19.4. Configuring LDAP and Kerberos for Single Sign-on
19.4. Configuring LDAP and Kerberos for Single Sign-on Single sign-on allows users to log in to the VM Portal or the Administration Portal without re-typing their passwords. Authentication credentials are obtained from the Kerberos server. To configure single sign-on to the Administration Portal and the VM Portal, you need to configure two extensions: ovirt-engine-extension-aaa-misc and ovirt-engine-extension-aaa-ldap ; and two Apache modules: mod_auth_gssapi and mod_session . You can configure single sign-on that does not involve Kerberos, however this is outside the scope of this documentation. Note If single sign-on to the VM Portal is enabled, single sign-on to virtual machines is not possible. With single sign-on to the VM Portal enabled, the VM Portal does not need to accept a password, so you cannot delegate the password to sign in to virtual machines. This example assumes the following: The existing Key Distribution Center (KDC) server uses the MIT version of Kerberos 5. You have administrative rights to the KDC server. The Kerberos client is installed on the Red Hat Virtualization Manager and user machines. The kadmin utility is used to create Kerberos service principals and keytab files. This procedure involves the following components: On the KDC server Create a service principal and a keytab file for the Apache service on the Red Hat Virtualization Manager. On the Red Hat Virtualization Manager Install the authentication and authorization extension packages and the Apache Kerberos authentication module. Configure the extension files. Configuring Kerberos for the Apache Service On the KDC server, use the kadmin utility to create a service principal for the Apache service on the Red Hat Virtualization Manager. The service principal is a reference ID to the KDC for the Apache service. Generate a keytab file for the Apache service. The keytab file stores the shared secret key. Note The engine-backup command includes the file /etc/httpd/http.keytab when backing up and restoring. If you use a different name for the keytab file, make sure you back up and restore it. Copy the keytab file from the KDC server to the Red Hat Virtualization Manager: Configuring Single Sign-on to the VM Portal or Administration Portal On the Red Hat Virtualization Manager, ensure that the ownership and permissions for the keytab are appropriate: Install the authentication extension package, LDAP extension package, and the mod_auth_gssapi and mod_session Apache modules: Copy the SSO configuration template file into the /etc/ovirt-engine directory. Template files are available for Active Directory ( ad-sso ) and other directory types ( simple-sso ). This example uses the simple SSO configuration template. Move ovirt-sso.conf into the Apache configuration directory. Note The engine-backup command includes the file /etc/httpd/conf.d/ovirt-sso.conf when backing up and restoring. If you use a different name for this file, make sure you back up and restore it. Review the authentication method file. You do not need to edit this file, as the realm is automatically fetched from the keytab file. Example 19.5. Example authentication method file Rename the configuration files to match the profile name you want visible to users on the Administration Portal and the VM Portal login pages: Edit the LDAP property configuration file by uncommenting an LDAP server type and updating the domain and passwords fields: Example 19.6. Example profile: LDAP server section To use TLS or SSL protocol to interact with the LDAP server, obtain the root CA certificate for the LDAP server and use it to create a public keystore file. Uncomment the following lines and specify the full path to the public keystore file and the password to access the file. Note For more information on creating a public keystore file, see Section D.2, "Setting Up Encrypted Communication between the Manager and an LDAP Server" . Example 19.7. Example profile: keystore section Review the authentication configuration file. The profile name visible to users on the Administration Portal and the VM Portal login pages is defined by ovirt.engine.aaa.authn.profile.name . The configuration profile location must match the LDAP configuration file location. All fields can be left as default. Example 19.8. Example authentication configuration file Review the authorization configuration file. The configuration profile location must match the LDAP configuration file location. All fields can be left as default. Example 19.9. Example authorization configuration file Review the authentication mapping configuration file. The configuration profile location must match the LDAP configuration file location. The configuration profile extension name must match the ovirt.engine.aaa.authn.mapping.plugin value in the authentication configuration file. All fields can be left as default. Example 19.10. Example authentication mapping configuration file Ensure that the ownership and permissions of the configuration files are appropriate: Restart the Apache service and the ovirt-engine service:
