAMPLE.COM:
[domain/EXAMPLE.com] krb5_store_password_if_offline = True ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname [nss] user_attributes=+email, +firstname, +lastname [ifp] allowed_uids = ipaapi, root user_attributes=+email, +firstname, +lastname
systemctl stop sssd
sss_cache -E
systemctl start sssd
dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname
satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml
keycloak-httpd-client-install --app-name foreman-openidc --keycloak-server-url "https:// rhsso.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "foreman-openidc" --foreman-keycloak-realm " Satellite_Realm "
keycloak-httpd-client-install --app-name hammer-openidc --keycloak-server-url "https:// rhsso.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "hammer-openidc" --foreman-keycloak-realm " Satellite_Realm "
satellite-installer --reset-foreman-keycloak
systemctl restart httpd
hammer settings set --name authorize_login_delegation --value true
hammer settings set --name login_delegation_logout_url --value https:// satellite.example.com /users/extlogout
hammer settings set --name oidc_algorithm --value 'RS256'
hammer settings set --name oidc_audience --value "[' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_audience --value "[' satellite.example.com -foreman-openidc', ' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_issuer --value "https:// rhsso.example.com /auth/realms/ KEYCLOAK_REALM "
hammer settings set --name oidc_jwks_url --value "https:// rhsso.example.com /auth/realms/ KEYCLOAK_REALM /protocol/openid-connect/certs"
hammer auth-source external list
hammer auth-source external update --id My_Authentication_Source_ID --location-ids My_Location_ID --organization-ids My_Organization_ID
:foreman: :use_sessions: true
hammer auth login oauth --oidc-token-endpoint 'https:// rhsso.example.com /auth/realms/ Satellite_realm /protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// rhsso.example.com /auth' --oidc-client-id ' satellite.example.com -hammer-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob
:foreman: :use_sessions: true
hammer auth login oauth --two-factor --oidc-token-endpoint 'https:// rhsso.example.com /auth/realms/ Satellite_realm /protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// rhsso.example.com /auth' --oidc-client-id ' satellite.example.com -hammer-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob
satellite-maintain packages install adcli krb5-workstation oddjob-mkhomedir oddjob realmd samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator sssd
realm join AD.EXAMPLE.COM --membership-software=samba --client-software=sssd
mkdir /etc/ipa/
[global] realm = AD.EXAMPLE.COM
[global] workgroup = AD.EXAMPLE realm = AD.EXAMPLE.COM kerberos method = system keytab security = ads
KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U Administrator -s /etc/samba/smb.conf
[domain/ ad.example.com ] ad_gpo_access_control = enforcing ad_gpo_map_service = +foreman
systemctl restart sssd
satellite-installer --foreman-ipa-authentication=true
kinit ad_user @ AD.EXAMPLE.COM
curl -k -u : --negotiate https://satellite.example.com/users/extlogin <html><body>You are being <a href="satellite.example.com/hosts">redirected</a>.</body></html>
Authentication failed with status code: { "error": { "message": "ERF77-7629 [Foreman::LdapException]: Error while connecting to 'server.com' LDAP server at 'ldap.example.com' during authentication ([Net::LDAP::Error]: Connection reset by peer - SSL_connect)" } }
openssl s_client -connect ldap.example.com :636
cp /tmp/ example.crt /etc/pki/tls/source/anchors
update-ca-trust extract
setsebool -P nis_enabled on
DC=Domain,DC=Example | |----- CN=Users | |----- CN=Group1 |----- CN=Group2 |----- CN=User1 |----- CN=User2 |----- CN=User3
grep 'puppet\|apache\|foreman\|foreman-proxy' /etc/passwd /etc/group
id username
foreman-rake ldap:refresh_usergroups