Skip to content

Commit fedc36f

Browse files
kalexand-rhkalexand-rh
authored
Merge pull request #13087 from kalexand-rh/4.0_sssd
porting SSSD assembly
2 parents f09d774 + debcd78 commit fedc36f

8 files changed

+509
-0
lines changed

‎_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ Topics:
5757
File: configuring-internal-oauth
5858
- Name: Using RBAC to define and apply permissions
5959
File: using-rbac
60+
- Name: Configuring LDAP failover
61+
File: configuring-ldap-failover
6062
- Name: Configuring the user agent
6163
File: configuring-user-agent
6264
- Name: Understanding and creating service accounts

‎authentication/configuring-ldap-failover.adoc

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[id='configuring-ldap-failover']]
2+
= Configuring LDAP failover
3+
include::modules/common-attributes.adoc[]
4+
:context: sssd-ldap-failover
5+
6+
toc::[]
7+
8+
include::modules/ldap-failover-overview.adoc[]
9+
10+
include::modules/ldap-failover-prereqs.adoc[leveloffset=+1]
11+
12+
include::modules/ldap-failover-generate-certs.adoc[leveloffset=+1]
13+
14+
include::modules/ldap-failover-configure-sssd.adoc[leveloffset=+1]
15+
16+
include::modules/ldap-failover-configure-apache.adoc[leveloffset=+1]
17+
18+
include::modules/ldap-failover-configure-openshift.adoc[leveloffset=+1]