kadmin kadmin> addprinc -randkey HTTP/fqdn-of-rhevm @ REALM.COM kadmin> ktadd -k /tmp/http.keytab HTTP/fqdn-of-rhevm @ REALM.COM kadmin> quit scp /tmp/http.keytab root@ rhevm.example.com :/etc/httpd chown apache /etc/httpd/http.keytab chmod 400 /etc/httpd/http.keytab yum install ovirt-engine-extension-aaa-misc ovirt-engine-extension-aaa-ldap mod_auth_gssapi mod_session cp -r /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple-sso/. /etc/ovirt-engine mv /etc/ovirt-engine/aaa/ovirt-sso.conf /etc/httpd/conf.d vi /etc/httpd/conf.d/ovirt-sso.conf <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/api> <If "req('Authorization') !~ /^(Bearer|Basic)/i"> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*)USD RewriteRule ^(.*)USD - [L,NS,P,E=REMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "Kerberos Login" # Modify to match installation GssapiCredStore keytab:/etc/httpd/http.keytab GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session path=/private;httponly;secure; Require valid-user ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" </If> </LocationMatch> mv /etc/ovirt-engine/aaa/profile1.properties /etc/ovirt-engine/aaa/ example .properties mv /etc/ovirt-engine/extensions.d/profile1-http-authn.properties /etc/ovirt-engine/extensions.d/ example -http-authn.properties mv /etc/ovirt-engine/extensions.d/profile1-http-mapping.properties /etc/ovirt-engine/extensions.d/ example -http-mapping.properties mv /etc/ovirt-engine/extensions.d/profile1-authz.properties /etc/ovirt-engine/extensions.d/ example -authz.properties vi /etc/ovirt-engine/aaa/ example .properties Select one include = <openldap.properties> #include = <389ds.properties> #include = <rhds.properties> #include = <ipa.properties> #include = <iplanet.properties> #include = <rfc2307-389ds.properties> #include = <rfc2307-rhds.properties> #include = <rfc2307-openldap.properties> #include = <rfc2307-edir.properties> #include = <rfc2307-generic.properties> Server # vars.server = ldap1.company.com Search user and its password. # vars.user = uid=search,cn=users,cn=accounts,dc=company,dc=com vars.password = 123456 pool.default.serverset.single.server = USD{global:vars.server} pool.default.auth.simple.bindDN = USD{global:vars.user} pool.default.auth.simple.password = USD{global:vars.password} Create keystore, import certificate chain and uncomment if using ssl/tls. pool.default.ssl.startTLS = true pool.default.ssl.truststore.file = /full/path/to/myrootca.jks pool.default.ssl.truststore.password = password vi /etc/ovirt-engine/extensions.d/ example -http-authn.properties ovirt.engine.extension.name = example -http-authn ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name = example -http ovirt.engine.aaa.authn.authz.plugin = example -authz ovirt.engine.aaa.authn.mapping.plugin = example -http-mapping config.artifact.name = HEADER config.artifact.arg = X-Remote-User vi /etc/ovirt-engine/extensions.d/ example -authz.properties ovirt.engine.extension.name = example -authz ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 = ../aaa/ example .properties vi /etc/ovirt-engine/extensions.d/ example -http-mapping.properties ovirt.engine.extension.name = example -http-mapping ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.misc.mapping.MappingExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Mapping config.mapAuthRecord.type = regex config.mapAuthRecord.regex.mustMatch = true config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))USD config.mapAuthRecord.regex.replacement = USD{user}USD{at}USD{suffix} chown ovirt:ovirt /etc/ovirt-engine/aaa/ example .properties chown ovirt:ovirt /etc/ovirt-engine/extensions.d/ example -http-authn.properties chown ovirt:ovirt /etc/ovirt-engine/extensions.d/ example -http-mapping.properties chown ovirt:ovirt /etc/ovirt-engine/extensions.d/ example -authz.properties chmod 600 /etc/ovirt-engine/aaa/ example .properties chmod 640 /etc/ovirt-engine/extensions.d/ example -http-authn.properties chmod 640 /etc/ovirt-engine/extensions.d/ example -http-mapping.properties chmod 640 /etc/ovirt-engine/extensions.d/ example -authz.properties systemctl restart httpd.service systemctl restart ovirt-engine.service