Administering Foreman

To install PostgreSQL, enter the following command:

# dnf install postgresql-server postgresql-evr

To initialize PostgreSQL, enter the following command:

# postgresql-setup initdb

Edit the /var/lib/pgsql/data/postgresql.conf file:

# vi /var/lib/pgsql/data/postgresql.conf

Remove the # and edit to listen to inbound connections:

listen_addresses = '*'

Edit the /var/lib/pgsql/data/pg_hba.conf file:

# vi /var/lib/pgsql/data/pg_hba.conf

Add the following line to the file:

  host  all   all   Foreman_ip/24   md5

To start, and enable PostgreSQL service, enter the following commands:

# systemctl start postgresql
# systemctl enable postgresql

Open the postgresql port on the external PostgreSQL server:

# firewall-cmd --add-service=postgresql
# firewall-cmd --runtime-to-permanent

Switch to the postgres user and start the PostgreSQL client:

$ su - postgres -c psql

Create three databases and dedicated roles: one for Foreman, one for Candlepin, and one for Pulp:

CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
CREATE DATABASE foreman OWNER foreman;
CREATE DATABASE candlepin OWNER candlepin;
CREATE DATABASE pulpcore OWNER pulp;

Exit the postgres user:

# \q

From Foreman server, test that you can access the database. If the connection succeeds, the commands return 1.

# PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
# PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
# PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

To install PostgreSQL, enter the following command:

# yum install rh-postgresql12-postgresql-server \
rh-postgresql12-syspaths \
rh-postgresql12-postgresql-evr

To initialize PostgreSQL, enter the following command:

# postgresql-setup initdb

Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf file:

# vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf

Remove the # and edit to listen to inbound connections:

listen_addresses = '*'

Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf file:

# vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf

Add the following line to the file:

  host  all   all   Foreman_ip/24   md5

To start, and enable PostgreSQL service, enter the following commands:

# systemctl start postgresql
# systemctl enable postgresql

Open the postgresql port on the external PostgreSQL server:

# firewall-cmd --add-service=postgresql
# firewall-cmd --runtime-to-permanent

Switch to the postgres user and start the PostgreSQL client:

$ su - postgres -c psql

Create three databases and dedicated roles: one for Foreman, one for Candlepin, and one for Pulp:

CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
CREATE DATABASE foreman OWNER foreman;
CREATE DATABASE candlepin OWNER candlepin;
CREATE DATABASE pulpcore OWNER pulp;

Exit the postgres user:

# \q

From Foreman server, test that you can access the database. If the connection succeeds, the commands return 1.

# PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
# PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
# PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

In the Foreman web UI, navigate to Administer > Users.

Click Create User.

In the Login field, enter a username for the user.

In the Firstname and Lastname fields, enter the real first name and last name of the user.

In the Mail field, enter the user’s email address.

In the Description field, add a description of the new user.

Select a specific language for the user from the Language list.

Select a timezone for the user from the Timezone list.

Set a password for the user:

Click Submit to create the user.

In the Foreman web UI, navigate to Administer > Users.

Click the username of the user to be assigned one or more roles.

Click the Locations tab, and select a location if none is assigned.

Click the Organizations tab, and check that an organization is assigned.

Click the Roles tab to display the list of available roles.

Select the roles to assign from the Roles list.

Click Submit.

In the Foreman web UI, navigate to Administer > Users.

To the right of the user that you want to impersonate, from the list in the Actions column, select Impersonate.

You have created a user and assigned roles to them. Note that this user must be authorized internally. For more information, see Creating a User and Assigning Roles to a User.

Log in to your Foreman as admin.

Navigate to Administer > Users and select a user.

On the User tab, set a password. Do not save or communicate this password with others. You can create pseudo-random strings on your console:

# openssl rand -hex 32

Create a Personal Access Token for the user. For more information, see Creating a Personal Access Token.

In the Foreman web UI, navigate to Administer > Users.

From the Username column, click on the username of the required user.

Click on the SSH Keys tab.

In the Foreman web UI, navigate to Administer > Users.

Select a user for which you want to create a Personal Access Token.

On the Personal Access Tokens tab, click Add Personal Access Token.

Enter a Name for you Personal Access Token.

Optional: Select the Expires date to set an expiration date. If you do not set an expiration date, your Personal Access Token will never expire unless revoked.

