2011-01-20 14:39:59 -06:00
<!DOCTYPE html>
2007-09-24 14:20:34 -05:00
< html >
2008-05-20 08:43:31 -05:00
< head >
2011-01-20 14:39:59 -06:00
< meta charset = "utf-8" >
< title > IPA: Identity Policy Audit< / title >
2013-08-29 08:19:02 -05:00
< script type = "text/javascript" src = "../ui/js/libs/loader.js" > < / script >
2012-10-01 10:36:42 -05:00
< script type = "text/javascript" >
2018-07-12 15:19:04 -05:00
var dojoConfig = {
baseUrl: "../ui/js",
has: {
'dojo-firebug': false,
'dojo-debug-messages': true
},
parseOnLoad: false,
async: true,
packages: [
{
name:'dojo',
location:'dojo'
},
{
name: 'freeipa',
location: 'freeipa'
}
]
};
2013-08-29 08:19:02 -05:00
(function() {
2018-09-24 12:52:37 -05:00
var icons = [
2018-09-26 15:12:55 -05:00
'../ui/favicon.ico'
2018-09-24 12:52:37 -05:00
];
2013-08-29 08:19:02 -05:00
var styles = [
2014-03-31 07:03:28 -05:00
'../ui/css/patternfly.css',
'../ui/css/ipa.css'
2013-08-29 08:19:02 -05:00
];
var scripts = [
2018-07-12 15:19:04 -05:00
'../ui/js/libs/jquery.js',
2018-09-24 12:52:37 -05:00
'../ui/js/libs/jquery.ordered-map.js',
2018-09-26 15:12:55 -05:00
'../ui/js/dojo/dojo.js'
2013-08-29 08:19:02 -05:00
];
2018-07-12 15:19:04 -05:00
ipa_loader.scripts(scripts, function() {
require([
'dojo/dom',
2018-09-24 12:52:37 -05:00
'freeipa/core',
2018-09-26 15:12:55 -05:00
'dojo/domReady!'
2018-09-24 12:52:37 -05:00
],
function(dom) {
var text = require('freeipa/text');
2018-09-26 15:12:55 -05:00
var msg = "".concat(
2018-07-12 15:19:04 -05:00
text.get('@i18n:ssbrowser-page.header'),
text.get('@i18n:ssbrowser-page.firefox-header'),
text.get('@i18n:ssbrowser-page.firefox-actions'),
text.get('@i18n:ssbrowser-page.chrome-header'),
text.get('@i18n:ssbrowser-page.chrome-certificate'),
text.get('@i18n:ssbrowser-page.chrome-spnego'),
text.get('@i18n:ssbrowser-page.ie-header'),
2018-09-26 15:12:55 -05:00
text.get('@i18n:ssbrowser-page.ie-actions')
);
2018-07-12 15:19:04 -05:00
dom.byId('ssbrowser-msg').innerHTML=msg;
});
});
2013-08-29 08:19:02 -05:00
ipa_loader.styles(styles);
2018-09-24 12:52:37 -05:00
ipa_loader.icons(icons);
2013-08-29 08:19:02 -05:00
})();
2012-10-01 10:36:42 -05:00
< / script >
2013-08-29 08:19:02 -05:00
2011-01-20 14:39:59 -06:00
< / head >
2007-09-24 14:20:34 -05:00
2011-10-11 02:42:35 -05:00
< body class = "info-page" >
2011-10-06 07:30:26 -05:00
2014-03-31 07:03:28 -05:00
< nav class = "navbar navbar-default navbar-pf" role = "navigation" >
< div class = "navbar-header" >
< a class = "brand" href = "../ui/index.html" > < img src = "../ui/images/header-logo.png" alt = "FreeIPA" > < / a >
< / div >
< / nav >
2011-10-06 07:30:26 -05:00
2014-03-31 07:03:28 -05:00
< div class = "container-fluid" >
< div class = "row" >
< div class = "col-sm-12" >
2018-07-12 15:19:04 -05:00
< div class = "ssbrowser" id = "ssbrowser-msg" >
< noscript >
2014-03-31 07:03:28 -05:00
< h1 > Browser Kerberos Setup< / h1 >
2011-10-06 07:30:26 -05:00
2015-07-17 08:57:30 -05:00
< h2 > Firefox< / h2 >
2011-10-06 07:30:26 -05:00
2014-03-31 07:03:28 -05:00
< p >
You can configure Firefox to use Kerberos for Single Sign-on. The following instructions will guide you in configuring your web browser to send your Kerberos credentials to the appropriate Key Distribution Center which enables Single Sign-on.
< / p >
2011-10-06 07:30:26 -05:00
2014-03-31 07:03:28 -05:00
< ol >
2015-10-27 09:36:55 -05:00
< li >
2017-09-01 14:50:44 -05:00
< p >
< a href = "ca.crt" id = "ca-link" class = "btn btn-default" > Import Certificate Authority certificate< / a >
< / p >
< p >
Make sure you select < b > all three< / b > checkboxes.
