Project

General

Profile

Edit History

Tutorials & Articles (Archived) ยป

Foreman and mod auth kerb » History » Version 12

Jan Pazdziora, 12/10/2013 08:25 AM

1 3 Jan Pazdziora 
{{>toc}}
2 





    3
    4
    Jan Pazdziora
    
h1. Foreman and mod_auth_kerb





    4
    1
    Jan Pazdziora
    





    5
    12
    Jan Pazdziora
    
Setting up SPNEGO/GSSAPI/Negotiate authentication in Foreman 1.4-to-be.





    6
    1
    Jan Pazdziora
    





    7
    12
    Jan Pazdziora
    
h2. Foreman 1.4-to-be (develop as of December 2013)





    8
    2
    Jan Pazdziora
    





    9
    12
    Jan Pazdziora
    
Foreman 1.4 will have support for SPNEGO/GSSAPI/Negotiate authentication.





    10
    1
    Jan Pazdziora
    





    11
    
    
    
We need mod_auth_kerb installed on the Foreman machine.





    12
    
    
    





    13
    
    
    
We assume the Foreman machine is IPA-enrolled:





    14
    
    
    





    15
    
    
    
<pre>





    16
    12
    Jan Pazdziora
    
# ipa-client-install





    17
    1
    Jan Pazdziora
    
</pre>





    18
    
    
    





    19
    9
    Jan Pazdziora
    
On the IPA server, we create the service:





    20
    1
    Jan Pazdziora
    





    21
    
    
    
<pre>





    22
    12
    Jan Pazdziora
    
# ipa service-add HTTP/<the-foreman-hostname>





    23
    1
    Jan Pazdziora
    
</pre>





    24
    
    
    





    25
    
    
    
On the Foreman machine, we get the keytab for the service:





    26
    
    
    





    27
    
    
    
<pre>





    28
    12
    Jan Pazdziora
    
# ipa-getkeytab -s ipa.example.com -k /etc/http.keytab -p HTTP/$( hostname )





    29
    
    
    
# chown apache /etc/http.keytab





    30
    
    
    
# chmod 600 /etc/http.keytab





    31
    1
    Jan Pazdziora
    
</pre>





    32
    
    
    





    33
    
    
    
On the Foreman machine, we install mod_auth_kerb:





    34
    
    
    





    35
    
    
    
<pre>





    36
    12
    Jan Pazdziora
    
# yum install -y mod_auth_kerb





    37
    1
    Jan Pazdziora
    
</pre>





    38
    
    
    





    39
    
    
    
On the Foreman machine, we configure it to be used by Apache:





    40
    
    
    





    41
    
    
    
<pre>





    42
    12
    Jan Pazdziora
    
<Location /users/extlogin>





    43
    1
    Jan Pazdziora
    
 AuthType Kerberos





    44
    
    
    
 AuthName "Kerberos Login"





    45
    
    
    
 KrbMethodNegotiate On





    46
    
    
    
 KrbMethodK5Passwd Off





    47
    
    
    
 KrbAuthRealms EXAMPLE.COM





    48
    
    
    
 Krb5KeyTab /etc/http.keytab





    49
    
    
    
 KrbLocalUserMapping On





    50
    
    
    
 require valid-user





    51
    12
    Jan Pazdziora
    
 ErrorDocument 401 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'





    52
    
    
    
 # The following is needed as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1020087





    53
    
    
    
 ErrorDocument 500 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'





    54
    
    
    
</Location>





    55
    1
    Jan Pazdziora
    
</pre>





    56
    
    
    





    57
    12
    Jan Pazdziora
    
On the Foreman machine, we tell Foreman that it is OK to trust the authentication done by Apache:





    58
    1
    Jan Pazdziora
    





    59
    2
    Jan Pazdziora
    
<pre>





    60
    12
    Jan Pazdziora
    
# to /etc/foreman/settings.yaml add





    61
    
    
    
:authorize_login_delegation: true





    62
    
    
    
:authorize_login_delegation_auth_source_user_autocreate: External





    63
    2
    Jan Pazdziora
    
</pre>





    64
    
    
    





    65
    
    
    
On Foreman machine, restart Apache:





    66
    
    
    





    67
    
    
    
<pre>





    68
    12
    Jan Pazdziora
    
# service httpd restart





    69
    2
    Jan Pazdziora
    
</pre>





    70
    
    
    





    71
    12
    Jan Pazdziora
    
Now in your browser, if you kinit to obtain a ticket, accessing Foreman's WebUI should not ask for login/password and should display the authenticated dashboard directly. If the user was just created, page asking for the email address of this new user will be shown.





    72
    2
    Jan Pazdziora
    





    73
    12
    Jan Pazdziora
    
h3. Disabling auto-creation of externally authentication users





    74
    6
    Jan Pazdziora
    





    75
    12
    Jan Pazdziora
    
If only already existing users should be allowed to log in, remove/comment out the line





    76
    11
    Jan Pazdziora
    





    77
    5
    Jan Pazdziora
    
<pre>





    78
    12
    Jan Pazdziora
    
:authorize_login_delegation: true





    79
    
    
    
:authorize_login_delegation_auth_source_user_autocreate: External





    80
    5
    Jan Pazdziora
    
</pre>





    81
    
    
    





    82
    12
    Jan Pazdziora
    
from /etc/foreman/settings.yaml.





    83
    5
    Jan Pazdziora
    





    84
    
    
    
h3. Namespace separation





    85
    
    
    





    86
    6
    Jan Pazdziora
    
If clear namespace separation of internally and externally authenticated users is desired, the KrbLocalUserMapping should be off:





    87
    
    
    





    88
    
    
    
<pre>





    89
    12
    Jan Pazdziora
    
# in /etc/httpd/conf.d/auth_kerb.conf use





    90
    
    
    
<Location /users/extlogin>





    91
    6
    Jan Pazdziora
    
 AuthType Kerberos





    92
    
    
    
 ...





    93
    
    
    
 KrbLocalUserMapping Off





    94
    12
    Jan Pazdziora
    
</Location>





    95
    6
    Jan Pazdziora
    
</pre>





    96
    
    
    





    97
    
    
    
Then the @REALM would be part of the username and it would be clear that bob is INTERNAL-authenticated and bob@EXAMPLE.COM is different user, EXTERNAL-authenticated. The admin then can manually create another admin@EXAMPLE.COM user (with administrator privileges) and even the admin can use Kerberos.





    98
    12
    Jan Pazdziora
    





    99
    
    
    
h2. This work





    100
    
    
    





    101
    
    
    
See "older version of this page":http://projects.theforeman.org/projects/foreman/wiki/Foreman_and_mod_auth_kerb/11 for the original situation in Foreman 1.3.