Click Submit. You now have the Personal Access Token available to you on the Personal Access Tokens tab.

Make an API request to your Foreman server and authenticate with your Personal Access Token:

# curl https://foreman.example.com/api/status --user My_Username:My_Personal_Access_Token

You should receive a response with status 200, for example:

{"foreman_version":"2.5.0","result":"ok","status":200,"version":"3.5.1.10","api_version":2}

In the Foreman web UI, navigate to Administer > Users.

Select a user for which you want to revoke the Personal Access Token.

On the Personal Access Tokens tab, locate the Personal Access Token you want to revoke.

Click Revoke in the Actions column next to the Personal Access Token you want to revoke.

Make an API request to your Foreman server and try to authenticate with the revoked Personal Access Token:

# curl https://foreman.example.com/api/status --user My_Username:My_Personal_Access_Token

You receive the following error message:

{
  "error": {"message":"Unable to authenticate user My_Username"}
}

In the Foreman web UI, navigate to Administer > User Groups.

Click Create User group.

On the User Group tab, specify the name of the new user group and select group members:

On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Admin checkbox to assign all available permissions.

Click Submit.

In the Foreman web UI, navigate to Administer > User Groups.

Click Delete to the right of the user group you want to delete.

In the alert box that appears, click OK to delete a user group.

In the Foreman web UI, navigate to Administer > Roles.

Click Create Role.

Provide a Name for the role.

Click Submit to save your new role.

In the Foreman web UI, navigate to Administer > Roles and select Clone from the drop-down menu to the right of the required role.

Provide a Name for the role.

Click Submit to clone the role.

Click the name of the cloned role and navigate to Filters.

Edit the permissions as required.

Click Submit to save your new role.

In the Foreman web UI, navigate to Administer > Roles.

Select Add Filter from the drop-down list to the right of the required role.

Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.

Click the permissions you want to select from the Permission list.

Depending on the Resource type selected, you can select or deselect the Unlimited and Override checkbox. The Unlimited checkbox is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited checkbox, the Search field activates. In this field you can specify further filtering with use of the Foreman search syntax. For more information, see Granular Permission Filtering. When you enable the Override checkbox, you can add additional locations and organizations to allow the role to access the resource type in the additional locations and organizations; you can also remove an already associated location and organization from the resource type to restrict access.

Click Next.

Click Submit to save changes.

List all available permissions:

# hammer filter available-permissions

Add permissions to a role:

# hammer filter create \
--permission-ids My_Permission_ID_1,My_Permission_ID_2 \
--role My_Role_Name

In the Foreman web UI, navigate to Administer > Roles.

Click Filters to the right of the required role to get to the Filters page.

Ensure that the required packages are installed. Execute the following command on Foreman server:

# yum install foreman-console

Start the Foreman console with the following command:

# foreman-rake console

f = File.open('/tmp/table.html', 'w')

result = Foreman::AccessControl.permissions {|a,b| a.security_block <=> b.security_block}.collect do |p|
      actions = p.actions.collect { |a| "<li>#{a}</li>" }
      "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
end.join("\n")

f.write(result)

Press Ctrl + D to exit the Foreman console. Insert the following text at the first line of /tmp/table.html:

<table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

</table>

Open /tmp/table.html in a web browser to view the table.

In the Foreman web UI, navigate to Administer > Roles.

Select Delete from the drop-down list to the right of the role to be deleted.

In an alert box that appears, click OK to delete the role.

Access the SCAP Security Guide in the package browser.

From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6.

Download the package RPM.

Extract the data-stream file (*-ds.xml) from the RPM. For example:

$ rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm \
| cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
> ssg-rhel-8.6-ds.xml

Upload the data stream to Foreman. For more information, see Uploading Additional SCAP Content.

In the Foreman web UI, navigate to Hosts > Compliance > SCAP contents.

Click Upload New SCAP Content.

Enter a title in the Title text box, such as My SCAP Content.

In Scap File, click Choose file, navigate to the location containing a SCAP data-stream file and click Open.

On the Locations tab, select locations.

On the Organizations tab, select organizations.

Click Submit.

Place the SCAP data-stream file to a directory on your Foreman server, such as /usr/share/xml/scap/my_content/.

Run the following Hammer command on Foreman server:

# hammer scap-content bulk-upload --type directory \
--directory /usr/share/xml/scap/my_content/ \
--location "My_Location" \
--organization "My_Organization"

In the Foreman web UI, navigate to Hosts > Compliance – Tailoring Files and click New Tailoring File.

