Goal	Integrate an Identity Management deployment with Red Hat's single sign-on technology, Red Hat Satellite, and Red Hat Ansible Automation Platform.
Objectives	Configure Red Hat's single sign-on technology to get information from the IdM service and use it for authentication. Integrate Red Hat Satellite with an Identity Management server and enable host-based access control. Configure IdM as a source for account authentication information for automation controller users.
Sections	Implementing Single Sign-on (and Guided Exercise) Integrating IdM with Red Hat Satellite (and Guided Exercise) Configuring Automation Controller with IdM Authentication (and Guided Exercise)
Lab	Integrating Identity Management with Red Hat Utilities

Implementing Single Sign-on

Objectives

Configure Red Hat's single sign-on technology to get information from the IdM service and use it for authentication.

Single Sign-on

Red Hat's single sign-on (SSO) technology enables applications to authenticate users from a federated identity manager. It can act as an integration platform to provide user authentication from existing LDAP or Active Directory servers, and you can use it to delegate authentication to third-party identity providers such as Google, GitHub, or other social networks.

Red Hat's single sign-on technology supports the OpenID Connect, OAuth 2.0, and Security Assertion Markup Language (SAML) protocols.

Benefits of SSO

The following list describes some relevant benefits of SSO:

Identity federation: SSO enables users to access distinct web, mobile, and desktop applications using a single set of credentials.
Improved network security: Users authenticate once to the SSO server instead of once for each application.
Centralized accounts: User accounts are stored in one system, rather than having a distinct user database for each application.
Simplified maintenance: Administrators manage one database or a small set of databases instead of one for each application.
Better user experience: Users enter their passwords only once to access multiple applications.

Single Sign-on for Red Hat Solutions

Red Hat's single sign-on technology is implemented using a separate server that you manage on your network. You use the web UI to configure this server to use identity management sources. You configure applications to use the server as a federated identity provider by pointing them at the server, and they communicate using open protocol standards such as OpenID Connect or SAML 2.0.

For example, you could configure a web application such as the automation controller component of Red Hat Ansible Automation Platform to authenticate its users by communicating with your SSO server, which is acting as an identity provider. The SSO server could itself be configured to authenticate those users by getting information stored on your IdM server.

Installing Red Hat's Single Sign-on

To install the server for Red Hat's single sign-on technology on a Red Hat Enterprise Linux 9 system, first you must enable the rh-sso-7.6-for-rhel-9-x86_64-rpms RPM repository. Next, install Java Runtime Environment version 1.8.0, which is provided in the java-1.8.0-openjdk-headless package, and the rh-sso7 package group.

The server must allow network traffic through its firewall to the following TCP ports:

8080
9990
443

Lastly, enable and start the rh-sso7 service.

Integrating IdM and Red Hat's Single Sign-on

Most organizations already have a user identity store such as Microsoft Active Directory or Identity Management. Rather than creating and managing user identities in SSO, you can integrate with the existing identity store.

To integrate SSO with IdM, the SSO server must be registered to the IdM realm as a client. You must then configure user federation to use IdM as an LDAP identity store.

Configuring the SSO Server as an IdM Client

Use the following procedure to configure the SSO server as an IdM client.

[user@host ~]$ ipa-client-install --domain example.com \
  --server idm.example.com --realm EXAMPLE.COM
...output omitted...

From the SSO web console, navigate to Configure → Realm Settings and verify you are in the desired realm.

Navigate to Configure → User Federation, click Add provider, and then select ldap from the list.

Figure 9.1: User Federation

Use the following values to configure IdM as the LDAP provider:

Property	Value
Enabled	`ON`
Console Display Name	`ldap`
Priority	0
Import Users	`ON`
Edit Mode	`READ_ONLY`
Sync Registrations	`OFF`
Vendor	`Red Hat Directory Server`
Username LDAP attribute	`uid`
RDN LDAP attribute	`uid`
UUID LDAP attribute	`ipaUniqueID`
User Object Classes	`inetOrgPerson`, `organizationalPerson`
Connection URL	`ldaps://idm.example.com:636`
Users DN	`cn=users,cn=accounts,dc=example,dc=com`
Search Scope	`One Level`
Bind Type	`simple`
Bind DN	`uid=admin,cn=users,cn=accounts,dc=example,dc=com`
Bind Credential	`some_password`

Click Save and then click Synchronize all users.

After synchronization, SSO can use the IdM LDAP user database for authenticating users to applications.

References

Integrating Identity Management with Single Sign-on for Red Hat Solutions

For more information about single sign-on user federation using LDAP, refer to the Lightweight Directory Access Protocol (LDAP) and Active Directory section of the Using External Storage chapter of the Red Hat single sign-on Server Administration Guide at Server Administration Guide

Discuss Red Hat Security: Identity Management and Authentication

Go to community

Welcome to the Red Hat Security: Identity Management and Active Directory Integration group!

Syed

26 wrz 2023

We are excited to launch a space dedicated to the Red Hat Training course Red Hat Security: Identity Management and Active Directory Integration! To gain the most value from this group - click the "Join Group" button in the upper right hand corner of the group home page.We encourage group members to collaborate in this group to discuss topics, ask questions, share best practices and tips, provide course feedback, and share their accomplishments as it relates to RH362.Read more about Red Hat Security: Identity Management and Active Directory Integration here.

215

Revision: rh362-9.1-4c6fdb8