Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
We need documentation related to configuring External Authentication via Idm(Identity Mnagement) using katello-installer.
I think this can go into the below section of Sat6 Docs:
Logging into RedHat Satellite:
--------------------------
We can have a sub-section related to "External Authentication" under the above Logging into RedHAt Satellite" Section , as per this upstream link http://www.theforeman.org/manuals/1.5/index.html#5.7ExternalAuthentication
*NOTE:-* Not sure what exact content, can or should go but, the below stpes can be helpful for documenting.
Registering RedHat Satellite6 box to IPA Server.
-----------------------------------
1) Install the ipa-client package on the RedHat satellite6
2) Run "ipa-client-install" on sat6 box/capsule,
3) Provide the domain info if asked for on prompting and be done registering sat6 box to IPA server.
Configuring External Authentication for Sat6 with IPA.
--------------------------------------
1) On the IDM server, we create the service:
ipa service-add HTTP/<the-foreman-hostname>
2) katello-installer --foreman-ipa-authentication=true
Accessing via the External Users
-----------------------------------------------------------------------
With the above configuration in place
1) The IPA/IDM users are now able to access the Sat6 UI.
2) These users upon first login get created under Users of Sat6, with "authorized type" as "external".
3) Then one could assign roles to the (external) IPA/IDM users for sat6, after logging in to sat6's admin account.
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
Comment 3Petra Kamenickova
2014-09-01 09:47:32 UTC
*** Bug 1172159 has been marked as a duplicate of this bug. ***
Comment 12Jan Pazdziora (Red Hat)
2015-04-20 11:59:20 UTC
When the IdM is used in cross-realm trust setup with Active Directory, the /etc/sssd/sssd.conf on the IdM server needs settings
ldap_user_extra_attrs=mail, sn, givenname
added to the [domain/...] section of /etc/sssd/sssd.conf, and service sssd restarted. The OS on both Satellite 6 machine and IdM need to be RHEL 7.1+.
Comment 13Jan Pazdziora (Red Hat)
2015-04-21 05:15:24 UTC
Please note that Satellite 6 with direct AD integration also likely needs to be documented, ideally as part of work on this bugzilla. Tracked in bug 1206138.
Comment 14RHEL Program Management
2015-04-21 16:10:50 UTC
Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.
Comment 15Jan Pazdziora (Red Hat)
2015-04-29 13:06:03 UTC
(In reply to Jan Pazdziora from comment #12)
> When the IdM is used in cross-realm trust setup with Active Directory, the
> /etc/sssd/sssd.conf on the IdM server needs settings
>
> ldap_user_extra_attrs=mail, sn, givenname
Correction.
When the IdM is used in cross-realm trust setup with Active Directory, the /etc/sssd/sssd.conf on the IdM server needs two settings added:
in section [domain/...]:
ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname
in section [nss]:
user_attributes=+email,+firstname,+lastname
Then service sssd needs to be restarted and you might need to do sss_cache -E if you still do not see the additional attributes for the AD users.