Enter a name in the Name text box.

Click Choose File, navigate to the location containing the tailoring file and select Open.

Click Submit to upload the chosen tailoring file.

In the Foreman web UI, navigate to Hosts > Compliance – Policies.

Click New Policy or New Compliance Policy.

Select the deployment method: Ansible, Puppet, or Manual. Then click Next.

Enter a name for this policy, a description (optional), then click Next.

Select the SCAP Content and XCCDF Profile to be applied, then click Next.

Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

Select the locations to which to apply the policy, then click Next.

Select the organizations to which to apply the policy, then click Next.

Optional: Select the host groups to which to assign the policy.

Click Submit.

In the Foreman web UI, navigate to Hosts > Compliance – Policies.

In the Actions column of the required policy, click Show Guide or select it from the list.

In the Foreman web UI, navigate to Hosts > Compliance – Policies.

Click the name of the required policy.

Edit the necessary attributes.

Click Submit.

In the Foreman web UI, navigate to Hosts > Compliance – Policies.

In the Actions column of the required policy, select Delete from the list.

Click OK in the confirmation message.

In the Foreman web UI, navigate to Configure > Host Groups.

Click the host group that you want to configure for OpenSCAP reporting.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.

Optional: On the Parameters tab, configure any Ansible variables of the role.

Click Submit to save your changes.

In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.

Optional: On the Parameters tab, configure any Ansible variables of the role.

Click Submit to save your changes.

Click the Hosts breadcrumbs link to navigate back to the host index page.

Select the host or hosts to which you want to add the policy.

Click Select Action.

Select Assign Compliance Policy from the list.

In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

Select the required policy from the list of available policies and click Submit.

Click Select Action.

Select Run all Ansible roles from the list.

In the Foreman web UI, navigate to Configure > Host Groups.

Click the host group that you want to configure for OpenSCAP reporting.

In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.

In the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Puppet ENC tab, add the foreman_scap_client Puppet class.

Optional: Configure any Puppet Class Parameters.

Click Submit to save your changes.

In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Puppet ENC tab, add the foreman_scap_client Puppet class.

Optional: Configure any Puppet Class Parameters.

Click the Hosts breadcrumbs link to navigate back to the host index page.

Select the host or hosts to which you want to add the policy.

Click Select Action.

Select Assign Compliance Policy from the list.

In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

Select the required policy from the list of available policies and click Submit.

In the Foreman web UI, navigate to Hosts > Reports.

Optional: To see a list of available search parameters, click the empty Search field.

Enter the search query in the Search field and click Search. The search query is case insensitive.

In the Foreman web UI, navigate to Hosts > Policies.

In the row of the required policy, navigate to the Actions column and click Dashboard.

In the Foreman web UI, navigate to Hosts > Reports.

In the Reported At column, navigate to the report of the required host and compliance policy, and click the time link.

Foreman displays a simplified list of policy rules with the results of the scan.

Optional: Filter the rules by check result. From the Show log messages dropdown list, select one of the following filters:

Optional: Examine the details of the rule. In the Message column, click the icon next to the name of the rule.

In the row of the required rule, navigate to the Actions column and click Hosts failing this rule.

In the Foreman web UI, navigate to Hosts > Reports to list all compliance reports.

In the row of the required host, navigate to the Actions column and click Full Report to view the complete details of an evaluation report.

Navigate to the Evaluation Characteristics area to review basic details about the evaluation of the host against a specific profile.

Navigate to the Compliance and Scoring area to review evaluation statistics and the host compliance score.

Navigate to the Rule Overview to examine the rules.

Optional: Deselect the check statuses that you want to hide, such as pass, notapplicable, or fixed.

Optional: From the Group rule by dropdown menu, select the criterion for the grouping of rules, such as Severity.

Optional: Enter a search string into the search field to filter rules by title. The search is case insensitive and applied dynamically as you type.

Click the title of a rule to inspect further result details:

In the Foreman web UI, navigate to Hosts > Reports.

In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.

Click OK.

In the Foreman web UI, navigate to Hosts > Reports.

In the Compliance Reports window, select the compliance reports that you want to delete.

In the upper right of the list, select Delete reports.

Repeat these steps for as many pages as you want to delete.

