docker run --name freeipa-server-container -it \ -h server.freeipa.local -e PASSWORD=YOUR_PASSWORD \ -v /sys/fs/cgroup:/sys/fs/cgroup:ro \ -v /var/lib/ipa-data:/data:Z adelton/freeipa-server
SSSD and FreeIPA/IdM integration
Keycloak also comes with a built-in SSSD (System Security Services Daemon) plugin. SSSD is part of the latest Fedora or Red Hat Enterprise Linux and provides access to multiple identity and authentication providers. Plus, some benefits like failover, offline support, and more. Have a look at the docs for all the configuration options and more detailed explanation.
Besides all the features mentioned, SSSD also has a very smooth integration with FreeIPA/IdM server providing authentication and access control. On Keycloak, we benefit from this integration authenticating against PAM services and retrieving user’s data from SSSD.
Most of the communication between Keycloak and SSSD happens through read-only D-Bus interfaces. For this reason, the only way to provision and update users is changing it at FreeIPA/IdM admin’s interface. By default, it is set up only to import username, e-mail, first name, and last name — just like the LDAP federation provider.
|Groups and roles and automatically registered, but not synchronized, so any changes made by the Keycloak administrator directly in Keycloak is not synchronized with SSSD.|
Because it’s easy to forget some configuration detail, let’s go through some steps, to make sure that everything is alright.
Running a FreeIPA server with Docker takes a single command:
server.freeipa.local represents the FreeIPA/IdM server hostname. Please, make sure to change
YOUR_PASSWORD to one of your choice.
After container startup, change
This is more convenient, otherwise would be necessary to setup a DNS server.
In order to have the SSSD federation provider up and running on Keycloak we have to enroll our Linux machine into the IPA domain.
ipa-client-install --mkhomedir -p admin -w password
To make sure that everything is working like expected, on the client machine, try to run:
You should be prompted for the password. After that, you may be able to add users to the IPA server:
$ ipa user-add john --first=John --last=Smith --email@example.com --phone=042424242 --street="Testing street" \ --city="Testing city" --state="Testing State" --postalcode=0000000000
SSSD and D-Bus
As mentioned before, the federation provider gets the data from SSSD via D-BUS and authentication happens using PAM.
All you have to is to run the provisioning script available at Keycloak distribution.
This script do the proper changes to
[domain/your-hostname.local] ... ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber ... [sssd] services = nss, sudo, pam, ssh, ifp ... [ifp] allowed_uids = root, yourOSUsername user_attributes = +mail, +telephoneNumber, +givenname, +sn
keycloak file will be included under
auth required pam_sss.so account required pam_sss.so
Check if everything is working as expected by running
sudo dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:john
You should be able to see user’s group. If this command returned a timeout or an error, it means that the federation provider also won’t be able to retrieve anything on Keycloak.
Most of the time it happens because the machine was not enrolled to FreeIPA/IdM server or you are not allowed to access SSSD service.
If you don’t have permission, please make sure that the user running Keycloak, was included at
[ifp] allowed_uids = root, your_username
Enabling SSSD Federation Provider
Keycloak uses DBus-Java under the covers to communicate at a low level with D-Bus which depends on Unix Sockets Library.
There’s an RPM for this library here. Before installing it, make sure to check the RPM signature:
$ rpm -K libunix-dbus-java-0.8.0-1.fc24.x86_64.rpm libunix-dbus-java-0.8.0-1.fc24.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 84dc9914: OK Header SHA1 digest: OK (d17bb7ebaa7a5304c1856ee4357c8ba4ec9c0b89) V4 RSA/SHA256 Signature, key ID 84dc9914: OK MD5 digest: OK (770c2e68d052cb4a4473e1e9fd8818cf) $ sudo yum install libunix-dbus-java-0.8.0-1.fc24.x86_64.rpm
For authentication with PAM Keycloak uses JNA under the covers. Please make ensure you have this package installed:
$ sudo yum install jna
After the installation, all you have to do is to configure a federated SSSD store, go to the Admin Console. Click on the User Federation left menu option. When you get to this page there is an Add Provider select box. You should see
sssd within this list. Selecting
sssd will bring you to the
sssd configuration page and save it.
Now you should be able to authenticate against Keycloak using FreeIPA/IdM credentials.