Streamline user authentication with identity provider (IdP) integration

As an organization administrator, you can integrate your preferred identity provider with Red Hat services and applications to let users authenticate through sso.redhat.com using their corporate credentials for single sign-on.

With identity provider integration, you can configure one identity provider (IdP) as an authenticator and a second IdP to rely on that authentication to allow users to log in. For example, you can rely on an IdP such as Microsoft Entra ID to authenticate your users. When Microsoft Entra ID authenticates the user, Red Hat Single Sign-On—also an IdP—accepts the authentication so that the user can complete the login process and access their Red Hat account. Instead of configuring user credentials multiple times across separate systems, you can configure your Red Hat account to accept the external IdP authentication.

After you integrate the IdP services, users need only one set of credentials to access their Red Hat account. These credentials consist of the username and password from your corporate identity provider.

An Organization Administrator can create, update, and delete identity providers associated with your organization account. Additional user access services for role-based access control (RBAC) provide user access authorization to other resources within the Red Hat account. For more information about user access services, see User Access Configuration Guide for Role-Based Access Control.

Understand the limitations of identity provider integration
Copy link

When you integrate an external identity provider (IdP) or single sign-on (SSO) solution with Red Hat services, specific technical restrictions and account requirements apply to user authentication.

If a user cannot authenticate with your organization's SSO solution, that user cannot log in to any Red Hat service that relies on a web-based authentication flow. A limited number of Red Hat services do not utilize web-based authentication; these services are not compatible with federated single sign-on.

Note
If you revoke a user's corporate credentials in your IdP, the user can still use a Red Hat username and password to log in to services that do not use web-based authentication.

Users who do not have an account in your corporate IdP cannot authenticate. This restriction applies to vendors and external partners who use a Red Hat login associated with your organization's Red Hat account. When you enable identity provider integration, external users must have an account in your corporate IdP to maintain access to Red Hat services.

Note
To use identity provider integration, you must create user accounts by using supported registration methods, such as inviting users or auto-user registration.

Identity provider integration is supported on the following Red Hat account types:

  • A Red Hat Corporate account type. Personal account types are not supported.
  • Accounts with an active, non-evaluation subscription.
  • Approved Red Hat partner accounts.

To remove user access to all Red Hat services, an Organization Administrator must deactivate the Red Hat user account. Use the user management tool to deactivate accounts. A deactivated account can no longer access any Red Hat service.

Configure identity provider (IdP) integration for your organization
Copy link

Identity provider integration is a component of the Identity and Access Management services provided by Red Hat Hybrid Cloud Console.

Identity Provider Integration establishes your corporate single sign-on (SSO) solution as a valid identity provider for the Red Hat single sign-on system. IdP integration supports Open ID Connect (OIDC) and Security Assertion Markup Language (SAML) authentication.

Important

When you modify your identity provider integration, users in your organization must re-link their user accounts in the following situations:

  • You delete an existing identity provider and configure a new one.
  • The identifier for your identity provider changes, for instance, if your company changes SSO or IdP vendors.
    • For SAML configurations, the identifier is the nameid attribute.
    • For OIDC configurations, the identifier is the sub claim.
  • A user leaves and returns to your organization. The user can replace a preexisting link with a new link when the One-time account linking required login message is displayed.

Connect your identity provider (IdP)
Copy link

The Organization Administrator can set up and configure identity provider integration for your organization. Identity provider integration supports SAML and OIDC.

Before you begin
Copy link

Procedure
Copy link

  1. Log in to Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission.
  2. From the home page after you log in, click ⚙ (Settings).
  3. Click Authentication Policy.
  4. When the Authentication Policy window appears, click Identity Provider Integration. Tip
    You can navigate directly to Identity Provider Integration.
  5. Click Set up an identity provider and choose an authentication protocol for your identity provider.
  6. Select SAML 2.0 or OpenID Connect and continue the configuration.

Configure identity provider (IdP) integration for OIDC
Copy link

You must provide information about your identity provider when you use OpenID Connect authentication. Gather information about your identity provider before you begin IdP integration for OIDC.

Before you begin
Copy link

  • Confirm you are logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator and have started the IdP integration.

The following information is required to complete IdP integration for OIDC.

Information you provide:

  • Issuer: Issuer information for your IdP. A URL for your IdP tokens.
  • Client ID: The IdP Client ID verifies user identities and provides the information to other services.
  • Client Secret: A client secret is a random string known only to the OAuth application and the authorization server. Note

    The following characters are not allowed in the client secret. Inspect the client secret and create a new one if any disallowed character is in the secret.

    \ $ ^ [ ] ' " > <
  • Authorization URL: The endpoint for the API provider authorization server, to retrieve the authorization code.
  • Token URL: The URL for the authentication server of the provider, to exchange an authorization code for an access token.
  • JWKS URL: The URL of JSON Web Key Set for your provider.