To synchronize an external Smart Proxy, select the relevant organization and location in the Foreman web UI, or choose Any Organization and Any Location.

In the Foreman web UI, navigate to Infrastructure > Smart Proxies and click the name of the Smart Proxy to synchronize.

On the Overview tab, select Synchronize.

Set the logging level in /etc/foreman/settings.yaml:

:logging:
  :production:
    :type: file
    :layout: pattern
    :level: debug

Enable selected loggers in /etc/foreman/settings.yaml:

:loggers:
  :ldap:
    :enabled: true
  :permissions:
    :enabled: true
  :sql:
    :enabled: true

Restart Foreman services:

# foreman-maintain service restart

Add the following line to the [agent] block in the /etc/puppetlabs/puppet/puppet.conf file:

[agent]
    log_level = debug

Add the following line to the [master] block in /etc/puppetlabs/puppet/puppet.conf file:

[master]
    log_level = debug

Restart the Puppet server:

# foreman-maintain service restart --only puppetserver

Obtain the Certificate from the LDAP Server.

Trust the Certificate from the LDAP Server.

Set the Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

# setsebool -P nis_enabled on

In the Foreman web UI, navigate to Administer > Authentication Sources.

Click Create LDAP Authentication Source.

On the LDAP server tab, enter the LDAP server’s name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS checkbox to enable encryption. The port should change to 636, which is the default for LDAPS.

On the Account tab, enter the account information and domain name details. See Description of LDAP Settings for descriptions and examples.

On the Attribute mappings tab, map LDAP attributes to Foreman attributes. You can map login name, first name, last name, email address, and photo attributes. See Example Settings for LDAP Connections for examples.

On the Locations tab, select locations from the left table. Selected locations are assigned to users created from the LDAP authentication source, and available after their first login.

On the Organizations tab, select organizations from the left table. Selected organizations are assigned to users created from the LDAP authentication source, and available after their first login.

Click Submit.

Configure new accounts for LDAP users:

On the FreeIPA server, to authenticate, enter the following command and enter your password when prompted:

# kinit admin

To verify that you have authenticated, enter the following command:

# klist

On the FreeIPA server, create a host entry for Foreman server and generate a one-time password, for example:

# ipa host-add --random hostname

Create an HTTP service for Foreman server, for example:

# ipa service-add HTTP/hostname

On Foreman server, install the IPA client:

# yum install ipa-client

On Foreman server, enter the following command as root to configure FreeIPA-enrollment:

# ipa-client-install --password OTP

If Foreman server is running on Red Hat Enterprise Linux 7, execute the following command:

# subscription-manager repos --enable rhel-7-server-optional-rpms

If Foreman server is running on Debian, ensure that the hostname is set to the fully qualified domain name (FQDN); the short name is not sufficient:

# hostname
foreman.example.com

Set foreman-ipa-authentication to true, using the following command:

# foreman-installer --foreman-ipa-authentication=true

Restart Foreman services:

# foreman-maintain service restart

On the FreeIPA server, to authenticate, enter the following command and enter your password when prompted:

# kinit admin

To verify that you have authenticated, enter the following command:

# klist

Create HBAC service and rule on the FreeIPA server and link them together. The following examples use the PAM service name foreman-prod. Execute the following commands on the FreeIPA server:

# ipa hbacsvc-add foreman-prod
# ipa hbacrule-add allow_foreman_prod
# ipa hbacrule-add-service allow_foreman_prod --hbacsvcs=foreman-prod

Add the user who is to have access to the service foreman-prod, and the hostname of Foreman server:

# ipa hbacrule-add-user allow_foreman_prod --user=username
# ipa hbacrule-add-host allow_foreman_prod --hosts=foreman.example.com

To check the status of the rule, execute:

# ipa hbacrule-find foreman-prod
# ipa hbactest --user=username --host=foreman.example.com --service=foreman-prod

Ensure the allow_all rule is disabled on the FreeIPA server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal.