< / p >
2015-10-27 09:36:55 -05:00
< / li >
2014-03-31 07:03:28 -05:00
< li >
In the address bar of Firefox, type < code > about:config< / code > to display the list of current configuration options.
< / li >
< li >
In the Filter field, type < code > negotiate< / code > to restrict the list of options.
< / li >
< li >
Double-click the < code > network.negotiate-auth.trusted-uris< / code > entry to display the Enter string value dialog box.
< / li >
< li >
2020-02-17 14:10:46 -06:00
Enter the name of the domain against which you want to authenticate, for example, < code class = "example-domain" > .example.com< / code > .
2014-03-31 07:03:28 -05:00
< / li >
2017-09-01 14:50:44 -05:00
< li > < a href = "../ui/index.html" id = "return-link" class = "btn btn-default" > Return to Web UI< / a > < / li >
2014-03-31 07:03:28 -05:00
< / ol >
2011-10-06 07:30:26 -05:00
2015-07-17 08:57:30 -05:00
< h2 > Chrome< / h2 >
< p >
You can configure Chrome to use Kerberos for Single Sign-on. The following instructions will guide you in configuring your web browser to send your Kerberos credentials to the appropriate Key Distribution Center which enables Single Sign-on.
< / p >
< h3 > Import CA Certificate< / h3 >
< ol >
< li >
Download the < a href = "ca.crt" > CA certificate< / a > . Alternatively, if the host is also an IdM client, you can find the certificate in /etc/ipa/ca.crt.
< / li >
< li >
Click the menu button with the < em > Customize and control Google Chrome< / em > tooltip, which is by default in the top right-hand corner of Chrome, and click < em > Settings< / em > .
< / li >
< li >
Click < em > Show advanced settings< / em > to display more options, and then click the < em > Manage certificates< / em > button located under the HTTPS/SSL heading.
< / li >
< li >
In the < em > Authorities< / em > tab, click the < em > Import< / em > button at the bottom.
< / li >
< li > Select the CA certificate file that you downloaded in the first step.< / li >
< / ol >
< h3 >
Enable SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) to Use Kerberos Authentication
in Chrome
< / h3 >
< ol >
< li >
Make sure you have the necessary directory created by running:
< div > < code >
[root@client]# mkdir -p /etc/opt/chrome/policies/managed/
< / code > < / div >
< / li >
< li >
Create a new < code > /etc/opt/chrome/policies/managed/mydomain.json< / code > file with write privileges limited to the system administrator or root, and include the following line:
< div > < code >
2020-02-17 14:10:46 -06:00
{ "AuthServerWhitelist": "*< span class = "example-domain" > .example.com< / span > " }
2015-07-17 08:57:30 -05:00
< / code > < / div >
< div >
You can do this by running:
< / div >
< div > < code >
2020-02-17 14:10:46 -06:00
[root@server]# echo '{ "AuthServerWhitelist": "*< span class = "example-domain" > .example.com< / span > " }' > /etc/opt/chrome/policies/managed/mydomain.json
2015-07-17 08:57:30 -05:00
< / code > < / div >
< / li >
< / ol >
2015-07-29 08:38:15 -05:00
< ol >
< p >
< strong > Note:< / strong > If using Chromium, use < code > /etc/chromium/policies/managed/< / code > instead of < code > /etc/opt/chrome/policies/managed/< / code > for the two SPNEGO Chrome configuration steps above.
< / p >
< / ol >
2015-07-17 08:57:30 -05:00
< h2 > Internet Explorer< / h2 >
2016-04-25 05:53:33 -05:00
< p > < strong > WARNING:< / strong > Internet Explorer is no longer a supported browser.< / p >
2015-07-17 08:57:30 -05:00
< p >
Once you are able to log into the workstation with your kerberos key you are now able to use that ticket in Internet Explorer.
< / p >
< p >
2017-11-21 02:15:07 -06:00
< strong > Log into the Windows machine using an account of your Kerberos realm (administrative domain)< / strong >
2015-07-17 08:57:30 -05:00
< / p >
< p >
< strong > In Internet Explorer, click Tools, and then click Internet Options.< / strong >
< / p >
< div >
< ol >
< li > Click the Security tab< / li >
< li > Click Local intranet< / li >
< li > Click Sites < / li >
< li > Click Advanced < / li >
< li > Add your domain to the list< / li >
< / ol >
< ol >
< li > Click the Security tab< / li >
< li > Click Local intranet< / li >
< li > Click Custom Level< / li >
< li > Select Automatic logon only in Intranet zone< / li >
< / ol >
< ol >
< li > Visit a kerberized web site using IE (You must use the fully-qualified Domain Name in the URL)< / li >
< li > < strong > You are all set.< / strong > < / li >
< / ol >
< / div >
2018-07-12 15:19:04 -05:00
< / noscript >
2014-03-31 07:03:28 -05:00
< / div >
< / div >
< / div >
< / div >
2007-09-24 14:20:34 -05:00
< / body >
2011-01-20 14:39:59 -06:00
2007-09-24 14:20:34 -05:00
< / html >
2011-01-20 14:39:59 -06:00
