Red Hat Edge Manager on Red Hat Enterprise Linux uses one primary authentication method at a time. Choose whether to keep the default PAM issuer or switch to federated sign-in after installation.

Default: PAM issuer

By default, the PAM issuer provides OIDC-compatible sign-in backed by local users and groups in the flightctl-pam-issuer container. No external identity system is required. Linux group names in that container map to Red Hat Edge Manager roles and organizations. For details, see Roles and organizations with the PAM issuer in the Additional resources section.

To authenticate users from LDAP, FreeIPA, or Active Directory while keeping the PAM issuer, connect the container to the host’s SSSD daemon. For details, see Authenticating with SSSD and the PAM issuer in the Additional resources section.

Optional: Red Hat Ansible Automation Platform

To use Red Hat Ansible Automation Platform for centralized authentication and authorization, see Additional resources.

Optional: OpenID Connect

To delegate sign-in to an external OIDC provider (for example, Red Hat Build of Keycloak, Azure AD, Okta, or Google), see Additional resources.