{"id":18701,"date":"2023-07-31T08:25:53","date_gmt":"2023-07-31T08:25:53","guid":{"rendered":"https:\/\/www.insentragroup.com\/us\/insights\/uncategorized\/rh-sso-user-federation-with-red-hat-idm-freeipa\/"},"modified":"2024-12-13T02:00:12","modified_gmt":"2024-12-13T02:00:12","slug":"rh-sso-user-federation-with-red-hat-idm-freeipa","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/us\/insights\/geek-speak\/modern-workplace\/rh-sso-user-federation-with-red-hat-idm-freeipa\/","title":{"rendered":"RH SSO User Federation with Red Hat idM (FreeIPA)"},"content":{"rendered":"\n<p>In today&#8217;s digital world, user authentication is crucial for ensuring the security of web applications. While some web applications support Kerberos Single Sign On (SSO), others rely on OpenID and SAML authentication. This is where Red Hat SSO (RH SSO) comes in, providing a solution to federate users from various sources.<\/p>\n\n\n\n<p>In this blog, we will explore how to use RH SSO and Red Hat idM (FreeIPA) to authenticate web users. RH SSO, a JBoss application, offers Single Sign On for online applications with OpenID and SAML2. One of its standout features is the ability to use Kerberos tickets to replace password-based authentication, adding an extra layer of convenience and security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is RH SSO<\/h2>\n\n\n\n<p>Red Hat SSO is a JBoss application that can federate users from a variety of LDAP servers, including 389-Server, OpenLDAP, and Microsoft Active Directory. It provides Single Sign On (SSO) for online applications with OpenID and SAML2.&nbsp;&nbsp;<\/p>\n\n\n\n<p>The ability to use Kerberos tickets from clients to replace password-based authentication is a very neat feature.&nbsp;<\/p>\n\n\n\n<p><strong>Requirements<\/strong>&nbsp;<\/p>\n\n\n\n<p>The following guide is based on the commercially supported products provided by Red Hat, namely RHEL8, Red Hat SSO and Red Hat idM. It is expected that this guide will also work with the upstream products: Keycloak (Red Hat SSO) and FreeIPA (Red Hat idM).&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A base installation of RHEL8&nbsp;&nbsp;<\/li>\n\n\n\n<li>A subscription for RHEL8 and JBoss EAP&nbsp;<\/li>\n\n\n\n<li>A configured and working FreeIPA\/Red Hat IdM environment<\/li>\n\n\n\n<li>An instance of WordPress (optional)&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>My setup consists of:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Three (3) idM servers (one primary and two replicas)&nbsp;<\/li>\n\n\n\n<li>Two (2) RH SSO servers in a HA configuration (the configuration is not in scope for this document)&nbsp;<\/li>\n\n\n\n<li>Two (2) mariadb\/galera servers in HA configuration for RH SSO&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>The following system specs have been used for the setup presented above:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CPU: 4vCPUs&nbsp;<\/li>\n\n\n\n<li>Memory: 4GB&nbsp;&nbsp;<\/li>\n\n\n\n<li>Disk: 60GB&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<p><strong>Integration with Red Hat idM<\/strong>&nbsp;<\/p>\n\n\n\n<p>Ensure your SSO server is enrolled in the idM domain.&nbsp;&nbsp;<\/p>\n\n\n\n<p>We need to do some preparation work:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create Kerberos Service Principal for the HTTP server&nbsp;&nbsp;<\/li>\n\n\n\n<li>Fetching the Kerberos Keytab&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<p><strong>Create the Kerberos Service Principal<\/strong>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log into the RH SSO server<\/li>\n\n\n\n<li>Obtain the admin kerberos ticket<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>subscription-manager register \n\nsubscription-manager attach --pool=pool_number <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>kinit admin \n\nklist  <\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create Service Principal&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ipa service-add HTTP\/rhsso01.example.net <\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Download the keytab&nbsp;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ipa-getkeytab -p HTTP\/rhsso01.example.net -s idm01.example.net -k \/etc\/krb5-keycloak.keytab <\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set correct permissions for the keytab&nbsp;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>chown root \/etc\/krb5-keycloak.keytab \n\nchgrp jboss \/etc\/krb5-keycloak.keytab \n\nchmod 640 \/etc\/krb5-keycloak.keytab <\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Create the user for ldap bind<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log into one of the idM servers&nbsp;<\/li>\n\n\n\n<li>Run the following ldapmodify command<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;root@idm01 ~]# ldapmodify -x -D 'cn=Directory Manager' -W &lt;&lt;EOF                                                                                                                              \n\ndn: uid=ssobind,cn=sysaccounts,cn=etc,dc=example,dc=net \n\nchangetype: add \n\nobjectclass: account \n\nobjectclass: simplesecurityobject \n\nuid: system \n\nuserPassword: tower123 \n\npasswordExpirationTime: 20320101000000Z \n\nnsIdleTimeout: 0 \n\nEOF <\/code><\/pre>\n\n\n\n<p>The above command has to be modified to meet your requirements, where:&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td style=\"background-color: #f35905; color: #ffffff; border: 1px solid #f35905\">DN&nbsp;<\/td><td style=\"background-color: #f35905; color: #ffffff; border: 1px solid #f35905\">Description&nbsp;<\/td><\/tr><tr><td><strong>uid=ssobind<\/strong>&nbsp;<\/td><td>This is the bind user. It can be whatever you choose&nbsp;<\/td><\/tr><tr><td><strong>dc=example,dc=net<\/strong>&nbsp;<\/td><td>This is your domain&nbsp;&nbsp;<\/td><\/tr><tr><td><strong>userPassword<\/strong>&nbsp;<\/td><td>This is the password. Make it simple.