Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1570040

Summary: [RFE] RH Single Sign-On or OpenID Connect integration with Administration/User Portal
Product: Red Hat Enterprise Virtualization Manager Reporter: Juan Manuel Parrilla Madrid <jparrill>
Component: ovirt-engineAssignee: Ravi Nori <rnori>
Status: CLOSED ERRATA QA Contact: Petr Matyáš <pmatyas>
Severity: low Docs Contact:
Priority: unspecified    
Version: 4.1.10CC: fgarciad, jparrill, lsurette, mgoldboi, michal.skrivanek, mperina, Rhev-m-bugs, rnori, sborella, srevivo
Target Milestone: ovirt-4.3.0Keywords: FutureFeature, Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ovirt-engine-4.3.0_rc, ovirt-engine-extension-aaa-misc-1.0.2 Doc Type: Enhancement
Doc Text:
This release adds support for external OpenID Connect authentication using Keycloak in both the user interface and the REST API.
Story Points: ---
Clone Of:
: 1574951 1588375 (view as bug list) Environment:
Last Closed: 2019-05-08 12:37:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Infra RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1574951, 1574958, 1588375    

Description Juan Manuel Parrilla Madrid 2018-04-20 13:35:22 UTC
Description of problem:
I have found some info regarding SSO integration with RHEV Manager for Usser and Administration portal, but all the info pointing to version 3.5.

- Is still valid this configuration?

If the answer is yes, must be on the official documentation from 3.6 until the latest.

If not is neccesary to make the integration work again.


I am following some clues:

- The best: https://access.redhat.com/sites/default/files/attachments/saml.pdf (still checking if it works)
- https://bugzilla.redhat.com/show_bug.cgi?id=884653 (closed errata)


btw the point of this BZ is give the customer a guide to integrate the Admin/User portal of Red Hat Virtualization with RHSSO/SAML clearer than already exists.

Comment 2 Juan Manuel Parrilla Madrid 2018-04-22 10:11:17 UTC
Hi Michal,

This looks perfect, when I look fot SSO integration on RHN this didn't comes up, on google just shows the 3.5 version. Maybe I was not using the right words. BTW, thanks this is what I was looking for.

Thanks buddy.

Regards

Comment 3 Juan Manuel Parrilla Madrid 2018-04-22 10:12:08 UTC
This works on 4.1 version also¿¿ or just on 4.2 Beta version?

Comment 4 Juan Manuel Parrilla Madrid 2018-04-22 10:12:19 UTC
This works on 4.1 version also¿¿ or just on 4.2 Beta version?

Comment 5 Michal Skrivanek 2018-04-22 17:15:11 UTC
4.0 or so. You can see all docs for all versions at https://access.redhat.com/documentation/en-us/red_hat_virtualization/

Comment 6 Juan Manuel Parrilla Madrid 2018-04-26 13:56:37 UTC
Hi there,

I was reviewing the documentation but I didn't see anything related with SAML or RHSSO, maybe I skip something?. I was looking for an integration with RH SSO or SAML/OpenID.

Thanks in advance

Comment 7 Martin Perina 2018-05-11 13:09:22 UTC
Were you able to configure RHSSO with RHV? If so could you please attach your solution to the bug?

Comment 8 Martin Perina 2018-05-28 06:40:43 UTC
(In reply to Martin Perina from comment #7)
> Were you able to configure RHSSO with RHV? If so could you please attach
> your solution to the bug?

Ping

Comment 9 Juan Manuel Parrilla Madrid 2018-06-05 13:43:58 UTC
Yeah, but I face a problem with non-federated users. I mean:

I have a RHSSO instance running federated against a LDAP, this LDAP gives me many users and I could login into RHSSO without problems. The problem comes when I try to login into RHV because those users not exists at RHEV level because that is not federated against nothing. TL;DR I succed at login but when the RHSSO redirects to RHEV login portal, the answer is that I have not permission to login.

I have the instance still runnning If you need info or check something.

Any clue to avoid this error?

Comment 10 Martin Perina 2018-06-06 13:47:35 UTC
(In reply to Juan Manuel Parrilla Madrid from comment #9)
> Yeah, but I face a problem with non-federated users. I mean:
> 
> I have a RHSSO instance running federated against a LDAP, this LDAP gives me
> many users and I could login into RHSSO without problems. The problem comes
> when I try to login into RHV because those users not exists at RHEV level
> because that is not federated against nothing. TL;DR I succed at login but
> when the RHSSO redirects to RHEV login portal, the answer is that I have not
> permission to login.
> 
> I have the instance still runnning If you need info or check something.
> 
> Any clue to avoid this error?

I would need to see your configuration, but here is my guess:

If you have configured SAML on Apache, Apache does the authentication and pass authenticated username to RHV manager using aaa-misc extension. Then RHV SSO try to find authz configuration using aaa-ldap extension, which will try to connect to associated LDAP and fetch additional information about user. So do you have this aaa-ldap authz extension configured?

Comment 11 Juan Manuel Parrilla Madrid 2018-06-07 07:51:34 UTC
Hi there,

no, I didn't configure the aaa-ldap to federate the RHEV Manager because I supose that this already works. The point of this BZ is to have an integration at API level to create the users without the need of a LDAP federated en RHEV side but on RHSSO/Keycloak side.

regards

Comment 12 Martin Perina 2018-08-17 09:13:08 UTC
Tentatively moving to 4.3, we will either support SAML tracked here or OIDC tracked in BZ1588375

Comment 13 Sandro Bonazzola 2018-11-23 12:47:02 UTC
All referenced patches have been merged, can this move to modified?

Comment 14 Martin Perina 2018-11-27 13:04:18 UTC
*** Bug 1588375 has been marked as a duplicate of this bug. ***

Comment 15 Petr Matyáš 2018-12-03 13:40:34 UTC
Verified on ovirt-engine-4.3.0-0.2.master.20181127150027.gitd731af3.el7.noarch

Comment 17 Raz Tamir 2019-01-16 01:31:32 UTC
QE verification bot: the bug was verified upstream

Comment 18 Ravi Nori 2019-01-31 18:06:27 UTC
*** Bug 1574951 has been marked as a duplicate of this bug. ***

Comment 20 errata-xmlrpc 2019-05-08 12:37:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2019:1085

Comment 21 Franta Kust 2019-05-16 13:05:41 UTC
BZ<2>Jira Resync