Configure the FreeIPA integration with Foreman server as described in Configuring FreeIPA Authentication on Foreman server. On Foreman server, define the PAM service as root:

# foreman-installer --foreman-pam-service=foreman-prod

Install the required packages:

# yum install sssd adcli realmd ipa-python-compat krb5-workstation samba-common-tools

Enroll Foreman server with the AD server. You may need to have administrator permissions to perform the following command:

# realm join -v EXAMPLE.ORG --membership-software=samba -U Administrator

Create the /etc/ipa/ directory and the default.conf file:

# mkdir /etc/ipa
# touch /etc/ipa/default.conf

To the default.conf file, add the following content:

[global]
server = unused
realm = EXAMPLE.ORG

Create the /etc/net-keytab.conf file with the following content:

[global]
workgroup = EXAMPLE
realm = EXAMPLE.ORG
kerberos method = system keytab
security = ads

Determine the effective user ID of the Apache user:

# id apache

Create the /etc/gssproxy/00-http.conf file with the following content:

[service/HTTP]
mechs = krb5
cred_store = keytab:/etc/httpd/conf/http.keytab
cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
euid = ID_of_Apache_User

Create a keytab entry:

# KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf
# chown root.apache /etc/httpd/conf/http.keytab
# chmod 640 /etc/httpd/conf/http.keytab

Enable IPA authentication in Foreman:

# foreman-installer --foreman-ipa-authentication=true

Start and enable the gssproxy service:

# systemctl restart gssproxy.service
# systemctl enable gssproxy.service

To configure the Apache server to use the gssproxy service, create a systemd drop-in file and add the following content to it:

# mkdir -p /etc/systemd/system/httpd.service.d/
# vi /etc/systemd/system/httpd.service.d/gssproxy.conf
[Service]
Environment=GSS_USE_PROXY=1

Apply changes to the service:

# systemctl daemon-reload

Start and enable the httpd service:

# systemctl restart httpd.service

Retrieve the Kerberos ticket of the LDAP user, using the following command:

# kinit ldapuser

View the Kerberos ticket, using the following command:

# klist

View output from successful SSO-based authentication, using the following command:

# curl -k -u : --negotiate https://foreman.example.com/users/extlogin

<html><body>You are being <a href="https://foreman.example.com/users/4-ldapuserexample-com/edit">redirected</a>.</body></html>

Enable HBAC:

Configure sssd to transfer additional attributes of AD users.

Users authenticate to Foreman using the Foreman web UI.

Users authenticate to Foreman using the Foreman CLI.

On the Foreman server, install the following packages:

# yum install mod_auth_openidc keycloak-httpd-client-install

Register Foreman to Keycloak as a client. Note that you the registration process for logging in using the web UI and the CLI are different. You can register two clients Foreman clients to Keycloak to be able to log in to Foreman from the web UI and the CLI.

Restart the httpd service:

# systemctl restart httpd

In the Keycloak web UI, navigate to Clients and click the Foreman client.

Configure access type:

In the Valid redirect URI fields, add a valid redirect URI.

Click Save.

Click the Mappers tab and click Create to add an audience mapper.

In the Name field, enter a name for the audience mapper.

From the Mapper Type list, select Audience.

From the Included Client Audience list, select the Foreman client.

Click Save.

Click Create to add a group mapper so that you can specify authorization in Foreman based on group membership.

In the Name field, enter a name for the group mapper.

From the Mapper Type list, select Group Membership.

In the Token Claim Name field, enter groups.

Set the Full group path setting to OFF.

Click Save.

To authenticate to the Foreman CLI using the code grant type, enter the following command:

# hammer auth login oauth \
--two-factor \
--oidc-token-endpoint 'https://Keycloak.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
--oidc-authorization-endpoint 'https://Keycloak.example.com/auth' \
--oidc-client-id 'foreman.example.com-foreman-openidc' \
--oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

To retrieve the success code, navigate to the URL that the command returns and provide the required information.

Copy the success code that the web UI returns.

In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Foreman CLI.

In the Foreman web UI, navigate to Administer > User Groups, and click the Create User Group button.

In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.

Do not add users and user groups to the right-hand columns. Click the Roles tab.

Select the Administer checkbox.

Click the External Groups tab.

Click Add external user group.

In the Name field, enter the name of the Active Directory group.

From the list, select EXTERNAL.

Users authenticate to Foreman using the Foreman web UI.

Users authenticate to Foreman using the Foreman CLI.

On the Foreman server, install the following packages:

# yum install mod_auth_openidc keycloak-httpd-client-install

Register Foreman to Keycloak as a client. Note that you the registration process for logging in using the web UI and the CLI are different. You can register two clients Foreman clients to Keycloak to be able to log in to Foreman from the web UI and the CLI.