&nbsp;&nbsp;<\/td><\/tr><tr><td><strong>passwordExpirationTime<\/strong>&nbsp;<\/td><td>Depending on when you are reading this \u2026 you might modify this date&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verify the bind user and the password&nbsp;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ldapsearch -D  \"uid=ssobind,cn=sysaccounts,cn=etc,dc=example,dc=net \"  \n\n-W -h idm01.example.net  \n\n-b \"cn=accounts,dc=example,dc=net\"  \n\nuid=nesiuser01 <\/code><\/pre>\n\n\n\n<p>We are ready to create the User Federation&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Create RH SSO User Federation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log into RH SSO using browser&nbsp;<\/li>\n\n\n\n<li>Select the Realm you want to modify (top right corner)&nbsp;<\/li>\n\n\n\n<li>Click on User Federation and click Add Provider&nbsp;<\/li>\n\n\n\n<li>Fill out the form as following:&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td style=\"background-color: #f35905; color: #ffffff; border: 1px solid #f35905\"><strong>Option<\/strong>&nbsp;<\/td><td style=\"background-color: #f35905; color: #ffffff; border: 1px solid #f35905\"><strong>Setting<\/strong>&nbsp;<\/td><\/tr><tr><td><strong>Edit Mode<\/strong>&nbsp;<\/td><td>READ_ONLY&nbsp;<\/td><\/tr><tr><td><strong>Vendor<\/strong>&nbsp;<\/td><td>Red Hat Directory Server&nbsp;<\/td><\/tr><tr><td><strong>Username LDAP Attribute<\/strong>&nbsp;<\/td><td>uid&nbsp;<\/td><\/tr><tr><td><strong>RDN LDAP attribute<\/strong>&nbsp;<\/td><td>Uid&nbsp;<\/td><\/tr><tr><td><strong>UUID LDAP attribute<\/strong>&nbsp;<\/td><td>ipaUniqueID&nbsp;<\/td><\/tr><tr><td><strong>User Object Class<\/strong>&nbsp;<\/td><td>inetOrgPerson, organizationalPerson&nbsp;<\/td><\/tr><tr><td><strong>Connection URL<\/strong>&nbsp;<\/td><td>ldaps:\/\/idm01.example.net&nbsp;<\/td><\/tr><tr><td><strong>Users DN<\/strong>&nbsp;<\/td><td>cn=users,cn=accounts,dc=example,dc=net&nbsp;<\/td><\/tr><tr><td><strong>Authentication Type<\/strong>&nbsp;<\/td><td>Simple&nbsp;<\/td><\/tr><tr><td><strong>Bind DN<\/strong>&nbsp;<\/td><td>uid=ssobind,cn=sysaccounts,cn=etc,dc=example,dc=net&nbsp;<\/td><\/tr><tr><td><strong>Bind Credential<\/strong>&nbsp;<\/td><td>your password&nbsp;<\/td><\/tr><tr><td><strong>Allow Kerberos authentication<\/strong>&nbsp;<\/td><td>On&nbsp;<\/td><\/tr><tr><td><strong>Kerberos Realm<\/strong>&nbsp;<\/td><td>EXAMPLE.NET&nbsp;<\/td><\/tr><tr><td><strong>Server Principal<\/strong>&nbsp;<\/td><td>HTTP\/rhsso01.example.net&nbsp;<\/td><\/tr><tr><td><strong>Keytab<\/strong>&nbsp;<\/td><td>\/etc\/krb5-keycloak.keytab&nbsp;<\/td><\/tr><tr><td><strong>Use Kerberos For Password Authentication<\/strong>&nbsp;<\/td><td>On&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"890\" height=\"784\" src=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-7.png\" alt=\"\" class=\"wp-image-18702\" srcset=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-7.png 890w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-7-300x264.png 300w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-7-768x677.png 768w\" sizes=\"(max-width: 890px) 100vw, 890px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Save the configuration<\/li>\n\n\n\n<li>Click on Test Connection (next to Connection URL) to verify connection to ldap server<\/li>\n\n\n\n<li>Click Test authentication to verify the bind user\/password&nbsp;<\/li>\n\n\n\n<li>Click on Synchronize all users. If you have any users in the idM, you should be able to see something like:&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"669\" height=\"69\" src=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-8.png\" alt=\"\" class=\"wp-image-18704\" srcset=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-8.png 669w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2023\/08\/image-8-300x31.png 300w\" sizes=\"(max-width: 669px) 100vw, 669px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate to Users and click \u2018View all users. You should be able to see all the imported users&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>If you want to learn more about RH SSO User Federation with Red Hat idM and how it can benefit your web applications, <a href=\"https:\/\/www.insentragroup.com\/us\/contact\/\" target=\"_blank\" rel=\"noreferrer noopener\">contact us<\/a> today! Our team of experts is ready to assist you in implementing this solution and enhancing the security of your digital assets.\u00a0<\/p>\n\n\n\n<style>\nbody .wp-block-code>code {\n    font-family: Menlo,Consolas,monaco,monospace;\n    color: #000;\n    padding: 30px 40px;\n    border: none;\n    border-radius: 4px;\n    background: #ddd;\n}\n<\/style>\n","protected":false},"excerpt":{"rendered":"<p>Learn how to use RH SSO and Red Hat idM to authenticate web users with OpenID and SAML2. This tutorial also covers using Kerberos tickets for passwordless authentication. <\/p>\n","protected":false},"author":67,"featured_media":18706,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-18701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-modern-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/18701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/comments?post=18701"}],"version-history":[{"count":3,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/18701\/revisions"}],"predecessor-version":[{"id":18707,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/18701\/revisions\/18707"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/media\/18706"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/media?parent=18701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/categories?post=18701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/tags?post=18701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}