Bug 1206138
| Summary: | [doc] Documentation needed for sat61 AD Direct Integration with GSS-Proxy | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Kedar Bidarkar <kbidarka> | ||||||
| Component: | Documentation | Assignee: | Peter Ondrejka <pondrejk> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Tahlia Richardson <trichard> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 6.1.0 | CC: | greartes, hhudgeon, jpazdziora, kbidarka | ||||||
| Target Milestone: | Unspecified | Keywords: | Reopened | ||||||
| Target Release: | Unused | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2015-08-12 11:49:30 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 1006786 [details]
[Updated] Satellite61 AD Integration with GSS-Proxy
Please use this latest doc, which is now updated after corrections.
Hi Kedar, Thank you! Possible 6.1 if it ties in to the active directory requirements we might have. I am assigning this to Megan. Cheers, Athene Ad step 2 b) -- please note that you need to have krb5-workstation to be able to run that klist command. Ad KrbLocalUserMapping -- it is possible to keep it on the On value that --foreman-ipa-authentication=true puts there, no change to Off is needed. What you need to do instead is to add to the beginning of /etc/krb5.conf directive includedir /var/lib/sss/pubconf/krb5.include.d/ We track that in bug 1207552. So the net result is that no modification to auth_kerb.conf is needed, neither for the setup without GSS-Proxy, nor the setup with GSS-Proxy, because KrbLocalUserMapping can stay at On and the Krb5KeyTab line can stay there as well -- the most important is to remove the actual /etc/httpd/conf/http.keytab when setting up the GSS-Proxy. And if you remove the keytab using rm -f /etc/httpd/conf/http.keytab && touch /etc/httpd/conf/http.keytab even subsequent katello-install runs will pass and keep things sane, without attempting to run ipa-getkeytab to re-retrieve it again, which would obviously fail for the direct AD integration scenario when there is no IPA there. Please note that this bugzilla is likely blocked by bug 1132527 -- we really want the --foreman-ipa-authentication=true option documented for its primary use before describing this setup without IdM/IPA. Since this issue was entered in Red Hat Bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release. We can only find the file /etc/httpd/conf.d/05-foreman-ssl.d/auth_kerb.conf , after running the "katello-installer" command. But we do not want the users to edit the above file, So no need to remove the Krb5KeyTab line. Reasons given above as per comment 4 of this bug. An alternate method of getting things to work without editing the file, have already been suggested in comment4 and have been properly updated in the Draft. Looks like we have missed this step: From the attached file by me above, ------------------------ 7) Place the keytab file created in step 5) at /etc/httpd/conf/http.keytab , with permissions for apache. 'chown apache /etc/httpd/conf/http.keytab' NOTE: we need to copy /etc/gssproxy/http.keytab and place at /etc/httpd/conf/http.keytab ------------------------ Above step should have been added between Step 4) and step 5) of "procedure 20.4"To Configure Direct AD Integration:, without which step 5) is bound to fail with missing /etc/httpd/conf/http.keytab. I need to go through the draft in more detail, but these are things which can think of currently. I see little changes in the draft, but I will test it out once as it is as per draft and update my findings here soon. I believe that should help. Corrections for "proecedure 20.5" To Configure GSS Proxy for Direct AD Integration: a) The below step 5) needs to be removed from the docs Draft. Remove the Krb5KeyTab line from the /etc/httpd/conf.d/05-foreman-ssl.d/auth_kerb.conf. b) We need to add the below statement for step 2), as to where the entry needs to be updated to /etc/gssproxy/gssproxy.conf. This section has to be before any section which might have allow_any_uid = yes, namely gssproxy-0.3.0 in its service/nfs-client: c) Another correction required, my attached doc too had this entry, but now this needs to be removed from step 7) # systemctl enable httpd.service |
Created attachment 1006779 [details] Satellite61 AD Integration with GSS-Proxy Document URL: I have attached the documentation "Satellite61_Active_Directory_Integration_with_gss_proxy.txt' This documentation is being updated here, after collecting the relevant information from various sources. Section Number and Name: Describe the issue: Currently there is no document to help with the integration process. Suggestions for improvement: Additional information: This document should help people integrate the Satellite6.1 with Active Directory. This will allow the ActiveDirectory users, to login to Satellite6.1 WebUI (without the need to fill the login form) via SSO, using realmd, kerberos, SSSD.