Red Hat Security: Identity Management and Authentication

Instructions

1. Log in to the idm machine, and request a Kerberos ticket as the admin user with RedHat123^ as the password:

   [student@workstation ~]$ ssh idm
   [student@idm ~]$ kinit admin
   Password for admin@LAB.EXAMPLE.COM: RedHat123^

2. Configure two-factor authentication for the idmuser02 user:

   [student@idm ~]$ ipa user-mod idmuser02 --user-auth-type=otp
   -------------------------
   Modified user "idmuser02"
   -------------------------
     User login: idmuser02
     First name: idmuser02
     Last name: idm
     Home directory: /home/idmuser02
     Login shell: /bin/sh
     Principal name: idmuser02@LAB.EXAMPLE.COM
     Principal alias: idmuser02@LAB.EXAMPLE.COM
     Email address: idmuser02@example.com
     UID: 12400003
     GID: 12400003
     User authentication types: otp
     Account disabled: False
   ...output omitted...

3. On your mobile device, search for and install the FreeOTP Authenticator application.

   If you choose not to install FreeOTP on your mobile devices, an alternative method using any QR code scanner is provided.

4. On the idm machine, create the user-managed software token. Set phone as the description and set idmuser02 as the user:

   [student@idm ~]$ ipa otptoken-add --desc=phone --owner=idmuser02

5. Scan the displayed QR code with FreeOTP to provision the token to the mobile device.

   As an alternative, use a QR code scanner to scan the QR code.

6. On the workstation machine, open the web browser and navigate to https://idm.lab.example.com. If you are automatically logged in to the IdM web UI, log out of the dashboard.

7. In the IdM web UI, log in as the idmuser02 user. For the password, enter the user password followed by a FreeOTP passcode.

   For the first part, enter RedHat123^. For the second part, use FreeOTP to generate a passcode. The two items combined form the one-time password (OTP).

   Click Login. The passcode is only valid for a brief period of time, so if authentication fails, try generating a new passcode.

   Note

   If you used the QR scanner, use the oathtool --base32 --totp command to generate the required passcode. In the URI displayed on your mobile device, find the secret= value and use that string as the argument for the --totp option. Run the following command on the workstation machine:

   [student@workstation ~]$ oathtool --base32 \
     --totp CODE
   350759

   Enter the generated passcode at the end of the password, and then click Login.

8. Log out of the web UI and exit the idm machine:

   [student@idm ~]$ exit
   logout
   Connection to idm closed.