Kerberos-based authentication #312

adamruzicka · 2025-11-20T16:44:42Z

Very rough draft at the moment, but the happy path seems to work.

Borrows ideas from theforeman/puppet-foreman#1172 and theforeman/puppet-foreman#1203

TODOs:

test on a fresh machine not tainted by previous attempts
test hammer part - in theory this could deprecate section 3.4 and step 2 in section 3.5
check that it can be turned off
- ipa users can't log in anymore
- httpd modules are not loaded (packages are left installed though)
- sssd config remains modified - the modifications are done in a way we can't easily undo
check that it doesn't stomp over user modifications suggested by docs
- ipv6 only in step 2, section 3.2
- AD integration section 3.8
check that pam service override still works in section 3.3

adamruzicka · 2025-11-20T16:45:54Z

src/playbooks/deploy/metadata.obsah.yaml

+  ipa_manage_sssd:
+    help: Whether to manage SSSD service and configuration for IPA authentication
+    action: store_true
+  pam_service:
+    help: Name of the PAM service to use for IPA authentication
+  gssapi_local_name:
+    help: Whether to use the local name for GSSAPI authentication
+    action: store_true


Do we want to explicitly expose those or leave EXTRA_VARS as the only option for overriding those?

It's currently exposed in the Puppet-based installer, but not documented in our docs, so I'd err on the side of leaving it out, but I also don't recall when this is needed.

but I also don't recall when this is needed

The original redmine which introduced it says it might be useful to workaround bugs like https://bugzilla.redhat.com/show_bug.cgi?id=1787630 . Let's not expose it for the time being

src/roles/httpd/defaults/main.yml

src/playbooks/deploy/metadata.obsah.yaml

adamruzicka · 2025-11-20T16:48:22Z

src/roles/httpd/tasks/main.yml

+        cmd: |
+          KRB5CCNAME=KEYRING:session:get-http-service-keytab kinit -k || true
+          KRB5CCNAME=KEYRING:session:get-http-service-keytab /usr/sbin/ipa-getkeytab -k {{ httpd_ipa_keytab }} -p HTTP/{{ ansible_facts['fqdn'] }}
+          kdestroy -c KEYRING:session:get-http-service-keytab || true


This could be probably broken into several individual single-command tasks, but I'm not sure if it's worth it

evgeni · 2025-11-21T12:32:09Z

src/playbooks/deploy/metadata.obsah.yaml

+      - ipa
+      - ipa_with_api


What is the difference between the two? ipa is UI only, while ipa_with_api does UI and API?

And to extend that, later we can add other methods here, like oidc etc?

ipa is UI only, while ipa_with_api does UI and API?

exactly

later we can add other methods here, like oidc etc?

Yes, that was the intent here

and those are mutually exclusive, right? as in, there can be only one external auth?

(LDAP probably always works, but that's not terminated on the httpd level)

Correct. I wanted to avoid the situation we had in the old installer where all the methods could be enabled individually, but some conflicted with others.

src/roles/httpd/tasks/sssd.yml

evgeni · 2025-11-21T13:01:54Z

src/playbooks/deploy/metadata.obsah.yaml

+  pam_service:
+    help: Name of the PAM service to use for IPA authentication


as there is no foreman user on the new host, one needs to pass something else here?

There is no foreman user, but as part of this we deploy a configuration for a foreman pam service, which seems to be enough.

Interesting!

evgeni · 2025-11-21T13:05:14Z

While I am not a fan of adding another non-containerized service (sssd), I guess that's the only way to make it work right now.

As such this looks like the right way to me

adamruzicka · 2025-11-21T15:22:25Z

src/roles/httpd/tasks/external_auth/ipa.yml

+- name: Create PAM service file for IPA authentication
+  ansible.builtin.template:
+    src: pam_service.j2
+    dest: "/etc/pam.d/{{ httpd_ipa_pam_service }}"
+    mode: "0644"
+


In theory this is not needed if httpd_ipa_pam_service != foreman

But when is it not foreman?

Then the service either needs to be defined manually by the user as a yet another pam service or it has to be the name of a user-created HBAC service in ipa

Edit: in either case, deploying our custom service config shouldn't be needed, but also doesn't really hurt anything

src/playbooks/setup-hammer/metadata.obsah.yaml

evgeni · 2025-11-24T10:30:30Z

docs/parameters.md

+| `--foreman-ipa-authentication` | Enable configuration for external authentication via IPA for web UI | `--external-authentication=ipa` |
+| `--foreman-ipa-authentication-api` | Enable configuration for external authentication via IPA for web UI and API | `--external-authentication=ipa_with_api` |
+| `--pam-service` | PAM service used for host-based access control in IPA | `--foreman-pam-service` |


you have the columns the wrong way round, the last column is the "old version", the first is "this is how it's done now"

I'd also probably fold the two "authentication" ones into one line, given the difference is minimal (and just explain it in the description)

evgeni · 2025-11-24T11:12:55Z

Ansible/structure wise this is fine.

