Red Hat Training

A Red Hat training course is available for RHEL 8

106.4. 启用 IdM 用户通过外部 IdP 进行身份验证

要启用 IdM 用户通过外部身份提供程序(IdP)，将之前创建的外部 IdP 引用与用户帐户关联。这个示例将外部 IdP 参考 keycloak-server1 与用户 external-idp-user 关联。

先决条件

流程

  • 修改 IdM 用户条目，将 IdP 引用与用户帐户关联： 

    [root@server ~]# ipa user-mod external-idp-user \
               --idp my-keycloak-idp \
               --idp-user-id external-idp-user@idm.example.com \
               --user-auth-type=idp
---------------------------------
Modified user "external-idp-user"
---------------------------------
  User login: external-idp-user
  First name: Test
  Last name: User1
  Home directory: /home/external-idp-user
  Login shell: /bin/sh
  Principal name: external-idp-user@idm.example.com
  Principal alias: external-idp-user@idm.example.com
  Email address: external-idp-user@idm.example.com
  UID: 35000003
  GID: 35000003
  User authentication types: idp
  External IdP configuration: keycloak
  External IdP user identifier: external-idp-user@idm.example.com
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False

验证

  • 验证该用户的 ipa user-show 命令的输出是否显示对 IdP 的引用： 

    [root@server ~]# ipa user-show external-idp-user
  User login: external-idp-user
  First name: Test
  Last name: User1
  Home directory: /home/external-idp-user
  Login shell: /bin/sh
  Principal name: external-idp-user@idm.example.com
  Principal alias: external-idp-user@idm.example.com
  Email address: external-idp-user@idm.example.com
  ID: 35000003
  GID: 35000003
  User authentication types: idp
  External IdP configuration: keycloak
  External IdP user identifier: external-idp-user@idm.example.com
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False