‎modules/ldap-failover-configure-apache.adoc

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/configuring-ldap-failover.adoc
4+
5+
[id='sssd-configuring-apache-{context}']
6+
= Configuring Apache to use SSSD
7+
8+
.Procedure
9+
10+
. Create a *_/etc/pam.d/openshift_* file that contains the
11+
following contents:
12+
+
13+
----
14+
auth required pam_sss.so
15+
account required pam_sss.so
16+
----
17+
+
18+
This configuration enables PAM, the pluggable authentication module, to use
19+
`pam_sss.so` to determine authentication and access control when an
20+
authentication request is issued for the `openshift` stack.
21+
22+
. Edit the *_/etc/httpd/conf.modules.d/55-authnz_pam.conf_* file and uncomment
23+
the following line:
24+
+
25+
----
26+
LoadModule authnz_pam_module modules/mod_authnz_pam.so
27+
----
28+
29+
. To configure the Apache *_httpd.conf_* file for remote basic authentication,
30+
create the *_openshift-remote-basic-auth.conf_* file in the
31+
*_/etc/httpd/conf.d_* directory. Use the following template to provide your
32+
required settings and values:
33+
+
34+
[IMPORTANT]
35+
====
36+
Carefully review the template and customize its contents to fit your
37+
environment.
38+
====
39+
+
40+
----
41+
LoadModule request_module modules/mod_request.so
42+
LoadModule php7_module modules/libphp7.so
43+
44+
# Nothing needs to be served over HTTP. This virtual host simply redirects to
45+
# HTTPS.
46+
<VirtualHost *:80>
47+
DocumentRoot /var/www/html
48+
RewriteEngine On
49+
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R,L]
50+
</VirtualHost>
51+
52+
<VirtualHost *:443>
53+
# This needs to match the certificates you generated. See the CN and X509v3
54+
# Subject Alternative Name in the output of:
55+
# openssl x509 -text -in /etc/pki/tls/certs/remote-basic.example.com.crt
56+
ServerName remote-basic.example.com
57+
58+
DocumentRoot /var/www/html
59+
60+
# Secure all connections with TLS
61+
SSLEngine on
62+
SSLCertificateFile /etc/pki/tls/certs/remote-basic.example.com.crt
63+
SSLCertificateKeyFile /etc/pki/tls/private/remote-basic.example.com.key
64+
SSLCACertificateFile /etc/pki/CA/certs/ca.crt
65+
66+
# Require that TLS clients provide a valid certificate
67+
SSLVerifyClient require
68+
SSLVerifyDepth 10
69+
70+
# Other SSL options that may be useful
71+
# SSLCertificateChainFile ...
72+
# SSLCARevocationFile ...
73+
74+
# Send logs to a specific location to make them easier to find
75+
ErrorLog logs/remote_basic_error_log
76+
TransferLog logs/remote_basic_access_log
77+
LogLevel warn
78+
79+
# PHP script that turns the Apache REMOTE_USER env var
80+
# into a JSON formatted response that OpenShift understands
81+
<Location /check_user.php>
82+
# all requests not using SSL are denied
83+
SSLRequireSSL
84+
# denies access when SSLRequireSSL is applied
85+
SSLOptions +StrictRequire
86+
# Require both a valid basic auth user (so REMOTE_USER is always set)
87+
# and that the CN of the TLS client matches that of the OpenShift master
88+
<RequireAll>
89+
Require valid-user
90+
Require expr %{SSL_CLIENT_S_DN_CN} == 'system:openshift-master'
91+
</RequireAll>
92+
# Use basic auth since OpenShift will call this endpoint with a basic challenge
93+
AuthType Basic
94+
AuthName openshift
95+
AuthBasicProvider PAM
96+
AuthPAMService openshift
97+
98+
# Store attributes in environment variables. Specify the email attribute that
99+
# you confirmed.
100+
LookupOutput Env
101+
LookupUserAttr mail REMOTE_USER_MAIL
102+
LookupUserGECOS REMOTE_USER_DISPLAY_NAME
103+
104+
# Other options that might be useful
105+
106+
# While REMOTE_USER is used as the sub field and serves as the immutable ID,
107+
# REMOTE_USER_PREFERRED_USERNAME could be used to have a different username
108+
# LookupUserAttr <attr_name> REMOTE_USER_PREFERRED_USERNAME
109+
110+
# Group support may be added in a future release
111+
# LookupUserGroupsIter REMOTE_USER_GROUP
112+
</Location>
113+
114+
# Deny everything else
115+
<Location ~ "^((?!\/check_user\.php).)*$">
116+
Deny from all
117+
</Location>
118+
</VirtualHost>
119+
----
120+
121+
. Create the *_check_user.php_* script in the *_/var/www/html_* directory.
122+
Include the following code:
123+
+
124+
----
125+
<?php
126+
// Get the user based on the Apache var, this should always be
127+
// set because we 'Require valid-user' in the configuration
128+
$user = apache_getenv('REMOTE_USER');
129+
130+
// However, we assume it may not be set and
131+
// build an error response by default
132+
$data = array(
133+
'error' => 'remote PAM authentication failed'
134+
);
135+
136+
// Build a success response if we have a user
137+
if (!empty($user)) {
138+
$data = array(
139+
'sub' => $user
140+
);
141+
// Map of optional environment variables to optional JSON fields
142+
$env_map = array(
143+
'REMOTE_USER_MAIL' => 'email',
144+
'REMOTE_USER_DISPLAY_NAME' => 'name',
145+
'REMOTE_USER_PREFERRED_USERNAME' => 'preferred_username'
146+
);
147+
148+
// Add all non-empty environment variables to JSON data
149+
foreach ($env_map as $env_name => $json_name) {
150+
$env_data = apache_getenv($env_name);
151+
if (!empty($env_data)) {
152+
$data[$json_name] = $env_data;
153+
}
154+
}
155+
}
156+
157+
// We always output JSON from this script
158+
header('Content-Type: application/json', true);
159+
160+
// Write the response as JSON
161+
echo json_encode($data);
162+
?>
163+
----
164+
165+
. Enable Apache to load the module. Modify the
166+
*_/etc/httpd/conf.modules.d/55-lookup_identity.conf_* file and uncomment the
167+
following line:
168+
+
169+
----
170+
LoadModule lookup_identity_module modules/mod_lookup_identity.so
171+
----
172+
173+
. Set an SELinux boolean so that SElinux allows Apache to connect to SSSD over
174+
D-BUS:
175+
+
176+
----
177+
# setsebool -P httpd_dbus_sssd on
178+
----
179+
180+
. Set a boolean to tell SELinux that it is acceptable for Apache to contact the
181+
PAM subsystem:
182+
+
183+
----
184+
# setsebool -P allow_httpd_mod_auth_pam on
185+
----
186+
187+
. Start Apache:
188+
+
189+
----
190+
# systemctl start httpd.service
191+
----

‎modules/ldap-failover-configure-openshift.adoc

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/configuring-ldap-failover.adoc
4+
5+
[id='sssd-for-ldap-configure-openshift-{context}']
6+
= Configuring {product-title} to use SSSD as the basic remote authentication server
7+
8+
Modify the default configuration of your cluster to use the new identity
9+
provider that you created. Complete the following steps on the first master host
10+
listed in the Ansible host inventory file.
11+
12+
.Procedure
13+
14+
. Open the *_/etc/origin/master/master-config.yaml_* file.
15+
16+
. Locate the `identityProviders` section and replace it with the following code:
17+
+
18+
----
19+
identityProviders:
20+
- name: sssd
21+
challenge: true
22+
login: true
23+
mappingMethod: claim
24+
provider:
25+
apiVersion: v1
26+
kind: BasicAuthPasswordIdentityProvider
27+
url: https://remote-basic.example.com/check_user.php
28+
ca: /etc/origin/master/ca.crt
29+
certFile: /etc/origin/master/openshift-master.crt
30+
keyFile: /etc/origin/master/openshift-master.key
31+
----
32+
33+
. Start {product-title} with the updated configuration:
34+
+
35+
----
36+
# openshift start \
37+
--public-master=https://openshift.example.com:8443 \
38+
--master-config=/etc/origin/master/master-config.yaml \
39+
--node-config=/etc/origin/node-node1.example.com/node-config.yaml
40+
----
41+
42+
. Test a login by using the `oc` CLI:
43+
+
44+
----
45+
oc login https://openshift.example.com:8443
46+
----
47+
+
48+
You can log in only with valid LDAP credentials.
49+
. List the identities and confirm that an email address is displayed for each
50+
user name. Run the following command:
51+
+
52+
----
53+
$ oc get identity -o yaml
54+
----

