Chapter 4. Configuring SSO and 2FA with Red Hat Single Sign-On in Satellite
Chapter 4. Configuring SSO and 2FA with Red Hat Single Sign-On in Satellite Red Hat Single Sign-On is an open-source identity and access management solution that provides authentication features, such as single sign-on functionality, user federation, and centralized authentication management. With Red Hat Single Sign-On, you can integrate Satellite Server with your existing Red Hat Single Sign-On server to delegate user authentication and authorization to Red Hat Single Sign-On. Red Hat Single Sign-On users can log in using the following login methods: User name and password in Satellite web UI and Hammer CLI Time-based one-time password (TOTP) For information about Red Hat Single Sign-On, see Red Hat Single Sign-On documentation . 4.1. Prerequisites for configuring Satellite with Red Hat Single Sign-On authentication A Red Hat Single Sign-On account with administrative privileges. A Red Hat Single Sign-On server that uses HTTPS instead of HTTP. If the certificates or the CA are self-signed, ensure that they are added to the end-user certificate truststore. A Red Hat Single Sign-On realm created for Satellite user accounts, for example Satellite_Realm . Users imported or added to Red Hat Single Sign-On. For more information about importing or creating users, see the Red Hat Single Sign-On Server Administration Guide . 4.2. Registering Satellite as a client of Red Hat Single Sign-On Users defined in Red Hat Single Sign-On can authenticate to Satellite by using the Satellite web UI or by using Hammer CLI. Each authentication method requires you to register a separate Satellite client to Red Hat Single Sign-On. If you want users to authenticate by using both Satellite web UI and Hammer CLI, you must register two different Satellite clients to Red Hat Single Sign-On. Procedure On your Satellite Server: Install the packages required for registering a Red Hat Single Sign-On client: Choose the authentication method you want Red Hat Single Sign-On users to use when authenticating to Satellite: If you want users to authenticate by using the Satellite web UI: Create a client for Satellite. Use foreman-openidc as the application name. Configure Satellite to use Red Hat Single Sign-On as an authentication source for Satellite web UI: If you want users to authenticate by using the Hammer CLI: Create a client for Satellite. Use hammer-openidc as the application name. Configure Satellite to use Red Hat Single Sign-On as an authentication source for Hammer CLI: Reset Red Hat Single Sign-On support to the default value to ensure that users are not authenticated also in Satellite web UI: Restart the httpd service: 4.3. Configuring the Satellite client in Red Hat Single Sign-On Configure the Satellite client in Red Hat Single Sign-On with valid redirect URIs and mappers. Procedure In the Red Hat Single Sign-On web UI: Go to the realm created for Satellite users. Navigate to Clients and click the Satellite client. Configure access type: If you are configuring a client that will provide Satellite web UI authentication, select confidential from the Access Type list. If you are configuring a client that will provide Hammer CLI authentication, select public from the Access Type list. Configure Valid redirect URI addresses: If you are configuring a client that will provide Satellite web UI authentication: You will see a pre-defined URI: https:// satellite.example.com /users/extlogin/redirect_uri . Do not change or remove this URI. Add another URI below the pre-defined URI: https:// satellite.example.com /users/extlogin If you are configuring a client that will provide Hammer CLI authentication: You will see a pre-defined URI: https:// satellite.example.com /users/extlogin/redirect_uri . Do not change or remove this URI. Add another URI below the pre-defined URI: urn:ietf:wg:oauth:2.0:oob Click Save . On the Mappers tab, click Create to add an audience mapper. From the Mapper Type list, select Audience . From the Included Client Audience list, select the Satellite client. Click Save . On the Mappers tab, click Create to add a group mapper so that you can specify authorization in Satellite based on group membership. From the Mapper Type list, select Group Membership . In the Token Claim Name field, enter groups . Set the Full group path setting to OFF . Click Save . Additional resources For more information about configuring Red Hat Single Sign-On clients, see Red Hat Single Sign-On Server Administration Guide . 4.4. Configuring a Satellite client to provide Satellite web UI authentication with Red Hat Single Sign-On If you are configuring a client that will provide Satellite web UI authentication to your Satellite deployment, delegate authentication to the Red Hat Single Sign-On server and add Red Hat Single Sign-On as an external authentication source in Satellite. Prerequisites Ensure that the Access Type setting in the Satellite client in the Red Hat Single Sign-On web UI is set to confidential . For more information, see Section 4.3, "Configuring the Satellite client in Red Hat Single Sign-On" . Procedure In the Satellite web UI: Navigate to Administer > Settings . On the Authentication tab, configure the following settings: Authorize login delegation : Set to Yes . Authorize login delegation auth source user autocreate : Set to External . Login delegation logout URL : Set to https:// satellite.example.com /users/extlogout . OIDC Algorithm : For example, set to RS256 . OIDC Audience : Set to the client ID for Red Hat Single Sign-On. OIDC Issuer : Set to https:// rhsso.example.com /auth/realms/ Satellite_Realm . OIDC JWKs URL : Set to https:// rhsso.example.com /auth/realms/ Satellite_Realm /protocol/openid-connect/certs . Navigate to Administer > Authentication Sources . From the External menu, select Edit . On the Locations tab, add the locations that you want to be able to use the Red Hat Single Sign-On authentication source. On the Organizations tab, add the organizations that you want to be able to use the Red Hat Single Sign-On authentication source. Click Submit . 