Chapter 5. Configuring Kerberos SSO for Active Directory users in Satellite If the base system of your Satellite Server is connected directly to Active Directory (AD), you can configure AD as an external authentication source for Satellite. Direct AD integration means that a Linux system is joined directly to the AD domain where the identity is stored. AD users can log in using the following methods: Username and password Kerberos single sign-on Note You can also connect your Satellite deployment to AD in the following ways: By using indirect AD integration. With indirect integration, your Satellite Server is connected to a Identity Management server which is then connected to AD. For more information, see Chapter 3, Configuring Kerberos SSO with Identity Management in Satellite . By attaching the LDAP server of the AD domain as an external authentication source with no single sign-on support. For more information, see Chapter 6, Configuring an LDAP server as an external identity provider for Satellite . For an example configuration, see How to configure Active Directory authentication with TLS on Satellite . 5.1. Configuring the Active Directory authentication source on Satellite Server Enable Active Directory (AD) users to access Satellite by configuring the corresponding authentication provider on your Satellite Server. Prerequisites The base system of your Satellite Server must be joined to an Active Directory (AD) domain. To enable AD users to sign in with Kerberos single sign-on, use the System Security Services Daemon (SSSD) and Samba services to join the base system to the AD domain: Install the following packages on Satellite Server: Specify the required software when joining the AD domain: For more information on direct AD integration, see Connecting RHEL systems directly to AD using Samba Winbind . Procedure Define AD realm configuration in a location where satellite-installer expects it: Create a directory named /etc/ipa/ : Create the /etc/ipa/default.conf file with the following contents to configure the Kerberos realm for the AD domain: Configure the Apache keytab for Kerberos connections: Update the /etc/samba/smb.conf file with the following settings to configure how Samba interacts with AD: Add the Kerberos service principal to the keytab file at /etc/httpd/conf/http.keytab : Configure the System Security Services Daemon (SSSD) to use the AD access control provider to evaluate and enforce Group Policy Object (GPO) access control rules for the foreman PAM service: In the [domain/ ad.example.com ] section of your /etc/sssd/sssd.conf file, configure the ad_gpo_access_control and ad_gpo_map_service options as follows: For more information on GPOs, see the following documents: How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 9) How SSSD interprets GPO access control rules in Integrating RHEL systems directly with Windows Active Directory (RHEL 8) Restart SSSD: Enable the authentication source: Verification To verify that AD users can log in to Satellite by entering their credentials, log in to Satellite web UI at https://satellite.example.com. Enter the user name in the user principal name (UPN) format, for example: ad_user @ AD.EXAMPLE.COM . To verify that AD users can authenticate by using Kerberos single sign-on: Obtain a Kerberos ticket-granting ticket (TGT) on behalf of an AD user: Verify user authentication by using your TGT: Troubleshooting Connecting to the AD LDAP can sometimes fail with an error such as the following appearing in the logs: If you see this error, verify which cipher is used for the connection: If the TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 cipher is used, disable it on either the Satellite Server side or on the AD side. The TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 cipher is known to cause incompatibilities. For more information, see the Red Hat Knowledgebase solution API calls to Red Hat Satellite 6 fail intermittently on LDAP authentication . Additional resources sssd-ad(5) man page on your system For information about configuring Mozilla Firefox for Kerberos, see Configuring Firefox to use Kerberos for single sign-on in Red Hat Enterprise Linux 9 Configuring authentication and authorization in RHEL .

Commands:
satellite-maintain packages install adcli krb5-workstation oddjob-mkhomedir oddjob realmd samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator sssd
realm join AD.EXAMPLE.COM --membership-software=samba --client-software=sssd
mkdir /etc/ipa/
[global] realm = AD.EXAMPLE.COM
[global] workgroup = AD.EXAMPLE realm = AD.EXAMPLE.COM kerberos method = system keytab security = ads
KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U Administrator -s /etc/samba/smb.conf
[domain/ ad.example.com ] ad_gpo_access_control = enforcing ad_gpo_map_service = +foreman
systemctl restart sssd
satellite-installer --foreman-ipa-authentication=true
kinit ad_user @ AD.EXAMPLE.COM
curl -k -u : --negotiate https://satellite.example.com/users/extlogin <html><body>You are being <a href="satellite.example.com/hosts">redirected</a>.</body></html>
Authentication failed with status code: { "error": { "message": "ERF77-7629 [Foreman::LdapException]: Error while connecting to 'server.com' LDAP server at 'ldap.example.com' during authentication ([Net::LDAP::Error]: Connection reset by peer - SSL_connect)" } }
openssl s_client -connect ldap.example.com :636