‎modules/ldap-failover-configure-sssd.adoc

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/configuring-ldap-failover.adoc
4+
5+
[id='sssd-configuring-sssd-{context}']
6+
= Configuring SSSD for LDAP failover
7+
Complete these steps on the remote basic authentication server.
8+
9+
You can configure the SSSD to retrieve attributes, such as email addresses and
10+
display names, and pass them to {product-title} to display in the web interface.
11+
In the following steps, you configure the SSSD to provide email addresses to
12+
{product-title}.
13+
14+
.Procedure
15+
16+
. Install the required SSSD and the web server components:
17+
+
18+
----
19+
# yum install -y sssd \
20+
sssd-dbus \
21+
realmd \
22+
httpd \
23+
mod_session \
24+
mod_ssl \
25+
mod_lookup_identity \
26+
mod_authnz_pam \
27+
php \
28+
mod_php
29+
----
30+
31+
. Set up SSSD to authenticate this VM against the LDAP server. If the LDAP server
32+
is a FreeIPA or Active Directory environment, then use `realmd` to join
33+
this machine to the domain.
34+
+
35+
----
36+
# realm join ldap.example.com
37+
----
38+
+
39+
For more advanced cases, see the
40+
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/authconfig-ldap.html[System-Level Authentication Guide]
41+
42+
. To use SSSD to manage failover situations for LDAP, add more entries to the
43+
*_/etc/sssd/sssd.conf_* file on the `ldap_uri` line. Systems that are
44+
enrolled with FreeIPA can automatically handle failover by using DNS SRV records.
45+
46+
. Modify the `[domain/DOMAINNAME]` section of the *_/etc/sssd/sssd.conf_* file
47+
and add this attribute:
48+
+
49+
----
50+
[domain/example.com]
51+
...
52+
ldap_user_extra_attrs = mail <1>
53+
----
54+
<1> Specify the correct attribute to retrieve email addresses for your LDAP
55+
solution. For IPA, specify `mail`. Other LDAP solutions might use another
56+
attribute, such as `email`.
57+
58+
. Confirm that the `domain` parameter in the *_/etc/sssd/sssd.conf_* file
59+
contains only the domain name listed in the `[domain/DOMAINNAME]` section.
60+
+
61+
----
62+
domains = example.com
63+
----
64+
65+
. Grant Apache permission to retrieve the email attribute. Add the following
66+
lines to the `[ifp]` section of the *_/etc/sssd/sssd.conf_* file:
67+
+
68+
----
69+
[ifp]
70+
user_attributes = +mail
71+
allowed_uids = apache, root
72+
----
73+
74+
. To ensure that all of the changes are applied properly, restart SSSD:
75+
+
76+
----
77+
$ systemctl restart sssd.service
78+
----
79+
80+
. Test that the user information can be retrieved properly:
81+
+
82+
----
83+
$ getent passwd <username>
84+
username:*:12345:12345:Example User:/home/username:/usr/bin/bash
85+
----
86+
87+
. Confirm that the mail attribute you specified returns an email address from
88+
your domain:
89+
+
90+
----
91+
# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \
92+
/org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr \
93+
string:username \ <1>
94+
array:string:mail <2>
95+
96+
method return time=1528091855.672691 sender=:1.2787 -> destination=:1.2795 serial=13 reply_serial=2
97+
array [
98+
dict entry(
99+
string "mail"
100+
variant array [
101+
string "username@example.com"
102+
]
103+
)
104+
]
105+
----
106+
<1> Provide a user name in your LDAP solution.
107+
<2> Specify the attribute that you configured.
108+
109+
. Attempt to log into the VM as an LDAP user and confirm that you can log in
110+
using LDAP credentials. You can use either the local console or a remote service
111+
like SSH to log in.
112+
113+
[IMPORTANT]
114+
====
115+
By default, all users can log into the remote basic authentication server by using
116+
their LDAP credentials. You can change this behavior:
117+
118+
* If you use IPA joined systems,
119+
link:https://www.freeipa.org/page/Howto/HBAC_and_allow_all[configure host-based access control].
120+
* If you use Active Directory joined systems, use a
121+
link:https://docs.pagure.org/SSSD.sssd/design_pages/active_directory_gpo_integration.html[group policy object].
122+
* For other cases, see the
123+
link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/sssd[SSSD configuration] documentation.
124+
====

0 commit comments

Comments
 (0)