Red Hat Security: Identity Management and Authentication

To configure Identity Management as an external authentication method, the Satellite server must be an IdM client.

Install the ipa-client package on the Satellite server and configure it as an IdM client. Ensure that the Satellite server can resolve IdM DNS services and records:

[root@host ~]# satellite-maintain packages install ipa-client
...output omitted...
[root@host ~]# ipa-client-install
...output omitted...

Use the satellite-installer command to configure IdM as an authentication provider. You can enable authentication for the Satellite web UI and the API independently. The Satellite services must be restarted after configuring IdM as an authentication provider.

[root@host ~]# satellite-installer \
  --foreman-ipa-authentication=true \
  --foreman-ipa-authentication-api=true
[root@host ~]# satellite-maintain service restart

When the configuration of Satellite server for external authentication with IdM is complete, IdM users can log in to the Satellite server using their IdM credentials. If single sign-on is configured in IdM, users can also obtain a ticket on their client machine and then log in to the Satellite server automatically. If an IdM user is configured to use two-factor authentication with a one-time password, then that user can also authenticate to the Satellite server with a one-time password.

Use the foreman-prepare-realm command to enable the realm feature on a Satellite server. The following example uses the IdM admin user account to authenticate to IdM, and creates the realm-capsule realm proxy user. Upon execution, IdM creates a role with the permissions needed by the Satellite server for integration and assigns this role to the realm-capsule user.

[root@host ~]# foreman-prepare-realm admin realm-capsule

Satellite retrieves an IdM keytab and stores it in the /root/freeipa.keytab directory on the Satellite server. You must move the keytab to the /etc/foreman-proxy directory and set the ownership of the file to the foreman-proxy user and group. Copy the keytab file to all Satellite and Capsule servers that you want to configure for authentication:

[root@host ~]# mv /root/freeipa.keytab /etc/foreman-proxy
[root@host ~]# chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

Use the satellite-installer command with the following options to configure a Satellite server for the provisioning of hosts configured to use IdM for external authentication.

[root@host ~]# satellite-installer \
  --foreman-proxy-realm true
  --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
  --foreman-proxy-realm-principal 'realm-capsule@LAB.EXAMPLE.COM' \
  --foreman-proxy-realm-provider freeipa

Ensure that the IdM CA certificates are installed and restart the foreman-proxy service. Also ensure that the principal is correctly defined in the /etc/foreman-proxy/settings.d/realm_freeipa.yml file:

[root@host ~]# cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
[root@host ~]# update-ca-trust enable
[root@host ~]# update-ca-trust
[root@host ~]# systemctl restart foreman-proxy

To create a Satellite realm, navigate to Infrastructure → Realms and complete the required information. To associate host groups with the new realm, navigate to Configure → Host Groups, select the host group and click Network. Select the realm and click Submit.

In Satellite server, host groups provide a means of grouping hosts into logical units. Hosts placed in a host group inherit that group's configurations for software, network, operating system, and subscription profiles.

Likewise, IdM also uses host groups to group systems into logical units. When integrating hosts provisioned by Satellite server into an organization's IdM realm, you might want to enroll the host into an IdM host group based on its Satellite host group membership.

You can automate these host enrollments by creating automember rules within IdM. The userclass attribute identifies the Satellite host group that a host belongs to. Therefore, to enroll provisioned hosts into IdM host groups based on their Satellite host group membership, you can create an automember rule based on the value of the userclass attribute.

For example, you can create the production_servers IdM host group to enroll hosts provisioned from the Prod Satellite host group. Create the add_production_servers automember rule as well. Use the --type=hostgroup option to specify that the rule is for host group enrollment:

[user@host ~]$ ipa hostgroup-add production_servers
[user@host ~]$ ipa automember-add --type=hostgroup add_production_servers

Then, create the condition to act as a trigger for the new automember rule. This condition defines the criteria for triggering the rule and the action to be taken.

The --key=userclass option specifies that the condition evaluates the host's userclass attribute, which contains its Satellite host group name. Use the --inclusive-regex='^Prod$' to define the regular expression to use when evaluating the userclass attribute, including only Satellite-provisioned hosts belonging to the Satellite Prod host group:

[user@host ~]$ ipa automember-add-condition \
  --type=hostgroup production_servers \
  --key=userclass \
  --inclusive-regex='^Prod$'

With realm configuration and automember rules in place, Satellite server automatically integrates systems into an organization's IdM realm during their provisioning. During host provisioning, the integration of Satellite server and IdM causes the following actions to automatically take place:

After the provisioning of the new host completes, it is reachable on the network by DNS resolution. It is also a member of the IdM realm, so it can authenticate using the IdM server without any further manual configuration. Due to its automatic enrollment into an IdM host group, it is available for management using IdM features, such as host-based access controls and Sudo policies.