Skip to content

Commit 341fc92

Browse files
FriedJannikaaronzi
FriedJannik
and
aaronzi
authored
Adds new Secured Setup Example for BaSyx (#374)
Signed-off-by: FriedJannik <[email protected]> Co-authored-by: Aaron Zielstorff <[email protected]>
1 parent 3446ff3 commit 341fc92

21 files changed

+3817
-177
lines changed

‎examples/BaSyxSecured/README.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# BaSyx Secure Setup
2+
3+
All BaSyx components support role-based access control by using Keycloak as identity provider.
4+
Access rules are defined based on roles. Roles are defined in the Keycloak server.
5+
6+
To start the secure setup execute the following command
7+
8+
```bash
9+
docker-compose up -d
10+
```
11+
12+
This will start the BaSyx components and the Keycloak server. The Keycloak server can be found at http://localhost:9097.
13+
There you can login as admin with username `admin` and password `keycloak-admin`.
14+
![BaSyx Realm User Overview](users.png)
15+
16+
The example comes with an already configured realm `BaSyx` and a user `john.doe` with password `johndoe`.
17+
This user has the `admin` role and can access all BaSyx components and all information about each component.
18+
19+
The entry point for accessing the Asset Administration Shells and their Submodels is the AAS Web UI running at http://localhost:3000.
20+
After opening the page you will be redirected to the Keycloak login page. Use the credentials of user `john.doe` to log in.
21+
![Login to BaSyx using Keycloak](login.png)
22+
23+
From there you can access the AAS and Submodels of the BaSyx components.
24+
The UI shows the login status in the top right corner.
25+
To end your session click on the logout button in the top right corner.
26+
![Logout button in the AAS UI](logout.png)
27+
28+
There are several other user accounts available, each with different roles. You can use them to test the different levels of access. The password for these users is their username without the dots. You can find them in the [Users](http://localhost:9097/admin/master/console/#/BaSyx/users) tab of the BaSyx realm in Keycloak.

‎examples/BaSyxSecured/aas/ExampleV3.aasx‎

120 KB
Binary file not shown.

‎examples/BaSyxSecured/aas/test_demo_full_example.xml‎

Lines changed: 2485 additions & 0 deletions
Large diffs are not rendered by default.

‎examples/BaSyxSecured/basyx/aas-discovery.properties‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
server.port=8081
2+
spring.application.name=AAS Discovery Service
3+
basyx.aasdiscoveryservice.name=aas-discovery-service
4+
basyx.backend=InMemory
5+
basyx.cors.allowed-origins=*
6+
basyx.cors.allowed-methods=GET,POST,PATCH,DELETE,PUT,OPTIONS,HEAD
7+
8+
basyx.feature.authorization.enabled = true
9+
basyx.feature.authorization.type = rbac
10+
basyx.feature.authorization.jwtBearerTokenProvider = keycloak
11+
basyx.feature.authorization.rbac.file = file:/application/rbac_rules.json
12+
spring.security.oauth2.resourceserver.jwt.issuer-uri= http://keycloak:9097/realms/BaSyx

‎examples/BaSyxSecured/basyx/aas-env.properties‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
server.port=8081
2+
basyx.backend=InMemory
3+
basyx.environment=file:aas
4+
basyx.cors.allowed-origins=*
5+
basyx.cors.allowed-methods=GET,POST,PATCH,DELETE,PUT,OPTIONS,HEAD
6+
basyx.aasrepository.feature.registryintegration=http://aas-registry:8080
7+
basyx.submodelrepository.feature.registryintegration=http://sm-registry:8080
8+
basyx.externalurl=http://localhost:8081
9+
10+
basyx.feature.authorization.enabled = true
11+
basyx.feature.authorization.type = rbac
12+
basyx.feature.authorization.jwtBearerTokenProvider = keycloak
13+
basyx.feature.authorization.rbac.file = file:/application/rbac_rules.json
14+
spring.security.oauth2.resourceserver.jwt.issuer-uri= http://keycloak-rbac:8080/realms/BaSyx
15+
basyx.aasenvironment.authorization.preconfiguration.token-endpoint=http://keycloak-rbac:8080/realms/BaSyx/protocol/openid-connect/token
16+
basyx.aasenvironment.authorization.preconfiguration.grant-type = CLIENT_CREDENTIALS
17+
basyx.aasenvironment.authorization.preconfiguration.client-id=workstation-1
18+
basyx.aasenvironment.authorization.preconfiguration.client-secret=nY0mjyECF60DGzNmQUjL81XurSl8etom
19+
#basyx.aasenvironment.authorization.preconfiguration.username=username
20+
#basyx.aasenvironment.authorization.preconfiguration.password=password
21+
#basyx.aasenvironment.authorization.preconfiguration.scopes=
22+
spring.servlet.multipart.max-request-size=128MB
23+
spring.servlet.multipart.max-file-size=128MB
24+
25+
basyx.aasrepository.feature.registryintegration.authorization.enabled=true
26+
basyx.aasrepository.feature.registryintegration.authorization.token-endpoint=http://keycloak-rbac:8080/realms/BaSyx/protocol/openid-connect/token
27+
basyx.aasrepository.feature.registryintegration.authorization.grant-type = CLIENT_CREDENTIALS
28+
basyx.aasrepository.feature.registryintegration.authorization.client-id = workstation-1
29+
basyx.aasrepository.feature.registryintegration.authorization.client-secret = nY0mjyECF60DGzNmQUjL81XurSl8etom
30+
basyx.submodelrepository.feature.registryintegration.authorization.enabled=true
31+
basyx.submodelrepository.feature.registryintegration.authorization.token-endpoint=http://keycloak-rbac:8080/realms/BaSyx/protocol/openid-connect/token
32+
basyx.submodelrepository.feature.registryintegration.authorization.grant-type = CLIENT_CREDENTIALS
33+
basyx.submodelrepository.feature.registryintegration.authorization.client-id=workstation-1
34+
basyx.submodelrepository.feature.registryintegration.authorization.client-secret=nY0mjyECF60DGzNmQUjL81XurSl8etom
35+
#basyx.aasrepository.feature.registryintegration.authorization.username=test
36+
#basyx.aasrepository.feature.registryintegration.authorization.password=test
37+
#basyx.aasrepository.feature.registryintegration.authorization.scopes=[]

‎examples/BaSyxSecured/basyx/rules/aas_discovery_rbac_rules.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
[
2+
{
3+
"role": "basyx-assetid-creator",
4+
"action": "CREATE",
5+
"targetInformation": {
6+
"@type": "aas-discovery-service",
7+
"aasIds": "*",
8+
"assetIds": []
9+
}
10+
},
11+
{
12+
"role": "basyx-assetid-discoverer",
13+
"action": "READ",
14+
"targetInformation": {
15+
"@type": "aas-discovery-service",
16+
"aasIds": "*",
17+
"assetIds": []
18+
}
19+
},
20+
{
21+
"role": "basyx-assetid-deleter",
22+
"action": "DELETE",
23+
"targetInformation": {
24+
"@type": "aas-discovery-service",
25+
"aasIds": "*",
26+
"assetIds": []
27+
}
28+
},
29+
{
30+
"role": "basyx-aas-discoverer",
31+
"action": "READ",
32+
"targetInformation": {
33+
"@type": "aas-discovery-service",
34+
"aasIds": null,
35+
"assetIds": [
36+
{
37+
"name": "*",
38+
"value": "*"
39+
}
40+
]
41+
}
42+
}
43+
]

0 commit comments

Comments
 (0)