This document discusses single sign-on (SSO) capabilities for Foreman using Keycloak. It provides an introduction to Foreman and its authentication methods. OpenID Connect and JSON Web Tokens (JWTs) are explained as the standards that enable SSO. The document demonstrates how to configure Foreman as a client in Keycloak to enable SSO, including registering Foreman and adding user mappers. It concludes with a demo and information on resources for using Foreman and Keycloak together.

1. Foreman Single Sign-On
Made Easy with Keycloak
Nikhil Kathole
1

2. About me
Who am I ?
Quality Engineer @ Red Hat
Satellite 6 QE
Follow me:
Twitter: @NikhilKathole1
Github: ntkathole
2

3. Agenda
What we’re going to cover (quickly)
1. Introduction to Foreman
2. Foreman Authentication Capabilities
3. OpenID Connect
4. Single Sign On with Keycloak
5. Demo - Foreman Integration with Keycloak
6. Q & A
3

4. Foreman
Managing the Lifecycle of your Systems
4

5. Foreman Plugins
1. Choose the environment as per specific needs
2. Plugins offer custom features and maximize the flexibility
Extend and modify the Foreman
5

6. Foreman Plugins
Huge ecosystem of plugins
6

7. Foreman Authentication Capabilities
Internal/FreeIPA/AD
1. User management is a repeated need across projects
2. Native implementations
a. Internal users
b. LDAP authentication
c. Kerberos based SSO
7

8. Login Workflows
Internal User login
8
Browser

9. Login Workflows
FreeIPA User login
9
Browser

10. Login Workflows
Active Directory User login
10
Browser

11. Login Workflows
FreeIPA-AD Forest
11
Browser
Trust

12. 12
Delegate your security

13. Single Sign On
13
1. Redirect all the things
2. Authenticate all the things
3. Multiple applications - login once

14. What is Keycloak ?
1. Open Source Project
2. Identity and Access Management
3. A java app
4. Wide variety of user management use cases
14

15. OpenID Connect
1. Making simple things simple and complicated things possible
2. Internet Standard for Single Sign On
a. Need to authenticate the user?
b. Send user to their OpenID provider
c. Get identity token back
3. Uses simple JSON Web Tokens
15

16. JWT (JSON Web Token)
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJrNkp3Ymt
HOTNsQThaM01yTFkwIn0.eyJqdGkiOiJkN2Y1MmQyZS0yMDk3L
TQwNDEtOWM4NC1jMzQ5ZDdmNWZjNzUiLCJleHAiOjE1Nzk0M
zE4NDIsIm5iZiI6MCwiaWF0IjoxNTc5NDMxNzgyLZF91c2VybmFtZ
SI6InRlc3QiLCJnaXZlbl9uYW1lIjoidGVzdDEiLCJmYZ0kcmoLs9JH
k43xkz_byJtenKpqwrNNDTF3UHsxn4I8doBW1pbHlfbmFtZSI6InRl
c3QyIiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.NZ_TDotrL4Nyi1
cEGlDs5KDBlml8urlKBvk5R9hXkLJXzgseqpMKtsGQPCOC7jzmjw
16

17. JWT (JSON Web Token)
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJrNkp3Ymt
HOTNsQThaM01yTFkwIn0.eyJqdGkiOiJkN2Y1MmQyZS0yMDk3L
TQwNDEtOWM4NC1jMzQ5ZDdmNWZjNzUiLCJleHAiOjE1Nzk0M
zE4NDIsIm5iZiI6MCwiaWF0IjoxNTc5NDMxNzgyLZF91c2VybmFtZ
SI6InRlc3QiLCJnaXZlbl9uYW1lIjoidGVzdDEiLCJmYZ0kcmoLs9JH
k43xkz_byJtenKpqwrNNDTF3UHsxn4I8doBW1pbHlfbmFtZSI6InRl
c3QyIiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.NZ_TDotrL4Nyi1
cEGlDs5KDBlml8urlKBvk5R9hXkLJXzgseqpMKtsGQPCOC7jzmjw
17

18. JWT (JSON Web Token)
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJrNkp3Ymt
HOTNsQThaM01yTFkwIn0.eyJqdGkiOiJkN2Y1MmQyZS0yMDk3L
TQwNDEtOWM4NC1jMzQ5ZDdmNWZjNzUiLCJleHAiOjE1Nzk0M
zE4NDIsIm5iZiI6MCwiaWF0IjoxNTc5NDMxNzgyLZF91c2VybmFtZ
SI6InRlc3QiLCJnaXZlbl9uYW1lIjoidGVzdDEiLCJmYZ0kcmoLs9JH
k43xkz_byJtenKpqwrNNDTF3UHsxn4I8doBW1pbHlfbmFtZSI6InRl
c3QyIiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.NZ_TDotrL4Nyi1
cEGlDs5KDBlml8urlKBvk5R9hXkLJXzgseqpMKtsGQPCOC7jzmjw
18
Header
{
"alg": "RS256",
"typ": "JWT",
}

