Chapter 3. Configuring Red Hat Single Sign-On

Procedure

1. From the drop-down list in the uppper left corner, select your RH-SSO realm.
2. From the Configure panel, select User Federation.
3. From the Add provider drop-down list in the User Federation panel, select ldap.

4. Provide values for the following parameters. Substitute all site-specific values with values relevant to your environment.

   Property	Value
   Console Display Name	Red Hat IDM
   Edit Mode	READ_ONLY
   Sync Registrations	Off
   Vendor	Red Hat Directory Server
   Username LDAP attribute	uid
   RDN LDAP attribute	uid
   UUID LDAP attribute	ipaUniqueID
   User Object Classes	inetOrgPerson, organizationalPerson
   Connection URL	LDAPS://<_FED_IPA_HOST_>
   Users DN	cn=users,cn=accounts,<_FED_IPA_BASE_DN_>
   Authentication Type	simple
   Bind DN	uid=rhsso,cn=sysaccounts,cn=etc,<_FED_IPA_BASE_DN_>
   Bind Credential	<_FED_IPA_RHSSO_SERVICE_PASSWD_>

5. Use the Test connection and Test authentication buttons to ensure that user federation is working.
6. Click Save to save the new user federation provider.
7. Click the Mappers tab at the top of the Red Hat IdM user federation page you created.
8. Create a mapper to retrieve the user group information. A user’s group membership returns the SAM assertion. Use group membership later to provide authorization in OpenStack.
9. Click Create in the Mappers page.

10. On the Add user federation mapper page, select group-ldap-mapper from the Mapper Type drop-down list, and name it Group Mapper. Provide values for the following parameters. Substitute all site-specific values with values relevant to your environment.

    Property	Value
    LDAP Groups DN	cn=groups,cn=accounts„<_FED_IPA_BASE_DN_>
    Group Name LDAP Attribute	cn
    Group Object Classes	groupOfNames
    Membership LDAP Attribute	member
    Membership Attribute Type	DN
    Mode	READ_ONLY
    User Groups Retrieve Strategy	GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE

11. Click Save.

Procedure

1. In the RH-SSO administration web console, select <_FED_RHSSO_REALM_> from the drop-down list in the upper left corner.
2. Select Clients from the Configure panel.
3. Select the service provider client that keycloak-httpd-client-install configured. You can identify the client with the SAML EntityId.
4. Select the mappers tab from the horizontal list of tabs.
5. In the Mappers panel, select Create or Add Builtin to add a protocol mapper to the client.

Procedure

1. Click the Create button in the Mappers Panel.
2. In the Create Protocol Mapper panel, select Group list from the Mapper tpe drop-down list.
3. Enter Group List as a name in the Name field.

4. Enter groups as the name of the SAML attribute in the Group attribute Name field.

   Note

   This is the name of the attribute as it appears in the SAML assertion. When the keystone mapper searches for names in the Remote section of the mapping declaration, it searches for the SAML attrubute name. When you add an attribute in RH-SSO to be passed in the assertion, specify the SAML attribute name. You define the name in the RH-SSO protocol mapper.

5. In the SAML Attribute NameFormat parameter, select Basic.
6. In the Single Group Attribute toggle box, select On.
7. Click Save.