Chapter 3. Configuring Kerberos SSO with Identity Management in Satellite Identity Management is an open-source identity management solution that provides centralized authentication, authorization, and account management services. With Satellite, you can integrate Satellite Server with your existing Identity Management server to enable Identity Management users to authenticate to Satellite. With your Identity Management server configured as an external identity provider, users defined in Identity Management can log in to Satellite with their Identity Management credentials. If cross-forest trust is configured between Identity Management and Active Directory, Active Directory users can also log in to Satellite. Identity Management users can log in using the following methods: Username and password Kerberos single sign-on When cross-forest trust is configured between Identity Management and Active Directory, Active Directory users can log in to Satellite with their user principal name (UPN) and password. For information about Identity Management, including its cross-forest trust functionality, see Red Hat Enterprise Linux 8 Planning Identity Management and Red Hat Enterprise Linux 8 Installing Identity Management . 3.1. Enrolling Satellite Server in a Identity Management domain Create a host entry for your Satellite Server system in the Identity Management LDAP and configure the system to be a client in your Identity Management domain. Prerequisites An existing Identity Management server Identity Management user account with privileges to enroll new Identity Management hosts Procedure On the Identity Management server: Create a host entry for the Satellite Server system. For more information, see Red Hat Enterprise Linux 8 Configuring and managing Identity Management or Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules . Create an entry for the HTTP service for Satellite Server. This enables access to the keytab file by creating a service principal for your Satellite Server. For more information on creating a service entry in Identity Management, see Red Hat Enterprise Linux 8 Managing IdM users, groups, hosts, and access control rules or Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules . On your Satellite Server, configure the system as client in the Identity Management domain. This includes ensuring that the system meets the necessary prerequisites, installing the necessary packages, and running the ipa-client-install utility. For more information, see Red Hat Enterprise Linux 8 Installing Identity Management or Red Hat Enterprise Linux 9 Installing Identity Management . Note To install packages on your Satellite Server, use the satellite-installer utility. Verification On your Satellite Server, check that you are able to resolve a user defined on the Identity Management server. For example, to check the admin user that Identity Management creates by default: Example 3.1. Enrolling a Satellite Server system as a Identity Management client from the command line by using a one-time password On the Identity Management server, a user named admin who has administrative privileges on the Identity Management server prepares a host entry for the Satellite Server system: Authenticate as the Identity Management admin user: Optional: Verify that you have authenticated successfully: Create a host entry from the command line. Specify that you want to use a random password for the enrollment. Enable access to the keytab file by creating a service principal for your Satellite Server: On the Satellite Server system, a user with Satellite administrative privileges enrolls the system into the Identity Management domain: Install the Identity Management client packages: Configure the Satellite Server system a client in Identity Management by using the random password produced by ipa host-add in a step: Verify that you are able to resolve the Identity Management admin user from your Satellite Server: 3.2. Configuring the Identity Management authentication source on Satellite Server Enable Identity Management users to access Satellite by configuring Identity Management as an authentication provider on your Satellite Server. Prerequisites Satellite Server running on a system that is enrolled in the Identity Management domain. Procedure To enable access to the Satellite web UI only: To enable access to the Satellite web UI and the Satellite API, including Hammer CLI: Warning Enabling access to both the Satellite web UI and the Satellite API poses a security risk. After the Identity Management user enters kinit to receive a Kerberos ticket-granting ticket (TGT), an attacker might obtain an API session. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser. To disable external authentication with Identity Management, reset the options. For example, to disable access to the Satellite API and Hammer CLI: Verification Log in to Satellite web UI by entering the credentials of a user defined in Identity Management. 