Red Hat Security: Identity Management and Authentication

Log in to the utility machine and become the root user to configure the SSO server as an IdM client:

[student@workstation ~]$ ssh utility
[student@utility ~]$ sudo -i
[sudo] password for student: student

1. Register the SSO server to the LAB.EXAMPLE.COM realm:

   [root@utility ~]# ipa-client-install --domain lab.example.com \
     --server idm.lab.example.com --realm LAB.EXAMPLE.COM
   This program will set up IPA client.
   Version 4.10.0
   
   ...output omitted...
   Proceed with fixed values and no DNS discovery? [no]: yes
   Do you want to configure chrony with NTP server or pool address? [no]: Enter
   Client hostname: utility.lab.example.com
   Realm: LAB.EXAMPLE.COM
   ...output omitted...
   
   Continue to configure the system with these values? [no]: yes
   ...output omitted...
   
   Time synchronization was successful.
   User authorized to enroll computers: admin
   Password for admin@LAB.EXAMPLE.COM: RedHat123^
   Successfully retrieved CA cert
   ...output omitted...
   
   Client configuration complete.
   The ipa-client-install command was successful

Navigate to the SSO web console at http://utility.lab.example.com:8080 and configure the ldap realm to use the IdM LDAP server. Use the admin user and RedHat123^ as the password to authenticate.

1. Navigate to the SSO web console at http://utility.lab.example.com:8080 and click Administration Console. Use the admin user and RedHat123^ as the password to authenticate.

2. Navigate to Configure → Realm Settings and verify you are in the review realm.

3. Navigate to Configure → User Federation under the Configure section.

   Figure 11.1: User Federation

4. Click Add provider, choose ldap, and add the following configuration settings:

   Setting	Value
   Console Display Name	review
   Priority	0
   Import Users	ON
   Edit Mode	READ_ONLY
   Sync Registrations	Off
   Vendor	Red Hat Directory Server
   Username LDAP attribute	uid
   RDN LDAP attribute	uid
   UUID LDAP attribute	ipaUniqueID
   User Object Classes	inetOrgPerson, organizationalPerson
   Connection URL	ldaps://idm.lab.example.com:636
   Users DN	cn=users,cn=accounts,dc=lab,dc=example,dc=com
   Search Scope	One Level
   Bind Type	simple
   Bind DN	uid=admin,cn=users,cn=accounts,dc=lab,dc=example,dc=com
   Bind Credential	RedHat123^

5. Click Save and then click Synchronize all users.

   The console shows a synchronization success message.

Log in to the client machine and start a Kerberos session.

1. Exit the utility machine and log in to the client machine as the student user:

   [root@utility ~]# exit
   logout
   [student@utility ~]$ exit
   logout
   Connection to utility closed.
   [student@workstation ~]$ ssh client

2. Start a Kerberos session as the idmuser03 user with RedHat123^ as the password:

   [student@client ~]$ kinit idmuser03
   Password for idmuser03@LAB.EXAMPLE.COM: RedHat123^

Verify that SSO uses IdM as an identity provider by obtaining an OpenID Connect token.

1. Exit the client machine:

   [student@client ~]$ exit
   logout
   Connection to client closed.
   [student@workstation ~]$

2. From the workstation machine, use the following curl command to get an OpenID Connect token from the SSO server for the idmuser03 in the review SSO realm:

   [student@workstation ~]$ curl -d 'client_id=admin-cli' -d "username=idmuser03" \
     -d "password=RedHat123^" -d 'grant_type=password' \
     "http://utility:8080/auth/realms/review/protocol/openid-connect/token"
   {"access_token":"eyJhbGciOi
   ...output omitted...