<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> <a name="_MailEndCompose">Got it!<o:p></o:p></a> <o:p> </o:p> Had to uncomment the following line in lookup_identity.conf<o:p></o:p> # LookupUserGroupsIter AJP_REMOTE_USER_GROUP<o:p></o:p> <o:p> </o:p> Seems to work perfectly now! Now to document all this just in case!<o:p></o:p> <o:p> </o:p> Thanks for the help.<o:p></o:p> <o:p> </o:p> <div> Max DiOrio<o:p></o:p> Global Systems Administrator<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: spacewalk-list-bounces@redhat.com [mailto:spacewalk-list-bounces@redhat.com] On Behalf Of DiOrio, Max Sent: Tuesday, March 13, 2018 1:55 PM To: spacewalk-list@redhat.com Subject: Re: [Spacewalk-list] Spacewalk and AD/SSSD Based User Authentication<o:p></o:p> </div> </div> <o:p> </o:p> Thanks Alex – I’m almost there!<o:p></o:p> <o:p> </o:p> I can now successfully log into Spacewalk as a user authenticating with SSSD and Group Policy. Needed to add a few more pieces to get it to work properly – it was doing the authentication but not the authorization, and wasn’t passing large Kerberos tokens.<o:p></o:p> <o:p> </o:p> It seems my External Authentication Group Role Mapping isn’t working though. I have created a new group “spacewalkadmins” in AD and added the users to it. I can id the username and see that the user is a member of the group. I added the group name to the Spacewalk External Authentication Group Role Mapping, but the mapping is not happening. The user is getting added with no role mapping permissions.<o:p></o:p> <o:p> </o:p> Any idea where I can see the logs for what is happening and why it may not be mapping?<o:p></o:p> <o:p> </o:p> Thanks! <o:p></o:p> <o:p> </o:p> <div> Max DiOrio<o:p></o:p> Global Systems Administrator<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:spacewalk-list-bounces@redhat.com"> spacewalk-list-bounces@redhat.com</a> [<a href="mailto:spacewalk-list-bounces@redhat.com">mailto:spacewalk-list-bounces@redhat.com</a>] On Behalf Of Alexandru Raceanu Sent: Monday, March 12, 2018 2:58 PM To: <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a> Subject: Re: [Spacewalk-list] Spacewalk and AD/SSSD Based User Authentication<o:p></o:p> </div> </div> <o:p> </o:p> <div> <div> Try to go trough the SW/FreeIPA documentation (<a href="https://github.com/spacewalkproject/spacewalk/wiki/SpacewalkAndIPA">https://github.com/spacewalkproject/spacewalk/wiki/SpacewalkAndIPA</a>) DON'T COPY PASTE, read, understand and skip the parts of ipa installation and config as you already have sssd up and running so that should be sufficient.<o:p></o:p> </div> <div> Take a backup before you mess around with you SW deployment so I won't feel bad about the tips!<o:p></o:p> </div> <div> As far as the channel related stuff, after you have the external auth working for rhn admins, you should be able to map another group for dev's with specific permissions (subscribe/unsubscribe systems to software channels) That's at least how the theory would be, personally I would prefer to add all development required software channels to the whole development env/machines, and they can install whatever they want from that channels.<o:p></o:p> </div> <div> It will save you the hassle of educating users on how to use spacewalk or other time consuming questions.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> /Alex<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> <div> From: "DiOrio, Max" <<a href="mailto:Max.DiOrio@ieeeglobalspec.com">Max.DiOrio@ieeeglobalspec.com</a>> To: <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a> Sent: Monday, March 12, 2018 7:44:07 PM Subject: Re: [Spacewalk-list] Spacewalk and AD/SSSD Based User Authentication<o:p></o:p> </div> <o:p> </o:p> <div> SW 2.7 on RHEL 7.4<o:p></o:p> <o:p></o:p> The HTTPD conf files are either commented out, or in the case of auth_kerb.conf, empty. This is a completely out of the box setup and the only documentation I’ve been able to find on this on RH’s portal mentions just the config changes I made. Nothing to do with the files you mentioned.<o:p></o:p> <o:p></o:p> Is there a better how-to to describe the full changes that need to take place to enable this?