3.3. Configuring host-based access control for Identity Management users logging in to Satellite You can use host-based access control (HBAC) rules to manage access control within your Identity Management domain. In Identity Management, HBAC rules define which users can access which hosts and which services can be used to gain access. For example, you can configure HBAC on the Identity Management server to limit access to Satellite Server only to selected users or user groups. By configuring a HBAC rule in the Identity Management domain, you can ensure Satellite does not create database entries for users who should not have access. Prerequisites Identity Management user account with privileges to configure HBAC rules Procedure On the Identity Management server, configure HBAC control. For more information, see Red Hat Enterprise Linux 9 Managing IdM users, groups, hosts, and access control rules or Red Hat Enterprise Linux 8 Managing IdM users, groups, hosts, and access control rules . Create a HBAC service for Satellite Server. Create a new HBAC rule to define the required access control. Add the following Identity Management entities to the HBAC rule: The HBAC service for Satellite Server The Satellite Server host The users or user groups to whom you want to grant access Make sure the default Identity Management allow_all rule is disabled. For information about how to disable allow_all without disrupting other services, see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal. On your Satellite Server, load the host-based access control rules from Identity Management: Verification Log in to the Satellite web UI as a user defined in Identity Management. If the user is included in the HBAC rule, Satellite web UI will grant access. If the user is not included in the HBAC rule, Satellite web UI will not grant access. Example 3.2. Configuring host-based access control to allow access to Satellite only for selected Identity Management users by using the command line On the Identity Management server, a user with administrative privileges configures a HBAC rule to allow selected users access to Satellite Server: Authenticate as the user with privileges required to configure HBAC rules: Optional: Verify that you have authenticated successfully: Create a new HBAC service named satellite-prod : Create a new HBAC rule: Add the following Identity Management entities to the HBAC rule: The satellite-prod HBAC service: The Satellite Server host: The users or user groups to whom you want to grant access: Optional: Verify the status of the rule: Disable the default allow_all rule: On Satellite Server, a Satellite administrator re-runs satellite-installer to load the host-based access control rules from Identity Management: 3.4. Configuring Hammer CLI to accept Identity Management credentials Configure the Satellite Hammer CLI tool to use Identity Management to authenticate users. Prerequisites You have enabled Identity Management access to the Satellite API. For more information, see Section 3.2, "Configuring the Identity Management authentication source on Satellite Server" . Procedure Open the ~/.hammer/cli.modules.d/foreman.yml file on your Satellite Server and update the list of foreman parameters: To enforce session usage, enable :use_sessions: : With this configuration, you will need to initiate an authentication session manually with hammer auth login negotiate . Alternatively, to enforce session usage and also negotiate authentication by default: With this configuration, Hammer will negotiate authentication automatically when you enter the first hammer command. 3.5. Logging in to Hammer CLI with Identity Management credentials Authenticate to the Satellite Hammer CLI with your Identity Management username and password. Prerequisites You have configured Hammer CLI to accept Identity Management credentials. For more information, see Configuring Hammer CLI to accept Identity Management credentials in Installing Satellite Server in a connected network environment . Procedure Authenticate as a user defined in Identity Management to obtain a Kerberos ticket-granting ticket (TGT): Warning If you enabled access to the Satellite API and the Satellite web UI when you were configuring Identity Management as the authentication provider for Satellite, an attacker might now obtain an API session after the user receives the Kerberos TGT. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser. If Hammer is not configured to negotiate authentication, initiate an authentication session manually: Note If you destroy the active Kerberos ticket, for example with kdestroy , you will still be logged in to Hammer. To log out, enter hammer auth logout . Verification Use any hammer command to check that the system does not ask you to authenticate. For example: Additional resources For more information about authenticating with Hammer, see Using the Hammer CLI tool or hammer auth --help . 