How to configure Microsoft Entra ID as an External Authentication source for Satellite 6

Solution Unverified - Updated

Environment

  • Red Hat Satellite 6
  • Microsoft Entra ID

Issue

Many people use Microsoft Entra ID as a central hub for their user authentication. While other Red Hat Products have direct support for leveraging Entra for authentication, Satellite does not.

Resolution

This solution is undocumented and unsupported. There is a request for feature enhancement (RFE) located This content is not included.here. If you feel this feature could benefit you and/or your company, please open a case with red hat support and reference this KCS and RFE.

Identity Provider. Microsoft Entra ID configuration

  1. From the Azure Portal, navigate to Microsoft Entra ID, choose App registrations, click on New Registration.
  2. Provide details to complete the registration
- Name: Name the application to what you desire
- Supported account types: Select how broad you want access to the application. Testing of this guide was done with Single tenant
- Refirect URI (optional): Set the dropdown to Web and provide https://<Satellite_URL>/users/extlogin/redirect_uri
  1. In the new application, select Certificates & secrets and generate a new secret. Ensure you save it now as you will not be able to retrieve it after leaving this section
  2. Go to Token configuration, select add optional claim and ID when prompted then select the following:
- email
- family_name
- given_name
- preferred_username
  1. select Add groups claims and select security groups
    #On Satellite Server
  2. Install mod_auth_openidc
satellite-maintain packages install mod_auth_openidc
  1. Configure the following modules to be loaded by editing /etc/httpd/conf.modules.d/10-auth_openidc.conf with the below entries
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_user_module modules/mod_authz_user.so
  1. Run the satellite-installer to enable keycloak with a new application and realm
satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "foreman-openidc" --foreman-keycloak-realm "*Satellite_Realm*"
  1. Edit the configuration file in /etc/httpd/conf.d/ generated by the previous command(app-name and realm will be in the filename) with the following:
OIDCProviderMetadataURL <OpenID Connect metadata document>
OIDCClientID <Application (client) ID>
OIDCClientSecret <Application Secret>
OIDCRedirectURI https://<SatelliteURL>/users/extlogin/redirect_uri
OIDCCryptoPassphrase <Random Password>
OIDCRemoteUserClaim preferred_username
OIDCScope "openid email profile"
OIDCResponseType id_token

<Location /users/extlogin>
    AuthType openid-connect
    Require valid-user
    LogLevel debug

    RequestHeader set REMOTE_USER %{OIDC_CLAIM_preferred_username}e
    RequestHeader set REMOTE_USER_EMAIL %{OIDC_CLAIM_email}e
    RequestHeader set REMOTE_USER_FIRSTNAME %{OIDC_CLAIM_given_name}e
    RequestHeader set REMOTE_USER_LASTNAME %{OIDC_CLAIM_family_name}e
    RequestHeader set REMOTE_USER_GROUPS %{OIDC_CLAIM_roles}e
</Location>
  1. Inside the Web UI go to Administer → Settings → Authentication and edit the following:

Authorize login delegation = Yes
Authorize login delegation auth source user autocreate = External
OIDC JWKs URL = https://login.microsoftonline.com/*tenant-id*/discovery/v2.0/keys
OIDC Audience = application-ID
OIDC Issuer = https://login.microsoftonline.com/*tenant-id*/v2.0
OIDC Algorithm = RS256
  1. Restart apache on Satellite
satellite-maintain service restart --only httpd
SBR
Product(s)

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.