<o:p></o:p> <o:p></o:p> As far as role map, I only want end users to be able to subscribe to additional software channels that we don’t push by default. For example, we don’t have Microsoft’s channel in our base activation key, but would like to give our developers an opportunity to install software from it without admin intervention.<o:p></o:p> <o:p></o:p> It appears that doing spacewalk-channel –add –c microsoft_rhel7 prompts for a username and password so they are unable to add the channel.<o:p></o:p> <o:p></o:p> <div> Max DiOrio<o:p></o:p> Global Systems Administrator<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a> [<a href="mailto:spacewalk-list-bounces@redhat.com">mailto:spacewalk-list-bounces@redhat.com</a>] On Behalf Of Alexandru Raceanu Sent: Monday, March 12, 2018 2:08 PM To: <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a> Subject: Re: [Spacewalk-list] Spacewalk and AD/SSSD Based User Authentication<o:p></o:p> </div> </div> <o:p></o:p> <div> <div> Spacewalk version and OS please...<o:p></o:p> </div> <div> Also log entries except the tomcat would be helpful.<o:p></o:p> </div> <div> <o:p></o:p> </div> <div> What's the content of following: /etc/httpd/conf.d/intercept_form_submit.conf<o:p></o:p> </div> <div> /etc/httpd/conf.d/authnz_pam.conf<o:p></o:p> </div> <div> /etc/httpd/conf.d/auth_kerb.conf<o:p></o:p> </div> <div> <o:p></o:p> </div> <div> I don't think that you need to create the user if you do role map for external authenticated users ( Admin -> Users -> External Authentication -> Group Role Mapping )<o:p></o:p> </div> <div> /Alex<o:p></o:p> </div> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> <div> From: "DiOrio, Max" <<a href="mailto:Max.DiOrio@ieeeglobalspec.com" target="_blank">Max.DiOrio@ieeeglobalspec.com</a>> To: <a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a> Sent: Monday, March 12, 2018 4:52:21 PM Subject: [Spacewalk-list] Spacewalk and AD/SSSD Based User Authentication<o:p></o:p> </div> <o:p></o:p> <div> Hi!<o:p></o:p> <o:p></o:p> I’m looking to potentially use SSSD and Active Directory to authenticate our users to Spacewalk. The Spacewalk server is already on the domain and we authenticate just fine via SSH using AD.<o:p></o:p> <o:p></o:p> I added the following to the rhn.conf file:<o:p></o:p> pam_auth_service = spacewalk-satellite<o:p></o:p> <o:p></o:p> Created the spacewalk-satellite pam.d file:<o:p></o:p> #%PAM-1.0<o:p></o:p> <o:p></o:p> auth required pam_env.so<o:p></o:p> auth sufficient pam_sss.so no_user_check<o:p></o:p> auth required pam_deny.so<o:p></o:p> <o:p></o:p> account required pam_sss.so no_user_check<o:p></o:p> <o:p></o:p> Restarted spacewalk. Created a user mdiorio in the GUI and checked the box to use PAM.<o:p></o:p> <o:p></o:p> But get the following error when I go to log in.<o:p></o:p> <o:p></o:p> Mar 12 11:51:21 la-1pspacewalk server: 2018-03-12 11:51:21,304 [ajp-bio-0:0:0:0:0:0:0:1-8009-exec-4] WARN com.redhat.rhn.domain.user.legacy.UserImpl - PAM login for user User mdiorio (id 2, org_id 1) failed with error Permission denied.<o:p></o:p> Mar 12 11:51:23 la-1pspacewalk server: 2018-03-12 11:51:23,304 [ajp-bio-0:0:0:0:0:0:0:1-8009-exec-4] INFO com.redhat.rhn.frontend.action.LoginAction - LOCAL AUTH FAILURE: [mdiorio]<o:p></o:p> <o:p></o:p> I can kinit my account on the server without a problem.<o:p></o:p> <o:p></o:p> Not sure what I’m missing. Thanks!<o:p></o:p> <o:p></o:p> Max DiOrio<o:p></o:p> Global Systems Administrator<o:p></o:p> <img border="0" width="175" height="46" style="width:1.8229in;height:.4791in" id="Picture_x0020_5" src="cid:image001.jpg@01D3BAD8.6FF13F60" alt="cid:image002.jpg@01D26A5C.D5C0BF00"><o:p></o:p> 201 Fuller Road, Suite 202<o:p></o:p> Albany, NY 12203-3621<o:p></o:p> Phone: +518-238-6516 | Mobile: +518-944-5289<o:p></o:p> <a href="mailto:max.diorio@ieeeglobalspec.com" target="_blank">max.diorio@ieeeglobalspec.com</a><o:p></o:p> <o:p></o:p> _______________________________________________ Spacewalk-list mailing list <a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><o:p></o:p> </div> </div> _______________________________________________ Spacewalk-list mailing list <a href="mailto:Spacewalk-list@redhat.com">Spacewalk-list@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><o:p></o:p> </div> </div> </div> </body> </html>