1. Log in to the appliance console using the user name admin.

2. The summary screen displays:

   External Auth:  not configured

3. Press Enter.
4. Select Configure External Authentication (httpd).
5. Enter the fully qualified host name of the IPA server, for example ipaserver.test.company.com.
6. Enter the IPA server domain, for example test.company.com.
7. Enter the IPA server realm, for example TEST.COMPANY.COM.
8. Enter the IPA server principal, for example admin.
9. Enter the password of the IPA server principal.
10. Enter y to proceed.

1. Log in to the web user interface as an administrative user.
2. Navigate to the settings menu, then Configuration → Settings → Zone → Server → NTP Servers or use the hosting provider of the virtual machine to synchronize the appliance’s time with an NTP server.
3. From the settings menu, select Configuration.
4. Select your server in the Settings accordion.
5. Select the Authentication tab.
6. Select a Session Timeout if required.
7. Select External (httpd) in the Mode list.
8. Select Enable Single Sign-On to allow single sign-on using Kerberos tickets from client machines that authenticate to the same IPA server as the appliance.
9. In the Role Settings area, select Get User Groups from External Authentication (https).
10. Click Save.

1. From the settings menu, select Configuration.
2. Select your server in the Settings accordion.
3. Select the Authentication tab.
4. Select Database in the Mode list.
5. Click Save.

1. Log in to the appliance console using the user name admin.

2. The summary screen displays:

   External Auth:  Id.server.FQDN

3. Press Enter.
4. Select Configure External Authentication (httpd). The currently configured IPA server host name and domain are displayed.
5. Enter y to remove configuration details for the IPA client.

1. Connect to the CloudForms appliance using SSH.

2. Run realm discover to determine what Active Directory realms are available:

   # realm discover example.com
     type: kerberos
     realm-name: EXAMPLE.COM
     domain-name: example.com
     configured: kerberos-member
     server-software: active-directory
     client-software: sssd
     required-package: oddjob
     required-package: oddjob-mkhomedir
     required-package: sssd
     required-package: adcli
     required-package: samba-common
     login-formats: %U@example.com
     login-policy: allow-realm-logins

3. Using the above information for your realm, join the Active Directory realm with a user that has enough permissions to be able to browse the directory:

   # realm join example.com -U user
   Password for user: ******

4. Allow all realm users to log in using realm permit:

   # realm permit --all

5. Edit the /etc/sssd/sssd.conf file with your Active Directory domain details. Refer to the following example for formatting:

   [domain/example.com]
     ad_domain = example.com
     krb5_realm = EXAMPLE.COM
     realmd_tags = manages-system joined-with-samba
     cache_credentials = True
     id_provider = ad
     krb5_store_password_if_offline = True
     default_shell = /bin/bash
     ldap_id_mapping = True
     use_fully_qualified_names = True
     fallback_homedir = /home/%d/%u
     access_provider = ad
    ldap_user_extra_attrs = mail, givenname, sn, displayname, domainname
   
   [sssd]
   domains = example.com
   config_file_version = 2
   services = nss, pam, ifp
   default_domain_suffix = example.com
   
   [nss]
   homedir_substring = /home
   
   [pam]
   default_domain_suffix = example.com
   
   [ifp]
   default_domain_suffix = example.com
   allowed_uids = apache, root
   user_attributes = +mail, +givenname, +sn, +displayname, +domainname

6. Restart and enable the sssd service:

   # systemctl restart sssd
   # systemctl enable sssd

7. Make sure the Kerberos keytab created by realm join above is readable by Apache:

   # chgrp apache /etc/krb5.keytab
   # chmod 640 /etc/krb5.keytab

8. Copy the following httpd configuration files into the correct respective directories with the following commands:

   # TEMPLATE_DIR="/opt/rh/cfme-appliance/TEMPLATE"
   # cp ${TEMPLATE_DIR}/etc/pam.d/httpd-auth /etc/pam.d/httpd-auth
   # cp ${TEMPLATE_DIR}/etc/httpd/conf.d/manageiq-remote-user.conf /etc/httpd/conf.d/
   # cp ${TEMPLATE_DIR}/etc/httpd/conf.d/manageiq-external-auth.conf.erb /etc/httpd/conf.d/manageiq-external-auth.conf

9. Edit the /etc/httpd/conf.d/manageiq-external-auth.conf file to point to the Kerberos domain hosted by your Active Directory domain by adding or editing the lines for KrbAuthRealms, Krb5KeyTab and KrbServiceName for your environment:

   <Location /dashboard/kerberos_authenticate>
     AuthType           Kerberos
     AuthName           "Kerberos Login"
     KrbMethodNegotiate On
     KrbMethodK5Passwd  Off
     KrbAuthRealms      example.com
     Krb5KeyTab         /etc/krb5.keytab
     KrbServiceName     Any
     Require            pam-account httpd-auth
   
     ErrorDocument 401  /proxy_pages/invalid_sso_credentials.js
   </Location>

10. Set the following SELinux booleans:

    # setsebool -P allow_httpd_mod_auth_pam on
    # setsebool -P httpd_dbus_sssd          on

11. Restart and enable the httpd service:

    # systemctl restart httpd
    # systemctl enable httpd

1. Log in to the user interface as an administrative user.
2. Navigate to the settings menu, then Configuration → Authentication.
3. Select a Session Timeout if required.
4. Select External (httpd) as the authentication Mode.
5. Select Enable Single Sign-On to allow single sign-on using Kerberos tickets from client machines that authenticate to the same Active Directory domain as the appliance.
6. In the Role Settings area, select Get User Groups from External Authentication (httpd).
7. Click Save.

1. From the settings menu, select Configuration.
2. Click the Access Control accordion, then click Groups.
3. Click (Configuration), and (Add a new Group) to create a group.
4. In Group Information, select Look Up External Authentication Groups to find a list of groups assigned to a specific user in Active Directory.

5. In User to Look Up, enter the user name for a user in your AD group.

   

6. Click Retrieve to look up details for the user in Active Directory and pull group information for the user. As a result, the AD groups will appear in the LDAP Groups for User drop-down list.

7. From the list in LDAP Groups for User, select the group you want to associate a CloudForms role with; for example, the cloudforms group.

   

8. Select a Role to map to the group.
9. Select a Project/Tenant to map to the group.
10. Click Add.

1. Log in to the appliance user interface as the administrative user.
2. From the settings menu, select Configuration → Authentication.
3. Uncheck Disable Local Login.
4. Click Save.

Re-enabling Local Login from the Appliance Console:

1. Use SSH to log into the appliance as root.
2. Run the appliance_console command.
3. Select Update External Authentication Options.
4. Select Enable Local Login.
5. Apply the updates.