Authentication, LDAP & SSO
Relevant source files
The following files were used as context for generating this wiki page:
The Authentication system provides a pluggable framework for validating user identities and managing resource credentials. It supports multiple modes including internal database authentication, LDAP-based validation, and External HTTPD/Single Sign-On (SSO) integrations. The system handles both the validation of users logging into the appliance and the management of credentials used by the appliance to communicate with providers, hosts, and other managed resources.
Sources: app/models/authenticator/base.rb, app/models/authentication.rb
Authentication Architecture
The system is built on a base Authenticator class that defines the workflow for identifying and authorizing users. Specific implementations like LDAP and HTTPD inherit from this base to provide specialized logic.
Core Authentication Flow
When a user attempts to authenticate, the system follows a sequence of normalization, validation, and authorization. If external roles are enabled, the system can automatically assign ManageIQ groups based on external group memberships.
Key Classes and Mixins
| Component | Responsibility |
|---|---|
Authenticator::Base | Defines the abstract template for authentication, audit logging, and task queuing. |
Authenticator::Httpd | Implements SSO by extracting user details from Apache/HTTP server headers. |
Authentication | An ActiveRecord model that stores credentials (passwords, keys) for managed resources. |
AuthenticationMixin | Provides models (like Hosts or EMS) with the ability to manage and check multiple credential types. |
Sources: app/models/authenticator/base.rb, app/models/authentication.rb, app/models/mixins/authentication_mixin.rb
LDAP and SSSD Configuration
The system integrates with SSSD (System Security Services Daemon) and Apache to support LDAP authentication and SSO. Configuration tools manage the underlying system files required for these integrations.
Apache Configuration for SSO
The MiqConfigSssdLdap::ConfigureApache class manages the setup of Apache configuration files and PAM (Pluggable Authentication Modules) to enable external authentication.
- Files Managed:
/etc/pam.d/httpd-auth: PAM configuration for HTTP authentication.manageiq-remote-user.conf: Apache configuration for passing the remote user.manageiq-external-auth.conf: ERP-generated configuration for Kerberos or GSSAPI realms.
Sources: tools/miq_config_sssd_ldap/configure_apache.rb:10-35
LDAP Authentication logic
In LDAP mode, the system performs a bind operation to the LDAP server. If ldap_role is enabled, the system fetches user memberships and matches them against internal ManageIQ group descriptions.
External HTTPD & SSO (SSO)
The Authenticator::Httpd implementation relies on the web server (typically Apache with SSSD) to perform the primary authentication. ManageIQ then consumes identity information passed via HTTP headers.
Identity Extraction
The system extracts user attributes from the following headers:
X-REMOTE-USER: The primary identifier.X-REMOTE-USER-FULLNAME,X-REMOTE-USER-FIRSTNAME,X-REMOTE-USER-LASTNAME.X-REMOTE-USER-EMAIL,X-REMOTE-USER-DOMAIN.X-REMOTE-USER-GROUPS: A delimited list of group memberships.
Sources: app/models/authenticator/httpd.rb:116-135
SSO User Lookup Logic
The HTTPD authenticator uses a multi-step lookup to find existing users or initialize new ones based on headers:
- UPN Lookup: Formats the username and domain into a User Principal Name (e.g.,
user@domain.com). - DN Lookup: Searches for the user as a Distinguished Name (e.g.,
cn=user,dc=domain,dc=com). - Username Lookup: Case-insensitive search by simple username.
Sources: app/models/authenticator/httpd.rb:69-80
Resource Credentials Management
Beyond user logins, the system manages Authentication records associated with resources like ExtManagementSystem (EMS) or Host.
Credential Status Types
The system tracks the validity of credentials using statuses defined in the Authentication model.
| Status | Severity | Description |
|---|---|---|
Valid | 0 | Validation was successful; credentials are correct. |
Incomplete | 1 | Required fields (like userid) are missing. |
Unreachable | 2 | Communication error with the remote resource. |
Error | 2 | Unpredictable or unexpected error during validation. |
Invalid | 3 | Authentication failed (bad username/password). |
Sources: app/models/authentication.rb:39-50
Password Handling and Encryption
ManageIQ automatically encrypts sensitive fields in the authentications table and settings files.
- Encrypted Columns:
password,auth_key,auth_key_password,become_password,service_account. - Automation: The
AuthenticationMixinprovidesupdate_authenticationwhich handles the encryption and saving of these credentials automatically.
Sources: app/models/authentication.rb:22-26, app/models/mixins/authentication_mixin.rb:146-200
Summary
ManageIQ provides a robust, multi-layered authentication system. User identity can be managed locally in the database, delegated to LDAP servers, or integrated with external SSO providers via Apache/SSO. For resource management, the system provides a comprehensive credential lifecycle, including secure storage, status tracking, and automated validation checks via the AuthenticationMixin.