13.8. Integrating Satellite with Red Hat Single Sign-On for External Authentication

Procedure

1. Install the following packages:

   # satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install

2. On Satellite Server, install the Red Hat Single Sign-On httpd client:

   # keycloak-httpd-client-install --app-name foreman-openidc \
   --keycloak-server-url "RHSSO.example.com" \
   --keycloak-admin-username "RHSSO_User" \
   --keycloak-realm "RHSSO_Realm" \
   --keycloak-admin-realm master \
   --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force

   The above command registers a client for Satellite in Red Hat Single Sign-On.

3. Enable Red Hat Single Sign-On using satellite-installer:

   # satellite-installer --foreman-keycloak true \
   --foreman-keycloak-app-name  "foreman-openidc" \
   --foreman-keycloak-realm "RHSSO_Realm"

4. Restart the httpd service:

   # systemctl restart httpd

5. In the Red Hat Single Sign-On web UI, navigate to Client and click the Satellite client.
6. Ensure that the Access type setting is set to Confidential.

7. If you use Red Hat Single Sign-On version 7.3 or later, complete the following steps:

   1. Navigate to the Red Hat Single Sign-On web UI, click Clients and click the client registered with Satellite.
   2. Locate the Valid redirect URI field that contains one redirect URI by default. Add a Valid redirect URI in the following form: https://satellite.example.com/users/extlogin.
   3. Click Save.

   4. Click the Mappers tab and click Create. Set the following values for the audience mapper:

      • From the Mapper Type list, select Audience.

      • From the Included Client Audience list, select the client that you use with Satellite.

        For more information about audience support, see Audience Support in the Red Hat Single Sign-On Server Administration Guide.

   5. Click Save.

   6. Click the Mapper tab and click Create to add a group mapper so that you can specify authorization in Satellite based on group membership. Set the following values for the group mapper:

      • From the Mapper Type list, select Group Membership.
      • In Token Claim Name, enter groups.

      • Set the Full group path toggle to OFF.

        For more information about group mappers, see Group Mapper in the LDAP Mappers section of the Red Hat Single Sign-On Server Administration Guide.

   7. Click Save.

   8. Navigate to Groups, and click New.

      • Enter a Name for the group.
      • Click Save.

   9. Navigate to Users and click Add user.

      • Enter the Username, Email, and other user details. Set the User Enabled toggle to ON.
      • Click Save. The user is now created.
      • Click the Credentials tab and reset the user password under Manage Password: Enter New Password and confirm the password, set the Temporary toggle to OFF, and click Reset Password.
      • Click the Groups tab. Select the group you want to join from the Available Groups list, and click Join. The user is now part of the selected group.
8. In the Satellite web UI, navigate to Administer > User Groups.
9. Click Create User Group, and enter a Name for the user group.
10. Click the Roles tab, and assign appropriate roles to the user group.
11. Click the External Groups tab, then click Add external user group.
12. Enter the group name created in the Red Hat Single Sign-On web UI.
13. Click Submit.
14. Navigate to Administer > Settings, and click the Authentication tab.
15. Locate the Authorize login delegation row, and in the Value column, set the value to Yes.
16. Locate the Authorize login delegation auth source user autocreate row, and in the Value column, set the value to External.

17. Locate the Login delegation logout URL row, and in the Value column, set the value to https://satellite.example.com/users/extlogout.

    For the following steps, you can retrieve the values that you require by navigating to the following URL: RHSSO.example.com/auth/realms/RHSSO_REALM/.well-known/openid-configuration.

18. Locate the OIDC Algorithm row, and in the Value column, set the algorithm for encoding on Red Hat Single Sign-On, for example, RS256.
19. Locate the OIDC Audience row, and in the Value column, set the value to the client ID for Red Hat Single Sign-On: ['satellite.example.com-foreman-openidc'].
20. Locate the OIDC Issuer row, and in the Value column, set the value to RHSSO.example.com/auth/realms/RHSSO_Realm.
21. Locate the OIDC JWKs URL row, and in the Value column, set the value to RHSSO.example.com/auth/realms/RHSSO_Realm/protocol/openid-connect/certs.

22. To set the organization and location for the authentication source, complete the following steps:

    1. Navigate to Administer > Authentication sources.
    2. Click the options menu next to External, and click Edit.
    3. Click the Locations tab and select locations from the All items list.
    4. Click the Organizations tab and select organizations from the All items list.
    5. Click Submit.

