Red Hat Security: Identity Management and Authentication

Instructions

1. Log in to the utility machine and become the root user:

   [student@workstation ~]$ ssh utility
   [student@utility ~]$ sudo -i
   [sudo] password for student: student

2. Log in to the LAB.EXAMPLE.COM Kerberos realm to verify that the utility machine is configured as IdM client.

   1. Verify that the utility machine has access to the realm.

      [root@utility ~]# kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. Log out of the utility machine.

      [root@utility ~]# logout
      [student@utility ~]$ logout
      Connection to utility closed.
      [student@workstation ~]$

3. Navigate to the SSO web console at http://utility.lab.example.com:8080 and configure the ldap realm to use the IdM LDAP server. Log in as the admin user with RedHat123^ as the password.

   1. Navigate to Configure → Realm Settings and verify that the Name field is set to ldap, indicating that you are in the ldap realm.

   2. Navigate to Configure → User Federation, click Add provider, and select ldap from the list.

   3. Use the following values to configure the ldap realm:

      Property	Value
      Enabled	ON
      Console Display Name	ldap
      Priority	0
      Import Users	ON
      Edit Mode	READ_ONLY
      Sync Registrations	OFF
      Vendor	Red Hat Directory Server
      Username LDAP attribute	uid
      RDN LDAP attribute	uid
      UUID LDAP attribute	ipaUniqueID
      User Object Classes	inetOrgPerson, organizationalPerson
      Connection URL	ldaps://idm.lab.example.com:636
      Users DN	cn=users,cn=accounts,dc=lab,dc=example,dc=com
      Search Scope	One Level
      Bind Type	simple
      Bind DN	uid=admin,cn=users,cn=accounts,dc=lab,dc=example,dc=com
      Bind Credential	RedHat123^

   4. Click Save and then click Synchronize all users.

4. Log in to the client machine and start a Kerberos session.

   1. Log in to the client machine as the student user:

      [student@workstation ~]$ ssh client

   2. Start a Kerberos session as the admin user with the RedHat123^ password

      [student@client ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

5. Verify that the idmuser03 exists in IdM:

   [student@client ~]$ ipa user-find idmuser03
   --------------
   1 user matched
   --------------
     User login: idmuser03
   ...output omitted...

6. Verify that SSO uses IdM as identity provider by getting an OpenID Connect token.

   1. Log out of the client machine to return to the workstation machine:

      [student@client ~]$ logout
      Connection to client closed.
      [student@workstation ~]$

   2. On the workstation machine, change to the ~/materials/labs/products-sso/ directory and run the get_token.sh script to get an OpenID Connect token from the SSO server for the idmuser03 in the ldap SSO realm.

      [student@workstation ~]$ cd materials/labs/products-sso
      [student@workstation products-sso]$ ./get_token.sh idmuser03 RedHat123^ ldap
      {"access_token":"eyJhbGciOiJS...
      ...output omitted...

   3. Return to the student user home directory:

      [student@workstation products-sso]$ cd
      [student@workstation ~]$