I think it should get a short reference to https://docs.theforeman.org/3.16/Configuring_User_Authentication/index-katello.html#enrolling-foreman-server-in-freeipa-domain as in "this is how you need to prepare you machine for this to work".

And then someone who knows Krb should verify this actually works fine (which I did not)

lhellebr · 2025-12-10T12:59:04Z

The correct workflow here is to do exactly what documentation says currently (Chapter 3. Configuring Kerberos SSO with Identity Management in Satellite) but in the satellite-installer step, run the foremanctl instead?

adamruzicka · 2025-12-11T11:17:32Z

Yes, although the options don't map one to one between the installer and foremanctl. See docs/parameters.md for details on how they translate.

lhellebr · 2025-12-11T12:14:37Z

Thanks, @adamruzicka , I have successfully verified that this basically works with IDM in UI, using both user/pass and kinit. There's more to do but it looks good.
Question, is there a way to reverse the setting, that is, disable IDM/AD/Kerberos auth? There was --reset-foreman-ipa-authentication in the classical installer. Is it --reset-external-authnetication? I can't see it in this PR but it's in the --help, so is it something more general that also works in this case?

adamruzicka · 2025-12-11T12:21:38Z

--reset-external-authnetication should work to some extent. The external authentication will be disabled, some of the extra files (like apache configuration drop-ins will be removed), but some things (like sssd config) will remain in the modified state as we can't reasonably know the previous state

lhellebr · 2025-12-11T14:15:27Z

Then it should be documented that this is irreversible and the reset operation leaves the machine in an undefined state. Although I understand it "works" and AFAIK is the same as in classical installer.

lhellebr · 2025-12-12T00:10:05Z

Update, it also works with IDM using API. Just AD to do.

ekohl · 2025-12-12T12:18:44Z

When I read https://docs.theforeman.org/3.17/Configuring_User_Authentication/index-katello.html we do document the reset "softly". Not an explicit procedure. IMHO this is something we should change for foremanctl: either have an explicit disable procedure or not at all. In the short term I'm OK with no documented/supported procedure and we can re-evaluate this when there are questions about it.

@aneta-petrova now that we have the new foremanctl docs structure, do you think we could start updating https://docs.theforeman.org/nightly/Configuring_User_Authentication/index-foremanctl-katello.html#configuring-kerberos-sso-with-FreeIPA-in-foreman and prepare the docs PR? It'll be a good way to verify we've covered all the user stories. Ideally I'd like to merge them in tandem.

aneta-petrova · 2025-12-12T12:39:07Z

@aneta-petrova now that we have the new foremanctl docs structure, do you think we could start updating https://docs.theforeman.org/nightly/Configuring_User_Authentication/index-foremanctl-katello.html#configuring-kerberos-sso-with-FreeIPA-in-foreman and prepare the docs PR? It'll be a good way to verify we've covered all the user stories. Ideally I'd like to merge them in tandem.

Sure. Can you create a ticket that we could refine and plan for a future sprint?

lhellebr · 2025-12-15T15:45:11Z

Verified with UPstream + packit on RHEL9. According to documentation, set up {ipa, ipa with api, ad} and tested using {webui, hammer, curl}. In WebUI, I tested both using kinit + browser negotiate and inserting credentials directly to the form. In all cases, I've been able to login except for cases where I used API or Hammer and ipa_with_api wasn't configured - which is correct.

Steps:

have a RHEL machine with RHEL repos enabled
enable foremanctl copr repo and packit repo for this PR
dnf install -y foremanctl
foremanctl deploy --external-authentication {ipa,ipa-with-api} --add-feature hammer (optionally with --pam-service satellite-prod)
login to WebUI using kinit or credentials from the auth source

# foremanctl deploy --help | grep auth
                         [--external-authentication {ipa,ipa_with_api}]
                         [--reset-external-authentication]
  --external-authentication {ipa,ipa_with_api}
                        External authentication method to use
  --reset-external-authentication
                        Reset external_authentication
                        Name of the PAM service to use for IPA authentication

hammer bookmark list # notice that hammer has been setup with sessions and negotiation automatically
curl -k -u : --negotiate -X GET https://$(hostname)/api/v2/users/extlogin --cookie-jar jar
curl -k -X GET https://$(hostname)/api/v2/hosts --cookie jar
foremanctl deploy --reset-external-authentication
Can't login anymore

I've hit an unrelated issue when setting up AD and reported it as [0], it's not a blocker for this PR.
[0] https://issues.redhat.com/browse/SAT-41186

adamruzicka · 2025-12-17T14:00:57Z

2025-12-17 13:45:55.118 logging.py        INFO   tar: foremanctl-1.0.0-127-g8380644/build/collections/foremanctl/ansible_collections/community/general/tests/unit/plugins/modules/interfaces_file/interfaces_file_fixtures/golden_output/no_leading_spaces_set_aggi_and_eth0_mtu.exceptions.txt.license: file name is too long (cannot be split); not dumped
2025-12-17 13:45:55.118 logging.py        INFO   tar: foremanctl-1.0.0-127-g8380644/build/collections/foremanctl/ansible_collections/community/general/tests/unit/plugins/modules/interfaces_file/interfaces_file_fixtures/golden_output/no_leading_spaces_add_and_delete_aggi_up.exceptions.txt.license: file name is too long (cannot be split); not dumped
2025-12-17 13:45:55.163 logging.py        INFO   tar: Exiting with failure status due to previous errors
2025-12-17 13:45:55.163 logging.py        INFO   make: *** [Makefile:9: foremanctl-1.0.0-127-g8380644.tar.gz] Error 2
2025-12-17 13:45:55.164 commands.py       ERROR  Command 'make dist' failed.

Uhh, what?

adamruzicka · 2025-12-17T14:37:58Z

Now based on top of #362

lhellebr · 2025-12-17T16:48:18Z

QA ACK

aneta-petrova · 2026-01-15T12:56:47Z

theforeman/foreman-documentation#4543 has received all the necessary acks and is ready to be merged after this PR is merged.

adamruzicka commented Nov 20, 2025

View reviewed changes

adamruzicka force-pushed the external-auth branch 7 times, most recently from 265bc56 to 80a3bcd Compare November 21, 2025 11:53

evgeni reviewed Nov 21, 2025

View reviewed changes

src/roles/httpd/tasks/sssd.yml Outdated Show resolved Hide resolved

evgeni reviewed Nov 21, 2025

View reviewed changes

adamruzicka commented Nov 21, 2025

View reviewed changes

src/playbooks/setup-hammer/metadata.obsah.yaml Outdated Show resolved Hide resolved

adamruzicka marked this pull request as ready for review November 24, 2025 09:47

evgeni reviewed Nov 24, 2025

View reviewed changes

adamruzicka force-pushed the external-auth branch 2 times, most recently from bdf0d0f to 9da9011 Compare November 24, 2025 12:56

adamruzicka force-pushed the external-auth branch 5 times, most recently from ec99bdc to bcddb3a Compare December 4, 2025 14:14

lhellebr approved these changes Dec 15, 2025

View reviewed changes

aneta-petrova mentioned this pull request Dec 16, 2025

Update Kerberos SSO documentation for foremanctl theforeman/foreman-documentation#4543

Open

8 tasks

adamruzicka force-pushed the external-auth branch 2 times, most recently from dccf29c to 77db6fc Compare December 17, 2025 14:19

exclude collection tests from the tarball

73c02d2

adamruzicka mentioned this pull request Dec 17, 2025

exclude collection tests from the tarball #362

Merged

adamruzicka added 12 commits December 17, 2025 15:37

Kerberos-based authentication

c3eae31

Reorganize things

0ebcb23

Kerberos support in hammer

81c85ff

Saner ifp service handling

0332563

Do not expose ipa_manage_sssd and gssapi_local_name

c8f68e2

Move parameters to mapped

2c204d2

ini lookup shenanigans

9ed48d9

s/kerberos_auth_enabled/enable_kerberos_authentication

4912a18

Polish parameters

126629b

Also configure for non-ssl vhost

19b310a

Derive hammer kerberos settings from external authentication

735a3ce

Rename pam service option

4979f6c

adamruzicka force-pushed the external-auth branch from d19e648 to 4979f6c Compare December 17, 2025 14:37

Some notes on external auth

9b015c6

adamruzicka force-pushed the external-auth branch from 5e2d958 to 9b015c6 Compare December 18, 2025 16:48

		pam_service:
		help: Name of the PAM service to use for IPA authentication

Kerberos-based authentication #312

Are you sure you want to change the base?

Kerberos-based authentication #312

Conversation

adamruzicka commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamruzicka Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Nov 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamruzicka Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Nov 24, 2025

Uh oh!

lhellebr commented Dec 10, 2025

Uh oh!

adamruzicka commented Dec 11, 2025

Uh oh!

lhellebr commented Dec 11, 2025

Uh oh!

adamruzicka commented Dec 11, 2025

Uh oh!

lhellebr commented Dec 11, 2025

Uh oh!

lhellebr commented Dec 12, 2025

Uh oh!

ekohl commented Dec 12, 2025

Uh oh!

aneta-petrova commented Dec 12, 2025

Uh oh!

lhellebr commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adamruzicka commented Dec 17, 2025

Uh oh!

adamruzicka commented Dec 17, 2025

adamruzicka commented Nov 20, 2025 •

edited

Loading

evgeni Nov 21, 2025 •

edited

Loading

adamruzicka Nov 21, 2025 •

edited

Loading

adamruzicka Nov 24, 2025 •

edited

Loading

lhellebr commented Dec 15, 2025 •

edited

Loading