3.6. Logging in to the Satellite web UI with Identity Management credentials in Mozilla Firefox You can use Mozilla Firefox to log in to the Satellite web UI with your Identity Management credentials. Use the latest stable Mozilla Firefox browser. Prerequisites You have Identity Management authentication configured in your Satellite environment. For more information, see Installing Satellite Server in a connected network environment . The host on which you are using Mozilla Firefox is a client in the Identity Management domain. Your Mozilla Firefox is configured for Single Sign-On (SSO). For more information, see Configuring Firefox to use Kerberos for single sign-on in Configuring authentication and authorization in Red Hat Enterprise Linux 9 . Procedure Obtain the Kerberos ticket granting ticket (TGT): In Mozilla Firefox, go to the URL of your Satellite Server. You are logged in automatically. Alternatively: In your browser address bar, enter the URL of your Satellite Server. Enter your username and password. 3.7. Logging in to the Satellite web UI with Identity Management credentials in Chrome You can use Chrome to log in to the Satellite web UI with your Identity Management credentials. Use the latest stable Chrome browser. Prerequisites You have Identity Management authentication configured in your Satellite environment. For more information, see Installing Satellite Server in a connected network environment . The host on which you are using Chrome is a client in the Identity Management domain. Procedure Enable the Chrome browser to use Kerberos authentication: Note Instead of allowlisting the whole domain, you can also allowlist a specific Satellite Server. Obtain the Kerberos ticket-granting ticket (TGT): In Chrome, go to the URL of your Satellite Server. You are logged in automatically. Alternatively: In your browser address bar, enter the URL of your Satellite Server. Enter your username and password. 3.8. Configuring a cross-forest trust between Identity Management and Active Directory for Satellite When your Identity Management deployment includes a cross-forest trust with Active Directory (AD), configure host-based access control (HBAC) and the System Security Services Daemon (SSSD) to enable AD users to log in to Satellite. Prerequisites An existing Identity Management server with a cross-forest trust with AD established. For more information, see Red Hat Enterprise Linux 8 Installing trust between IdM and AD . Procedure On your Identity Management server: Enable HBAC: Create an external group and add the AD group to it. Add the new external group to a POSIX group. Use the POSIX group in a HBAC rule. On your Identity Management server and all replicas in your Identity Management topology, configure SSSD to transfer additional attributes of AD users: Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf . For example: Clear the SSSD cache: Stop SSSD: Clear the cache: Start SSSD: Verify the AD attributes value by using the dbus-send command on your Satellite Server and on your Identity Management server. Make sure that both outputs match.

Commands:
id admin
kinit admin
klist
ipa host-add --random satellite-server.example.com -------------------------------------------------- Added host "satellite-server.example.com" -------------------------------------------------- Host name: satellite-server.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: ipa-server.example.com
ipa service-add HTTP/ satellite-server.example.com
satellite-maintain packages install ipa-client
ipa-client-install --password 'W5YpARl=7M.n'
id admin
satellite-installer --foreman-ipa-authentication=true
satellite-installer --foreman-ipa-authentication-api=true --foreman-ipa-authentication=true
satellite-installer --reset-foreman-ipa-authentication-api
satellite-installer --foreman-pam-service=foreman-prod
kinit admin
klist
ipa hbacsvc-add satellite-prod
ipa hbacrule-add allow-satellite-prod
ipa hbacrule-add-service allow-satellite-prod --hbacsvcs=satellite-prod
ipa hbacrule-add-host allow-satellite-prod --hosts= satellite.example.com
ipa hbacrule-add-user allow-satellite-prod --user= ipa-user
ipa hbacrule-find satellite-prod ipa hbactest --user= ipa-user --host= satellite.example.com --service=satellite-prod
ipa hbacrule-disable allow_all
satellite-installer --foreman-pam-service=satellite-prod
:foreman: :use_sessions: true
:foreman: :default_auth_type: 'Negotiate_Auth' :use_sessions: true
kinit Identity_Management_user
hammer auth login negotiate
hammer host list
kinit user Password for user@EXAMPLE.COM:
google-chrome --auth-server-whitelist="*. example.com " --auth-negotiate-delegate-whitelist="*. example.com "
kinit user Password for user@EXAMPLE.COM:
[domain/EXAMPLE.com] krb5_store_password_if_offline = True ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname [nss] user_attributes=+email, +firstname, +lastname [ifp] allowed_uids = ipaapi, root user_attributes=+email, +firstname, +lastname
systemctl stop sssd
sss_cache -E
systemctl start sssd
dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname