Bug 1847205

Summary:	[RFE] Allow accounts stored in Azure AD access Linux systems joined into and managed by IdM.
Product:	Red Hat Enterprise Linux 8	Reporter:	Paul Gozart <pgozart>
Component:	ipa	Assignee:	Florence Blanc-Renaud <frenaud>
Status:	CLOSED MIGRATED	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.1	CC:	abokovoy, pasik, rcritten, tscherf
Target Milestone:	rc	Keywords:	FutureFeature, MigratedToJIRA, Triaged
Target Release:	8.0
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-09-18 18:43:15 UTC	Type:	Story
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Paul Gozart 2020-06-15 22:34:29 UTC

Description of RFE:

After having a customer call with Dmitri from the IdM BU, he asked that I create this RFE on behalf of the customer.

Allow accounts stored in Azure AD access Linux systems joined into and managed by IdM.  Allow sudo, hbac and SSH key management for those accounts.

Large TAM customer currently has about 5,000 RHEL systems on-prem and about 3,000 RHEL systems in Azure with management asking for a larger RHEL-in-Azure footprint.  This RFE will allow the customer to continue adding RHEL subs as their focus continues to shift towards Azure.

Comment 3 Mike Murphy 2021-11-17 15:33:26 UTC

from customer: Are there any efforts on supporting multifactor logins with users who have a microsoft authenticator token for example that could integrate into IDM ? This is the current configuration we have today for multi-factor authentication for a large chunk of users. Would this type of multifactor authentication be supported in our current configuration given we are reliant on an AD trust ?

Comment 4 Alexander Bokovoy 2021-11-17 15:40:53 UTC

It is impossible to answer these questions without knowing specific details of the implementation in use.

A generic answer is that with Kerberos, the source of truth is the KDC that stores information about the user. In case of Active Directory, those are Active Directory domain controllers, not IdM servers. As far as I know, Active Directory has no support for multifactor authentication on Kerberos level. Instead, they have it all integrated on the Windows operating system level and use a different protocol to authenticate the user on Windows desktop and then obtain a Kerberos ticket based on that. This method is not supported and will unlikely be supported as it is all proprietary.

Once a Kerberos ticket granting ticket is obtained on Windows machine, it can be used to authenticate to RHEL IdM-enrolled machines over trust to Active Directory with the help of PuTTY or similar applications.

Comment 9 RHEL Program Management 2023-09-18 18:38:15 UTC

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

Comment 10 RHEL Program Management 2023-09-18 18:43:15 UTC

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.