Information Red Hat provides:

  • Service provider OpenID Configuration URL: The OpenID Connect configuration URL contains the configuration details for the sso.redhat.com OIDC setup.
  • Redirect URL: The service provider redirect URL, also known as a redirect URL or reply URL, is where your identity provider will redirect users to authenticate to Red Hat.

Procedure
Copy link

  1. On the Identity Provider Integration page, click OpenID Connect. The OIDC identity provider configuration form appears.
  2. Using the information you have gathered, fill out the form.
  3. The URLs required for identity provider configuration are provided by Red Hat and are required by your internal identity provider. Copy the URLs and enter them appropriately in your identity provider.
  4. After you verify the information is complete for your identity provider integration, click Create OIDC identity provider integration. A page appears that shows you the configuration information.
    Note
    If any information is missing or wrong, update the form and resubmit.
  5. Click Test and enable to complete the identity provider integration. This opens a new window for you to enter your login ID and password.
    Note
    Make sure pop-ups are enabled in your browser.
  6. On a successful test, click the Enable button to enable for your organization. If you choose not to enable, you must retest.

Configure identity provider (IdP) integration for SAML
Copy link

You must provide certain information about your identity provider when you use Security Assertion Markup Language (SAML) authentication. Gather this information before you begin IdP integration for SAML.

Before you begin
Copy link

  • Confirm you are logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator and have started the IdP integration.

The following information is required to complete IdP integration for SAML.

Information that you provide:

  • Identity provider Entity ID (EID): The EID attribute is in your SAML metadata configuration.
  • SSO authentication request URL: The URL that receives SAML authentication requests; i.e. the URL of your internal log in page.
  • Service provider issuer: The issuer that will be used to uniquely identify the SAML Service Provider. This could be a URL, GUID, or a string of alphanumeric characters. Spaces and most special characters will not be accepted. This value does not come from the Identity Provider (IdP) metadata file.
  • x509 certificate: Identity provider integration for SAML requires an x509 certificate. This certificate is a Base64 privacy-enhanced electronic mail (PEM) file that checks for signatures. The identity provider integration provided by Red Hat uses the x509 certificate to verify the assertion signature. Response and assertion encryption is not currently enforced; however, a valid x509 certificate allows decryption of the responses and assertions.
  • SAML metadata: The SAML metadata can be imported from a XML-format file or it can be manually entered. When you import the SAML XML metadata file, the x509 certificate is automatically parsed. File import is recommended.

Information Red Hat provides:

  • Service provider metadata URL: Service provider metadata used to integrate Red Hat with your identity provider.
  • Redirect or ACS URL: The redirect URL to use when configuring your identity provider. This is where your identity provider will redirect users to authenticate to Red Hat.
Note
Microsoft Entra ID adds spn: to the beginning of any non-URL value in the service provider issuer field. This field might also be referred to as a client, application, or a Service Provider Entity ID. Make sure the Entra ID value and the IdP configuration values match.
 Note
Okta Single Sign On identifies the service provider issuer field as Audience Description. Look for that value in your Okta admin console and copy it into the service provider issuer field

Procedure
Copy link

  1. On the Identity Provider Integration page, click SAML 2.0.
  2. You can upload most of the information from a SAML metadata file in XML format. The following information is parsed from the SAML metadata file:
    • Identity provider Entity ID
    • Single sign-on authentication request URL
  3. Manually enter the service provider issuer information. This information must be provided by you. The service provider issuer is how the Red Hat single sign-on system will be identified in your IdP. It is also known as the "service provider Entity ID."
    Note
    Only alphanumeric characters are allowed in the service provider issuer information. Do not use spaces or non-alphanumeric characters.
  4. The URLs required for identity provider configuration are provided by Red Hat and are required by your internal identity provider. Copy the URLs and enter them appropriately in your identity provider.
    • Service provider metadata URL
    • Redirect URL / Assertion Consumption Service (ACS) URL
  5. After you verify the information is complete for your identity provider integration, click Create SAML identity provider integration. A page appears that shows you the configuration information.
    Note
    If any information is missing or incorrect, update the form and resubmit.
  6. Click Test and enable to complete the identity provider integration. This opens a new window for you to enter your login ID and password.
    Note
    Make sure pop-ups are enabled in your browser.
  7. On a successful test, click the Enable button to enable for your organization. If you choose not to enable, you must retest.

Delete, disable, or update your identity provider (IdP) integration
Copy link

You can delete or disable the identity provider integration. Before you change your internal SAML certificate or the OIDC secret, disable Red Hat identity provider integration.

When you disable or delete your IdP integration, all users on your account, including your Organization Administrator, must use their Red Hat account credentials to log in.

The service provider metadata URL will become unavailable while the identity provider is disabled. You can still download the metadata information in .xml format from the configuration page by clicking the Download service provider metadata button.

After you update and re-enable the identity provider integration, users on your organization account can log in through your identity provider and access the service provider metadata URL as normal.

