You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add OIDC PKCE configuration through policy (#7765)
* Fix leading whitespace in tmpl files
* Add PKCE Enabled flag
* Implement pkce in configs
* Add check for OIDC to guard for a nil pointer
* Fix some whitespace alignment in tmpl files
* Update snapshots to realign with whitespaces
* Add tests for PKCE enabled true
* Update CRDs based on policy files
* Add pkceEnabled to oidc pytest setup yaml
* Terminate include directive with a ;
* Set pkce enabled to an int instead of a string
* OIDC test doesn't need pkce enabled
* Add PKCE pytest
* Update snapshot after changing a str -> int
* oidc and pkce pytest fixture scope to function
* OIDC tests should be class fixtured
* Remove a parameter from pkce test
* pkce test fixture should also be class scoped
* Add debug prints
* Merge pkce test into oidc test file
* Add unit tests for the bool to int util function
* Add docs to create keycloak client via api
* Reword options because no tabs
* OIDC example deploy keycloak into nginx-ingress ns
* Add plus-mgmt-configmap.yaml to instructions
* Redo list numbers in oidc example readme
* Reset keycloak to be in default namespace
* Add note on not using client secret for PKCE
* Move applying the plus mgmt to common resources
* Add pkceEnabled to policy resource doc
* Rename pkceEnabled from past to present tense
* Fix product name in example readme
* Change console code type to shell
* Turn choice into unordered list
* Replace const default pkce secret with init val
* Change pkce and client secret validations
* Update snapshots
* Do not use default client secret
* Add more validation and tests
* Add note to OIDC policy docs about pkce-clientsecret
* Remove clientsecret from e2e test for pkce
1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
11
-
instructions to deploy the Ingress Controller. This example requires that the HTTPS port of the Ingress Controller is
12
-
`443`.
13
-
1. Save the public IP address of the Ingress Controller into `/etc/hosts` of your machine:
23
+
instructions to deploy NGINX Ingress Controller. This example requires that the HTTPS port of the Ingress
24
+
Controller is `443`.
25
+
2. Save the public IP address of the Ingress Controller into `/etc/hosts` of your machine:
14
26
15
27
```text
16
28
...
@@ -27,29 +39,29 @@ application using an OpenID Connect policy and [Keycloak](https://www.keycloak.o
27
39
Create a secret with the TLS certificate and key that will be used for TLS termination of the web application and
28
40
Keycloak:
29
41
30
-
```console
42
+
```shell
31
43
kubectl apply -f tls-secret.yaml
32
44
```
33
45
34
46
## Step 2 - Deploy a Web Application
35
47
36
48
Create the application deployment and service:
37
49
38
-
```console
50
+
```shell
39
51
kubectl apply -f webapp.yaml
40
52
```
41
53
42
54
## Step 3 - Deploy Keycloak
43
55
44
56
1. Create the Keycloak deployment and service:
45
57
46
-
```console
58
+
```shell
47
59
kubectl apply -f keycloak.yaml
48
60
```
49
61
50
-
1. Create a VirtualServer resource for Keycloak:
62
+
2. Create a VirtualServer resource for Keycloak:
51
63
52
-
```console
64
+
```shell
53
65
kubectl apply -f virtual-server-idp.yaml
54
66
```
55
67
@@ -59,27 +71,30 @@ To set up Keycloak:
59
71
60
72
1. Follow the steps in the "Configuring Keycloak" [section of the documentation](https://docs.nginx.com/nginx/deployment-guides/single-sign-on/keycloak/#configuring-keycloak):
61
73
1. To connect to Keycloak, use `https://keycloak.example.com`.
62
-
1. Make sure to save the client secret for NGINX-Plus client to the `SECRET` shell variable:
74
+
2. Make sure to save the client secret for NGINX-Plus client to the `SECRET` shell variable:
63
75
64
-
```console
76
+
```shell
65
77
SECRET=value
66
78
```
67
79
68
-
1. Alternatively, [execute the commands](./keycloak_setup.md).
80
+
2. Alternatively, [execute the commands](./keycloak_setup.md).
69
81
70
82
## Step 5 - Deploy the Client Secret
71
83
84
+
**Note**: If you're using PKCE, skip this step. PKCE clients do not have client secrets. Applying this will result
85
+
in a broken deployment.
86
+
72
87
1. Encode the secret, obtained in the previous step:
73
88
74
-
```console
89
+
```shell
75
90
echo -n $SECRET | base64
76
91
```
77
92
78
-
1. Edit `client-secret.yaml`, replacing `<insert-secret-here>` with the encoded secret.
93
+
2. Edit `client-secret.yaml`, replacing `<insert-secret-here>` with the encoded secret.
79
94
80
-
1. Create a secret with the name `oidc-secret` that will be used by the OIDC policy:
95
+
3. Create a secret with the name `oidc-secret` that will be used by the OIDC policy:
81
96
82
-
```console
97
+
```shell
83
98
kubectl apply -f client-secret.yaml
84
99
```
85
100
@@ -96,23 +111,23 @@ Steps:
96
111
97
112
1. Apply the ConfigMap `nginx-config.yaml`, which contains `zone-sync` configuration parameter that enable zone synchronization and the resolver using the kube-dns service.
98
113
99
-
```console
114
+
```shell
100
115
kubectl apply -f nginx-config.yaml
101
116
```
102
117
103
118
## Step 7 - Deploy the OIDC Policy
104
119
105
120
Create a policy with the name `oidc-policy` that references the secret from the previous step:
106
121
107
-
```console
122
+
```shell
108
123
kubectl apply -f oidc.yaml
109
124
```
110
125
111
126
## Step 8 - Configure Load Balancing
112
127
113
128
Create a VirtualServer resource for the web application:
114
129
115
-
```console
130
+
```shell
116
131
kubectl apply -f virtual-server.yaml
117
132
```
118
133
@@ -122,15 +137,15 @@ Note that the VirtualServer references the policy `oidc-policy` created in Step
122
137
123
138
1. Open a web browser and navigate to the URL of the web application: `https://webapp.example.com`. You will be
124
139
redirected to Keycloak.
125
-
1. Log in with the username and password for the user you created in Keycloak, `nginx-user` and `test`.
140
+
2. Log in with the username and password for the user you created in Keycloak, `nginx-user` and `test`.
126
141
127
-
1. Once logged in, you will be redirected to the web application and get a response from it. Notice the field `User ID`
142
+
3. Once logged in, you will be redirected to the web application and get a response from it. Notice the field `User ID`
128
143
in the response, this will match the ID for your user in Keycloak. 
129
144
130
145
## Step 10 - Log Out
131
146
132
147
1. To log out, navigate to `https://webapp.example.com/logout`. Your session will be terminated, and you will be
133
148
redirected to the default post logout URI `https://webapp.example.com/_logout`.
134
149
135
-
1. To confirm that you have been logged out, navigate to `https://webapp.example.com`. You will be redirected to
150
+
2. To confirm that you have been logged out, navigate to `https://webapp.example.com`. You will be redirected to
0 commit comments