Restart the httpd service:

# systemctl restart httpd

In the Keycloak web UI, navigate to Clients and click the Foreman client.

Configure access type:

In the Valid redirect URI fields, add a valid redirect URI.

Click Save.

Click the Mappers tab and click Create to add an audience mapper.

In the Name field, enter a name for the audience mapper.

From the Mapper Type list, select Audience.

From the Included Client Audience list, select the Foreman client.

Click Save.

Click Create to add a group mapper so that you can specify authorization in Foreman based on group membership.

In the Name field, enter a name for the group mapper.

From the Mapper Type list, select Group Membership.

In the Token Claim Name field, enter groups.

Set the Full group path setting to OFF.

Click Save.

In the Keycloak web UI, navigate to the Foreman realm.

Navigate to Authentication, and click the OTP Policy tab.

Ensure that the Supported Applications field includes FreeOTP or Google Authenticator.

Configure the OTP settings to suit your requirements.

Optional: If you want to use TOTP authentication as a default authentication method for all users, click the Flows tab, and to the right of the OTP Form setting, select REQUIRED.

Click the Required Actions tab.

To the right of the Configure OTP row, select the Default Action checkbox.

Log in to Foreman, Foreman redirects you to the Keycloak login screen.

Enter your username and password, and click Log In.

The first attempt to log in, Keycloak requests you to configure your client by scanning the barcode and entering the pin displayed.

After you configure your client and enter a valid PIN, Keycloak redirects you to Foreman and logs you in.

To authenticate to the Foreman CLI using the code grant type, enter the following command:

# hammer auth login oauth \
--two-factor \
--oidc-token-endpoint 'https://Keycloak.example.com/auth/realms/ssl-realm/protocol/openid-connect/token' \
--oidc-authorization-endpoint 'https://Keycloak.example.com/auth' \
--oidc-client-id 'foreman.example.com-foreman-openidc' \
--oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob

To retrieve the success code, navigate to the URL that the command returns and provide the required information.

Copy the success code that the web UI returns.

In the command prompt of hammer auth login oauth, enter the success code to authenticate to the Foreman CLI.

In the Foreman web UI, navigate to Administer > User Groups, and click the Create User Group button.

In the Name field, enter a name for the user group. The name should not be the same as in the Active Directory.

Do not add users and user groups to the right-hand columns. Click the Roles tab.

Select the Administer checkbox.

Click the External Groups tab.

Click Add external user group.

In the Name field, enter the name of the Active Directory group.

From the list, select EXTERNAL.

Users authenticate to Foreman using the Foreman web UI.

Users authenticate to Foreman using the Foreman CLI.

On the Foreman server, install the following packages:

# yum install mod_auth_openidc keycloak-httpd-client-install

Register Foreman to Keycloak as a client. Note that you the registration process for logging in using the web UI and the CLI are different. You can register two clients Foreman clients to Keycloak to be able to log in to Foreman from the web UI and the CLI.

Restart the httpd service:

# systemctl restart httpd

In the Keycloak web UI, navigate to Clients and click the Foreman client.

Configure access type:

In the Valid redirect URI fields, add a valid redirect URI.

Click Save.

Click the Mappers tab and click Create to add an audience mapper.

In the Name field, enter a name for the audience mapper.

From the Mapper Type list, select Audience.

From the Included Client Audience list, select the Foreman client.

Click Save.

Click Create to add a group mapper so that you can specify authorization in Foreman based on group membership.

In the Name field, enter a name for the group mapper.

From the Mapper Type list, select Group Membership.

In the Token Claim Name field, enter groups.

Set the Full group path setting to OFF.

Click Save.

In the Keycloak web UI, navigate to the Authentication tab.

From the Flows list, select Browser.

Click Copy to copy this flow.

In the Copy Authentication Flow window, enter a new name for the flow and click OK.

In the copied flow, delete Username Password Form and OTP Form entries.

Click Add execution.

From the Provider list, select X509/Validate Username Form.

Click Save.

In the X509/Validate Username Form raw, select ALTERNATIVE.

In the X509/Validate Username Form raw, click Actions > Config.

In the Alias field, enter a name for this configuration.

From the User Identity Source list, select Subject’s Common Name,

From the User mapping method list, select Username or Email.

Click Save.

Navigate to Authentication > Bindings.

From the Browser Flow list, select the created flow.

Install required packages:

yum install opensc -y

Install the Firefox browser if not installed.