Update the SAML certificate or OIDC secret
Copy link

Disable the Red Hat identity provider integration before you change or update your internal SAML certificate or OIDC secret. These changes are sometimes referred to as rotations. After the rotation, update the Red Hat IdP integration with the new certificate or secret information and re-enable.

Before you begin
Copy link

  • Confirm you are logged in to the Red Hat Hybrid Cloud Console as the Organization Administrator.
  • Ensure you have configured and enabled the Red Hat identity provider integration.
  • Ensure you can access your internal IdP and rotate the SAML certificate or OIDC secret.
Warning
You must disable the Red Hat IdP integration before changing your internal SAML certificate or OIDC secret. Failure to do so results in all users, including Organization Administrators, being unable to authenticate. If this happens, contact Red Hat Customer Service.

Procedure
Copy link

  1. Navigate to Settings > Authentication Policy > Identity Provider Integration. Your enabled integration is displayed.
  2. Click Disable.
    Note
    While the identity provider is disabled, users will be able to log in with their Red Hat credentials.
     Note
    The service provider metadata URL will become unavailable while the identity provider is disabled. You can still download the metadata information in .xml format from the configuration page by clicking the Download service provider metadata button.
  3. Generate and update the SAML certificate or OIDC secret in your organization’s identity provider.
  4. Update the Red Hat IdP integration SAML certificate or OIDC secret.
  5. When finished, click Test and enable. The testing step is required after any update to your IdP integration.
  6. On a successful test, click Enable to re-enable for your organization.

Pause your identity provider (IdP) integration for maintenance
Copy link

You can temporarily disable the integration without changing it. For example, your identity provider might have a maintenance window and you want users to log in to Red Hat services using their Red Hat login ID and password.

Before you begin
Copy link

  • Ensure you are logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator or as a user with User Access administrator permissions.
  • Ensure you have configured an identity provider integration.
Note
If you cannot access the Red Hat IdP integration application and need to disable your integration, open a support ticket with Red Hat Customer Service. This might occur if you identity provider has an outage and you cannot log in through your integration.

Procedure
Copy link

  1. Navigate to Settings > Authentication Policy > Identity Provider Integration. Your enabled integration is displayed.
  2. Click Disable. Your IdP integration is now disabled.
  3. When you are ready to re-enable, click Test and enable.
  4. On a successful test, click Enable to re-enable for your organization.

Identity provider integration requirements and technical defaults
Copy link

Use the following information to help align your identity provider configurations with Red Hat’s technical requirements and defaults for SAML and OIDC integrations to ensure secure authentication and protocol compatibility.

SAML requirements and defaults
Copy link

The following table identifies Red Hat identity system defaults and expectations for identity provider integration with SAML.

Table 1. IdP integration defaults for SAML configuration
Name Description

SSO initiation type

The Red Hat identity system (sso.redhat.com) supports Service Provider-initiated single sign-on. Red Hat does not support IdP-initiated single sign-on.

SSO binding

Only POST is allowed for new IdPs.

Name ID

Red Hat expects an ID that allows for unspecified identification of authenticating users. The organization must determine the preferred identifier. Commonly used IDs are a UUID, an email address, a username, etc.

Other required attributes

Red Hat does not require any other attributes to be provided for authenticating users.

ACS URL

This is provided by the Identity Provider Integration tool after a customer has completed the initial setup for their IdP. Red Hat also provides a link to the SAML metadata URL that the customer can bind with if they so choose (this would allow for them to review the configured IdP in-depth).

Assertion Signing

Red Hat requires that integrating customers sign their assertions. We require that a valid x509 certificate is provided during IdP configuration that can be used to verify the assertion signature.

Response/Assertion Encryption

Encryption is not currently enforced, but, as long as a valid x509 is provided, Red Hat will be able to decrypt responses/assertions.

Signing AuthN requests

Red Hat signs AuthN requests and encourages integrating parties to verify this signature. The key Red Hat uses to do this will be discoverable in the provided SAML metadata (mentioned above, this will be presented after the IdP has been created).

Federated Logout

Red Hat does not currently support any federated logout options. Doing so would result in your users being logged out of both Red Hat as well as your company’s SSO if they were to log out of a Red Hat service or application.

OIDC requirements and defaults
Copy link

The following table identifies Red Hat identity system defaults and expectations for identity provider integration with OIDC.

Table 2. IdP integration defaults for OIDC configuration
Name Description

Federated Logout

Red Hat does not currently support any federated logout options. Doing so would result in your users being logged out of both Red Hat as well as your company’s SSO if they were to “log out” of a Red Hat service or application.

Signatures

IdP integration validates signatures and requires that tokens must be signed.

PKCE

For enhanced security, use Proof Key for Code Exchange (PKCE), which is an extension to the OAuth 2.0 authorization code flow. Red Hat encourages that you use S256 as the PKCE method.

Disallowed characters for OIDC secrets
Copy link

The following characters are not allowed in the OIDC client secret. Inspect the client secret and create a new one if any disallowed character is in the secret.

\ $ ^ [ ] ' " > <