Uyuni with Google Oauth

[rchekhina]

HI,

is it possible to inegrate uyuni with Google Oauth to login with gmail account and manage permission with gmail groups ?

Thanks in advance.

Best regards.

[rchekhina]

HI,
To connect uyuni to google and can login do the following steps:

• Go to https://admin.google.com/
• Go to Apps, Web and mobile apps, click on Add app and select Add custom SAML app:
  
• Give it a name, upload the uyuni logo and click on CONTINUE:
  
• Copy the SSO URL, Entity ID and certificate we will use them on the /etc/rhn/rhn.conf file and click on Continue:
  
• On ACS URL set the url of uyuni with path /rhn/manager/sso/acs, on Entity ID set the url of uyuni with path /rhn/manager/sso/metadata, on Start URL set the uyuni url, select the box Signed response, on Name ID Format select UNSPECIFIED, on Name ID select Basic Information > Primary email and click on CONTINUE:
  
• Add the attribute mapping Primary email > uid and click on FINISH:
  
• Click on User access:
  
• Click on ON for everyone and click on SAVE:
  
• On Uyuni you need to create all the user locally with their gmail email to map them to google. the username need to be the gmail account, you dont need to set the password and you must select use PAM and fill out the Account information with the same gmail account like following:
  
• On the uyuni server edit the file /etc/rhn/rhn.conf and add the following:

java.sso = true

java.sso.onelogin.saml2.sp.entityid                       = https://DNS-UYUNI/rhn/manager/sso/metadata
java.sso.onelogin.saml2.sp.assertion_consumer_service.url = https://DNS-UYUNI/rhn/manager/sso/acs
java.sso.onelogin.saml2.sp.single_logout_service.url      = https://DNS-UYUNI/rhn/manager/sso/sls



java.sso.onelogin.saml2.idp.entityid  = Entity ID that you have copied 
java.sso.onelogin.saml2.idp.single_sign_on_service.url = SSO URL that you have copied 
java.sso.onelogin.saml2.idp.single_logout_service.url  = https://DNS-UYUNI/rhn/manager/sso/sls

# paste the certificate that you have copied in oneline
java.sso.onelogin.saml2.idp.x509cert = -----BEGIN CERTIFICATE----- 

• restart uyuni:
  spacewalk-service restart
• IIf you want to disable the SSO you need to edit the file /etc/rhn/rhn.conf and change java.sso from true to false and restart uyuni

[juliogonzalez]

Very nice!

Can I move this to the Wiki @rchekhina?

[rchekhina]

HI Julio,
yes you can. Only one thing this parameter java.sso.onelogin.saml2.idp.single_logout_service.url = https://DNS-UYUNI/rhn/manager/sso/sls is not the best because it doesnt close the gmail session I put it like this because I for the moment gsuite doesnt support the single logout service so I put the uyuni logout.