19. JWT (JSON Web Token)
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJrNkp3Ymt
HOTNsQThaM01yTFkwIn0.eyJqdGkiOiJkN2Y1MmQyZS0yMDk3L
TQwNDEtOWM4NC1jMzQ5ZDdmNWZjNzUiLCJleHAiOjE1Nzk0M
zE4NDIsIm5iZiI6MCwiaWF0IjoxNTc5NDMxNzgyLZF91c2VybmFtZ
SI6InRlc3QiLCJnaXZlbl9uYW1lIjoidGVzdDEiLCJmYZ0kcmoLs9JH
k43xkz_byJtenKpqwrNNDTF3UHsxn4I8doBW1pbHlfbmFtZSI6InRl
c3QyIiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.NZ_TDotrL4Nyi1
cEGlDs5KDBlml8urlKBvk5R9hXkLJXzgseqpMKtsGQPCOC7jzmjw
19
Payload Data
{
"jti": "d7f52d2e-2097-4041-9c84-c349d7f5fc75",
"exp": 1579431842,
"iat": 1579431782,
"iss": "https://keycloak.example.com/auth/realms/ssl-realm",
"aud": [
"foreman.example.com-foreman-openidc",
"broker",
"account"
],
"sub": "5097d158-6638-43b8-8c76-daade8673ed6",
"typ": "Bearer",
"name": "test1 test2",
"groups": [DevConfCZ],
"preferred_username": "test",
"given_name": "test1",
"family_name": "test2",
"email": "test@test.com"
}

20. JWT (JSON Web Token)
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJrNkp3Ymt
HOTNsQThaM01yTFkwIn0.eyJqdGkiOiJkN2Y1MmQyZS0yMDk3L
TQwNDEtOWM4NC1jMzQ5ZDdmNWZjNzUiLCJleHAiOjE1Nzk0M
zE4NDIsIm5iZiI6MCwiaWF0IjoxNTc5NDMxNzgyLZF91c2VybmFtZ
SI6InRlc3QiLCJnaXZlbl9uYW1lIjoidGVzdDEiLCJmYZ0kcmoLs9JH
k43xkz_byJtenKpqwrNNDTF3UHsxn4I8doBW1pbHlfbmFtZSI6InRl
c3QyIiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.NZ_TDotrL4Nyi1
cEGlDs5KDBlml8urlKBvk5R9hXkLJXzgseqpMKtsGQPCOC7jzmjw
20
Signature

21. JWT Payload Data
1. Who you are
2. What you can do (groups, roles..)
3. No registration is needed in Foreman
21

22. Single Sign On in Foreman
With Keycloak
1. Register Foreman as client to Keycloak
a. Install mod_auth_openidc and keycloak-httpd-client-install
b. keycloak-httpd-client-install --app-name foreman-openidc
--keycloak-server-url "{{ KEYCLOAK_URL }}"
--keycloak-admin-username "{{ KEYCLOAK_USER }}"
--keycloak-realm "{{ KEYCLOAK_REALM }}"
--keycloak-admin-realm master
--keycloak-auth-role root-admin -t openidc -l /users/extlogin
22

23. Single Sign On in Foreman
With Keycloak
2. Add mappers to client
a. Group Membership Mapper
b. Audience Mapper
3. Configure Foreman settings
23

24. 24
Demo

25. Single Sign On in Foreman
With Keycloak
25

26. Single Sign On in Foreman
With Keycloak
● Foreman is responsible for
○ Validate the token
○ Authorize the user based on payload
○ Map roles and permissions
26

27. Simple and “more” secure
1. Password goes to Identity provider
2. End application doesn’t have your password
3. Token has short expiry
4. Centralized authentication with Keycloak
5. Less work on the back end and reduced risk
27

28. Resources
● Visit us http://theforeman.org/
● If you do something cool with Foreman, let us know!
● Find us:
− IRC: irc.freenode.net
● #theforeman
● #theforeman-dev
− Reach out to us at
● https://community.theforeman.org/
28

29. Q & A
Nikhil Kathole
@NikhilKathole1
29

30. THANK YOU!
Nikhil Kathole
@NikhilKathole1
30