4.5. Configuring a Satellite client to provide Hammer CLI authentication with Red Hat Single Sign-On If you are configuring a client that will provide Hammer CLI authentication to your Satellite deployment, delegate authentication to the Red Hat Single Sign-On server and add Red Hat Single Sign-On as an external authentication source in Satellite. Prerequisites Ensure that the Access Type setting in the Satellite client in the Red Hat Single Sign-On web UI is set to public . For more information, see Section 4.3, "Configuring the Satellite client in Red Hat Single Sign-On" . Obtain the values to configure Satellite settings from the following URL: https:// rhsso.example.com /auth/realms/ Satellite_Realm /.well-known/openid-configuration . Replace Satellite_Realm with the name of the Red Hat Single Sign-On realm created for your Satellite server. Procedure On the Satellite client registered to Red Hat Single Sign-On: Set the login delegation to true so that users can authenticate using the Open IDC protocol: Set the login delegation logout URL: Set the algorithm for encoding: For example, to use the RS256 algorithm: Add the value for the Hammer client in the Open IDC audience: Note If you register several Red Hat Single Sign-On clients to Satellite, ensure that you append all audiences in the array. For example: Set the value for the Open IDC issuer: Set the value for Open IDC Java Web Token (JWT): Retrieve the ID of the Red Hat Single Sign-On authentication source: Set the location and organization: 4.6. Configuring Satellite with Red Hat Single Sign-On for TOTP authentication If you want users to authenticate with time-based one-time passwords (TOTP), configure an OTP policy for the Satellite realm in Red Hat Single Sign-On. Procedure In the Red Hat Single Sign-On web UI, navigate to the Satellite realm. Navigate to Authentication . On the Policies tab, click the OTP Policy tab. Ensure that the Supported Applications field includes FreeOTP or Google Authenticator. Configure the OTP settings to suit your requirements. On Required Actions tab, enable the Set as default action setting for the Configure OTP action. Additional resources For more information, see Red Hat Single Sign-On Server Administration Guide or Red Hat build of Keycloak Server Administration Guide . 4.7. Optional: Configuring external group mapping for Red Hat Single Sign-On authentication To implement the role-based access control (RBAC), create a group in Satellite, assign a role to this group, and then map an Red Hat Single Sign-On group to the Satellite group. As a result, anyone in the given group in Red Hat Single Sign-On will log in under the corresponding Satellite group. For example, you can configure users of the Satellite-admin user group defined in Active Directory to authenticate as users with administrator privileges on Satellite. If you do not configure group mapping, every user will receive the Default role permissions. Procedure In the Satellite web UI, navigate to Administer > User Groups . Click Create User Group . In the Name field, enter a name for the user group. Enter a name that is different from the Active Directory user group name. Do not add any users or user groups to the new group in Satellite web UI. On the Roles tab, select Administer . On the External Groups tab, click Add external user group . In the Name field, enter the name of the Active Directory group. From the Auth Source drop-down menu, select EXTERNAL . Click Submit . 4.8. Logging in to Satellite configured with Red Hat Single Sign-On as an authentication source With Red Hat Single Sign-On configured as an external authentication source for Satellite, users defined in a Red Hat Single Sign-On realm can log in to Satellite Server. The particular login methods available to users depend on how you configured integration between Red Hat Single Sign-On and Satellite. Procedure To authenticate to the Satellite web UI: In your browser, go to https:// satellite.example.com and enter your credentials. To authenticate to the Satellite web UI by using Red Hat Single Sign-On TOTP: In your browser, log in to Satellite. Satellite redirects you to the Red Hat Single Sign-On login screen. Enter your username and password, and click Log In . On your first login attempt, Red Hat Single Sign-On requests you to configure your client by scanning the bar code and entering your PIN. Once authenticated, your browser redirects you back to Satellite and logs you in. To authenticate to the Satellite CLI with Hammer: Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml : Initiate an authentication session with hammer auth login oauth : To authenticate to the Satellite CLI with Hammer by using Red Hat Single Sign-On TOTP: Ensure that Hammer is configured to enforce session usage in ~/.hammer/cli.modules.d/foreman.yml : Initiate an authentication session by using --two-factor with hammer auth login oauth : You will be prompted to enter a success code. To retrieve the success code, navigate to the URL that the command returns. Enter the success code in CLI.
satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml keycloak-httpd-client-install --app-name foreman-openidc --keycloak-server-url "https:// rhsso.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "foreman-openidc" --foreman-keycloak-realm " Satellite_Realm " keycloak-httpd-client-install --app-name hammer-openidc --keycloak-server-url "https:// rhsso.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "hammer-openidc" --foreman-keycloak-realm " Satellite_Realm " satellite-installer --reset-foreman-keycloak systemctl restart httpd hammer settings set --name authorize_login_delegation --value true hammer settings set --name login_delegation_logout_url --value https:// satellite.example.com /users/extlogout hammer settings set --name oidc_algorithm --value 'RS256' hammer settings set --name oidc_audience --value "[' satellite.example.com -hammer-openidc']" hammer settings set --name oidc_audience --value "[' satellite.example.com -foreman-openidc', ' satellite.example.com -hammer-openidc']" hammer settings set --name oidc_issuer --value "https:// rhsso.example.com /auth/realms/ KEYCLOAK_REALM " hammer settings set --name oidc_jwks_url --value "https:// rhsso.example.com /auth/realms/ KEYCLOAK_REALM /protocol/openid-connect/certs" hammer auth-source external list hammer auth-source external update --id My_Authentication_Source_ID --location-ids My_Location_ID --organization-ids My_Organization_ID :foreman: :use_sessions: true hammer auth login oauth --oidc-token-endpoint 'https:// rhsso.example.com /auth/realms/ Satellite_realm /protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// rhsso.example.com /auth' --oidc-client-id ' satellite.example.com -hammer-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob :foreman: :use_sessions: true hammer auth login oauth --two-factor --oidc-token-endpoint 'https:// rhsso.example.com /auth/realms/ Satellite_realm /protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// rhsso.example.com /auth' --oidc-client-id ' satellite.example.com -hammer-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob