Red Hat Security: Identity Management and Authentication – Red Hat Learning Subscription Course (RH362LS)

Some topics covered in this course are central management and provisioning of user accounts; design and installation of IdM server topologies; operation of the integrated DNS and TLS Certificate Authority services; management of two-factor authentication, smart card authentication, and operation as a single-sign on provider; integration and management of two-way trusts with Active Directory; and troubleshooting and disaster recovery planning. Registration of Linux clients to IdM and operation in enterprise environments that use both Linux and Microsoft Windows clients and servers is discussed.

RHLS Course Includes:

• 365-Day RHLS Subscription - Full year of access starting from your purchase date. Official Red Hat Training Curriculum - Learn directly from Red Hat’s validated, up-to-date course materials.
• Hands-On Labs (100 Hours per Course) - Build practical, real-world skills through extensive lab time.
• One Certification Exam + Free Retake - Includes exam readiness resources to help you prepare with confidence.
• One Virtual, Instructor-Led Class - Attend a live online class through the Red Hat portal (self-enrollment required using your RHID).

Identity Management (IdM) Topology and Operations Guide

1. IdM Topology Design for Scale and Resiliency

Topology Overview

A resilient IdM deployment follows a multi-master replication model based on 389 Directory Server, avoiding single points of failure while maintaining data consistency across sites.

Design Principles

• Minimum of 2 servers per data center for high availability
• Maximum of 60 replication agreements per server (practical limit ~20 for manageability)
• Use a "hub and spoke" or "fully meshed" topology depending on site count
• Deploy CA-configured servers redundantly (at least 2 CA renewal masters)
• Place hidden replicas for backup/heavy workloads (e.g., reporting, HR system integration)
• Distribute replicas geographically aligned with client density and WAN latency

Recommended Topology Pattern

• Data Center A: 2–3 servers (CA renewal master + CRL master)
• Data Center B: 2–3 servers (replica of CA)
• Regional Sites: Replicas with local DNS/KDC services
• Branch Offices: IdM clients only, using SSSD caching for offline resilience

Replication Considerations

• Use ipa-replica-manage or ipa topologysegment commands to visualize and manage topology
• Avoid replication loops; use a graph with redundancy but limited fan-out
• Monitor replication using ipa-replica-manage list and ipa-healthcheck

Resiliency Features

• SSSD client-side caching allows authentication during server outages
• DNS load balancing via SRV records for KDC/LDAP discovery
• Cross-realm Kerberos trust for AD integration failover
• Hidden replicas absorb load without appearing in DNS SRV records

2. Key Technologies Used by IdM

SSSD (System Security Services Daemon)

• Provides authentication, identity lookup, and caching for local systems
• Talks to IdM/AD via LDAP, Kerberos, and Active Directory protocols
• Enables offline login through local cache
• Configuration file: /etc/sssd/sssd.conf

PAM (Pluggable Authentication Modules)

• Provides the authentication framework used by Linux services
• Integrates with SSSD via pam_sss.so
• Supports 2FA, smart card, and Kerberos-based authentication chains

Kerberos

• Provides secure, ticket-based authentication (KDC embedded in IdM)
• Supports Single Sign-On (SSO) across services
• Uses realms, principals, and keytabs
• Cross-realm trust enables AD authentication interoperability

PKI (Public Key Infrastructure)

• IdM includes an integrated Certificate Authority (Dogtag CA)
• Issues and manages certificates for hosts, services, and users
• Supports certificate renewal, revocation, and OCSP
• Vault service can store and manage secrets/keys

3. Installing IdM Servers, Replicas, and Clients Using Ansible

Prerequisites

• Ansible collection: ansible-freeipa
• Inventory with defined server/replica/client groups

Sample Inventory

[ipaserver]
idm01.example.com

[ipareplicas]
idm02.example.com
idm03.example.com

[ipaclients]
client01.example.com
client02.example.com

Install Server Playbook

- name: Install IdM Server
  hosts: ipaserver
  become: true
  roles:
    - role: ipaserver
      state: present
      ipaserver_setup_dns: true
      ipaserver_setup_ca: true
      ipaadmin_password: "{{ vault_admin_password }}"
      ipadm_password: "{{ vault_dm_password }}"
      ipaserver_realm: EXAMPLE.COM
      ipaserver_domain: example.com

Install Replica Playbook

- name: Install IdM Replica
  hosts: ipareplicas
  become: true
  roles:
    - role: ipareplica
      ipaadmin_password: "{{ vault_admin_password }}"
      ipareplica_setup_ca: true

Install Client Playbook

- name: Install IdM Clients
  hosts: ipaclients
  become: true
  roles:
    - role: ipaclient
      ipaclient_domain: example.com
      ipaclient_realm: EXAMPLE.COM
      ipaadmin_password: "{{ vault_admin_password }}"

4. Managing IdM Services (DNS and CA)

DNS Management

• Create zones: ipa dnszone-add example.com
• Add records: ipa dnsrecord-add example.com host1 --a-rec 192.168.1.10
• Configure forwarders: ipa dnsforwardzone-add

CA Management

• View CA status: ipa-certupdate, getcert list
• Renew certificates automatically via certmonger
• Manage sub-CAs: ipa ca-add
• Backup CA data separately using ipa-backup

5. Configuring and Managing Kerberos Authentication

• Verify realm: klist -kt /etc/krb5.keytab
• Create service principal: ipa service-add HTTP/host.example.com
• Retrieve keytab: ipa-getkeytab -s idm01 -p HTTP/host.example.com -k /etc/httpd/http.keytab
• Configure SSO for web apps using GSSAPI negotiation (mod_auth_gssapi)
• Set password policies: ipa pwpolicy-mod

6. Configuring and Managing TLS Certificates

• Request certificate: ipa cert-request --principal=HTTP/host.example.com request.csr
• Track renewal with certmonger:

  ipa-getcert request 
    -d /etc/pki/tls 
    -n servercert 
    -K HTTP/host.example.com

• List certs: getcert list
• Revoke cert: ipa cert-revoke <serial> --revocation-reason=affiliation_changed

7. Creating and Managing AD Trust Relationships

Establish Trust

ipa-adtrust-install --add-sids
ipa trust-add --type=ad adexample.com --admin Administrator --password

Verify Trust

• ipa trust-show adexample.com
• ipa idrange-find
• getent passwd 'AD\user1'

ID Mapping

• Configure ID ranges for AD SIDs
• Use SSSD for cross-forest group resolution

8. Configuring Secure Authentication (2FA and SSO)

Two-Factor Authentication

• Enable OTP: ipa user-mod user1 --otp=TRUE
• Configure token: ipa otptoken-add --type=totp --owner=user1
• PAM integration automatically enforces OTP challenge

Single Sign-On

• Uses Kerberos ticket-granting system
• Configure browser SSO with SPNEGO
• Web apps use GSSAPI-based Apache modules

9. Configuring Sudo, HBAC, and RBAC Policies

Sudo Rules

ipa sudorule-add webadmins
ipa sudorule-add-user webadmins --users=admin1
ipa sudorule-add-host webadmins --hosts=server1.example.com
ipa sudorule-add-allow-command webadmins --sudocmds="/usr/bin/systemctl"

HBAC (Host-Based Access Control)

ipa hbacrule-add allow_ssh
ipa hbacrule-add-user allow_ssh --users=user1
ipa hbacrule-add-host allow_ssh --hosts=server1.example.com
ipa hbacrule-add-service allow_ssh --hbacsvcs=sshd

RBAC (Role-Based Access Control)

ipa role-add "Helpdesk Operators"
ipa role-add-privilege "Helpdesk Operators" --privileges="User Administrators"
ipa role-add-member "Helpdesk Operators" --users=helpdeskuser

10. Managing Secrets, Vaults, Certificates, and Keys

Vault Operations

ipa vault-add mysecret --type=standard
ipa vault-archive mysecret --in=secretfile.txt
ipa vault-retrieve mysecret --out=retrieved.txt

Certificate and Key Management

• Certificates tracked automatically via certmonger
• Vaults can hold private keys, symmetric secrets, or asymmetric certs
• User, service, and shared vault types available for access control

11. Troubleshooting Identity Management

Common Diagnostic Tools

• ipa-healthcheck — runs full system diagnostics
• journalctl -u sssd and /var/log/sssd/*.log
• klist and kinit -V for Kerberos tickets
• ipa-replica-manage list for replication status
• ldapsearch for directory verification

Common Issues

• Clock skew causing Kerberos failures — use chronyd
• DNS resolution mismatches — verify SRV records
• Replication conflicts — check with ipa-replica-manage list-ruv
• Certificate expiration — inspect via getcert list

12. Integrating Satellite 6 and Ansible Automation Platform with IdM

Satellite 6 Integration

• Configure external authentication source (LDAP/Kerberos via IdM)
• Enable SSO login using Kerberos-based external auth
• Sync host groups and user roles from IdM/AD via LDAP filters

Ansible Automation Platform Integration

• Configure LDAP/Kerberos authentication backend in AAP settings
• Map IdM groups to AAP roles/teams for RBAC enforcement
• Use service principals for secure API authentication
• Automate credential retrieval from IdM Vault for playbook execution

13. Configuring IdM Backup and Recovery

Full Backup

ipa-backup

Creates a complete backup including LDAP data, Kerberos database, and CA data.

Data-Only Backup

ipa-backup --data

Restore Procedure

ipa-restore /var/lib/ipa/backup/ipa-full-2025-01-01-12-00-00

Best Practices

• Schedule regular backups via cron or Ansible
• Store backups securely off-site
• Test restore procedures periodically in a lab environment
• Backup CA renewal master separately due to unique CA private key material