For CLI Users

1. Install the following packages:

   # satellite-maintain packages install keycloak-httpd-client-install

2. On Satellite Server, install the Red Hat Single Sign-On httpd client:

   # keycloak-httpd-client-install --app-name hammer-openidc \
   --keycloak-server-url "RHSSO.example.com" \
   --keycloak-admin-username "RHSSO_User" \
   --keycloak-realm "RHSSO_Realm" \
   --keycloak-admin-realm master \
   --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force

   This command creates a client for Satellite in Red Hat Single Sign-On.

3. Enable Red Hat Single Sign-On using satellite-installer:

   # satellite-installer --foreman-keycloak true \
   --foreman-keycloak-app-name  "hammer-openidc" \
   --foreman-keycloak-realm "RHSSO_Realm"

4. Restart the httpd service:

   # systemctl restart httpd

5. In the Red Hat Single Sign-On web UI, navigate to Client and click the Satellite client.
6. Set the Access type setting to Public.
7. In the Valid Redirect URL field, enter urn:ietf:wg:oauth:2.0:oob.

8. If you use Red Hat Single Sign-On version 7.3 or later, complete the following steps:

   1. Navigate to the Red Hat Single Sign-On web UI, click Clients and click the client registered with Satellite.
   2. Locate the Valid redirect URI field that contains one redirect URI by default. Add a Valid redirect URI in the following form: https://satellite.example.com/users/extlogin.
   3. Click Save.

   4. Click the Mappers tab and click Create. Set the following values for the audience mapper:

      • From the Mapper Type list, select Audience.

      • From the Included Client Audience list, select the client that you use with Satellite.

        For more information about audience support, see Audience Support in the Red Hat Single Sign-On Server Administration Guide.

   5. Click Save.

   6. Click the Mapper tab and click Create to add a group mapper so that you can specify authorization in Satellite based on group membership. Set the following values for the group mapper:

      • From the Mapper Type list, select Group Membership.
      • From the Token Claim Name list, select groups.

      • Set the Full group path toggle to OFF.

        For more information about group mappers, see Group Mapper in the LDAP Mappers section of the Red Hat Single Sign-On Server Administration Guide.

   7. Click Save.

9. On Satellite, set the login delegation to true so that users can authenticate using the Open IDC protocol:

   # hammer settings set --name authorize_login_delegation --value true

10. Set the login authorization to an external source:

    # hammer settings set --name authorize_login_delegation_auth_source_user_autocreate --value External

11. Set the login delegation logout URL:

    # hammer settings set --name login_delegation_logout_url \
    --value https://satellite.example.com/users/extlogout

12. Set the algorithm for encoding on Red Hat Single Sign-On, for example, RS256:

    # hammer settings set --name oidc_algorithm --value 'RS256'

13. Open the RHSSO.example.com/auth/realms/RHSSO_REALM/.well-known/openid-configuration URL and note the values to populate the options in the following steps.

14. Add the value for the Hammer client in the Open IDC audience:

    # hammer settings set --name oidc_audience \
    --value "['satellite.example.com-hammer-openidc']"

    注記

    If you register several Red Hat Single Sign-On clients to Satellite, ensure that you append all audiences in the array. For example:

    # hammer settings set --name oidc_audience \
    --value "['satellite.example.com-foreman-openidc', 'satellite.example.com-hammer-openidc']"

15. Set the value for the Open IDC issuer:

    # hammer settings set --name oidc_issuer \
    --value "RHSSO.example.com/auth/realms/RHSSO_Realm"

16. Set the value for Open IDC Java Web Token (JWT):

    # hammer settings set --name oidc_jwks_url \
    --value "RHSSO.example.com/auth/realms/RHSSO_Realm/protocol/openid-connect/certs"

17. To set the organization and location of the authentication source, complete the following steps:

    1. Retrieve the ID of the Red Hat Single Sign-On authentication source:

       # hammer auth-source external list

    2. Set the location and organization:

       # hammer auth-source external update --id Authentication Source ID \
       --location-ids Location ID --organization-ids Organization ID

18. To authenticate using two-factor authentication, enter the following command:

    # hammer auth login oauth \
    --two-factor \
    --oidc-token-endpoint 'https://RHSSO.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
    --oidc-authorization-endpoint 'https://RHSSO.example.com/auth' \
    --oidc-client-id 'satellite.example.com-foreman-openidc' \
    --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

    The command prompts you to enter a success code. To retrieve the success code, navigate to the URL that the commands returns and provide the required information.