Red Hat Training

A Red Hat training course is available for Red Hat OpenStack Platform

Chapter 2. Configure Red Hat Identity Management

In this example, IdM is situated externally to the OpenStack Red Hat OpenStack Platform director deployment and is the source of all user and group information. RH-SSO will be configured to use IdM as its User Federation, and will then perform LDAP searches against IdM to obtain user and group information.

2.1. Create the IdM Service Account for RH-SSO

Although IdM allows anonymous binds, some information is withheld for security reasons. Some of this information withheld during anonymous binds is essential for RH-SSO user federation; consequently, RH-SSO will need to bind to the IdM LDAP server with enough privileges to successfully query the required information. As a result, you will need to create a dedicated service account for RH-SSO in IdM. IdM does not natively provide a command to do this, but you can use the ldapmodify command. For example: 

ldap_url="ldaps://$FED_IPA_HOST"
dir_mgr_dn="cn=Directory Manager"
service_name="rhsso"
service_dn="uid=$service_name,cn=sysaccounts,cn=etc,$FED_IPA_BASE_DN"

$ ldapmodify -H "$ldap_url" -x -D "$dir_mgr_dn" -w "$FED_IPA_ADMIN_PASSWD" <<EOF
dn: $service_dn
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: $service_name
userPassword: $FED_IPA_RHSSO_SERVICE_PASSWD
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0

EOF
Note

You can use the configure-federation script to perform the above step: 

$ ./configure-federation create-ipa-service-account

2.2. Create a test user

You will also need a test user account in IdM. You can either use an existing user or create a new one; the examples in this guide use "John Doe" with a uid of jdoe. You can create the jdoe user in IdM: 

$ ipa user-add --first John --last Doe --email jdoe@example.com jdoe

Assign a password to the user: 

$ ipa passwd jdoe

2.3. Create an IdM group for OpenStack Users

Create the openstack-users group in IdM.

  1. Make sure the openstack-users group does not already exist: 

    $ ipa group-show openstack-users
ipa: ERROR: openstack-users: group not found

  2. Add the openstack-users group to IdM: 

    $ ipa group-add openstack-users

  3. Add the test user to the openstack-users group: 

    $ ipa group-add-member --users jdoe openstack-users

  4. Verify that the openstack-users group exists and has the test user as a member: 

    $ ipa group-show openstack-users
  Group name: openstack-users
  GID: 331400001
  Member users: jdoe