5.2. Using Identity Management for Authentication

Satellite 5 now offers authentication through an IdM or IPA server, which provides support for:
  • Kerberos authentication in the WebUI
  • Users do not need to be pre-created in Satellite database
  • The PAM authentication can be enabled for all users
  • User roles can be derived from user group membership in the external identity provider
  • System Groups administrators can be derived from user group membership in the external identity provider per Organization

Note

IPA authentication configuration only works with Satellite 5's Web UI. Client tools like rhn_register, rhnreg_ks, spacecmd, rhncfg-manager and the Satellite 5 API can not use IPA authentication.

5.2.1. Requirements

Satellite Authentication through IPA has the following requirements:
  • A configured Satellite Server. The following instructions will use the hostname satellite.example.com to denote the Satellite server.
  • A configured IPA/IdM Server on Red Hat Enterprise Linux 6 or 7. The following instructions will use the hostname ipa.example.com to denote the IPA server.
  • Installation of additional packages on the Satellite server. Use the following command to install these packages from the standard Red Hat Enterprise Linux 6 and 7 repositories:
    [root@satellite ~]# yum install ipa-client ipa-admintools sssd sssd-dbus mod_auth_kerb mod_authnz_pam mod_lookup_identity mod_intercept_form_submit -y
    
  • The latest version of the selinux-policy package to ensure the latest SELinux Booleans are added. You can update this package with the following command:
    [root@satellite ~]# yum update selinux-policy -y
    

5.2.2. Enrolling the Satellite Server

Enrol the Satellite server with the IPA server using the ipa-client-install command. This will step through the required configuration options to enrol the Satellite server.
[root@satellite ~]# ipa-client-install
Provide the domain name of your IPA server (ex: example.com): example.com
Provide your IPA server name (ex: ipa.example.com): ipa.example.com
Hostname: satellite.example.com
Realm: EXAMPLE.COM
DNS Domain: example.com
IPA Server: ipa.example.com
BaseDN: dc=example,dc=com

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Password for admin@EXAMPLE.COM: *********
When complete, the Satellite server acts as an client using the IPA Server details.
The IPA server also requires a HTTP Service for the Satellite server. Authenticate the Satellite server against the IPA server with the admin user and run the ipa service-add command:
[root@satellite ~]# kinit admin
[root@satellite ~]# ipa service-add HTTP/satellite.example.com
--------------------------------------------------
Added service "HTTP/satellite.example.com@EXAMPLE.COM"
--------------------------------------------------
  Principal: HTTP/satellite.example.com@EXAMPLE.COM
  Managed by: satellite.example.com

5.2.3. Using the IPA Authentication Setup Tool

Satellite contains a tool called spacewalk-setup-ipa-authentication, which configures your Satellite server to use IPA Authentication. The tool performs the following steps:
  • Configures Kerberos authentication on the Satellite server
  • Configures SSSD services on the Satellite server
  • Configures Satellite webservers to communicate with SSSD and observe PAM authentication
Run the command on the Satellite server to start the configuration:
[root@satellite ~]# spacewalk-setup-ipa-authentication

5.2.4. Finalizing Authentication Configuration

Log in as the Satellite administration user and navigate to AdminUsersExternal Authentication. Set the Default organization to the default organization for new users authenticating through IPA. Click Update to save this option.
Users can now login to Satellite using their IPA credentials.

5.2.5. Configuring IPA to Use Multiple Organizations (Optional)

The IPA server contains a parameter for the Organizational Unit for each user. Satellite can use this value to map to its own Organizations. This adds specific users to Organizations based upon the Organizational Unit value (ou) in the IPA server.
Log in as the Satellite administration user and navigate to AdminUsersExternal Authentication. Enable the Use organization unit name passed from IPA option and click Update.
Satellite now adds users to Organizations based on each user's Organizational Unit in the IPA server. Users with no Organizational Unit are assigned to the default organization.

5.2.6. Configuring IPA to Use Groups (Optional)

The IPA server contains parameters for Groups, which Satellite can map to roles. This provides a method to use role-based permissions for IPA users.
Log in as the Satellite administration user and navigate to AdminUsersExternal AuthenticationGroup Role Mapping. Click the Create new external group link and enter the following details:
  • External Group Name - Enter the name of the group from the IPA server.
  • Administrative Roles and Roles - Select roles to assign to the group. For example, assign the Channel Administrator.
Click Create to complete the group creation.
Satellite now assigns permissions to users based on each user's IPA groups.