Skip to content

Commit a13c77c

Browse files
themr0cthemr0c
committed
RHIDP-7834-RHIDP-7634-RHIDP-598 Refactor authenticating with RHBK
Signed-off-by: Fabrice Flore-Thébault <[email protected]>
1 parent 5da9619 commit a13c77c

File tree

3 files changed

+158
-170
lines changed

3 files changed

+158
-170
lines changed

‎assemblies/assembly-authenticating-with-rhbk.adoc‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,7 @@
33

44
To authenticate users with {rhbk-brand-name} ({rhbk}):
55

6-
. xref:enabling-authentication-with-rhbk[Enable the OpenID Connect (OIDC) authentication provider in RHDH].
7-
. xref:provisioning-users-from-rhbk-to-the-software-catalog[Provision users from {rhbk-brand-name} ({rhbk}) to the software catalog].
6+
include::modules/authentication/proc-enabling-user-authentication-with-rhbk.adoc[leveloffset=+1]
87

9-
include::modules/authentication/proc-enabling-authentication-with-rhbk.adoc[leveloffset=+1]
10-
11-
include::modules/authentication/proc-provisioning-users-from-rhbk-to-the-software-catalog.adoc[leveloffset=+1]
128

139
include::modules/authentication/proc-creating-a-custom-transformer-to-provision-users-from-rhbk-to-the-software-catalog.adoc[leveloffset=+1]

modules/authentication/proc-enabling-authentication-with-rhbk.adoc renamed to modules/authentication/proc-enabling-user-authentication-with-rhbk.adoc

Lines changed: 157 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
[id="enabling-authentication-with-rhbk"]
2-
= Enabling authentication with {rhbk-brand-name} ({rhbk})
3-
4-
To authenticate users with {rhbk-brand-name} ({rhbk}), enable the OpenID Connect (OIDC) authentication provider in {product}.
1+
[id="enabling-user-authentication-with-rhbk"]
2+
= Enabling user authentication with {rhbk-brand-name} ({rhbk})
53

4+
To authenticate users with {rhbk-brand-name} ({rhbk}), enable and configure the OpenID Connect (OIDC) authentication provider in {product} and provision the users and groups from {rhbk} to the {product-short} software catalog.
65

76
.Prerequisites
87
* You link:{configuring-book-url}[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
98
* You have sufficient permissions in {rhsso} to create and manage a realm.
9+
Alternatively, you can ask your {rhbk} administrator to prepare the required {rhbk} App.
1010

1111
.Procedure
1212
. To allow {product-short} to authenticate with {rhbk}, complete the steps in {rhbk}, to link:https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html/getting_started_guide/getting-started-zip-#getting-started-zip-create-a-realm[create a realm and a user] and link:https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html/getting_started_guide/getting-started-zip-#getting-started-zip-secure-the-first-application[secure the first application]:
@@ -31,6 +31,145 @@ Save the value for the next step:
3131
`AUTH_OIDC_CLIENT_SECRET`:: Enter the saved **Client Secret**.
3232
`AUTH_OIDC_METADATA_URL`:: Enter the saved **{rhbk} realm base URL**.
3333

34+
. link:{installing-and-viewing-plugins-book-url}[Enable the `backstage-plugin-catalog-backend-module-keycloak-dynamic` plugin].
35+
+
36+
.`dynamic-plugins.yaml` file fragment
37+
[code,yaml]
38+
----
39+
plugins:
40+
- package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-keycloak-dynamic'
41+
disabled: false
42+
----
43+
44+
. To enable {rhbk} member discovery, edit `{my-app-config-file}`, your custom {product-short} configuration file:
45+
+
46+
--
47+
[id=keycloakOrgProviderId]
48+
.`{my-app-config-file}` fragment with mandatory `keycloakOrg` fields
49+
[source,yaml]
50+
----
51+
catalog:
52+
providers:
53+
keycloakOrg:
54+
default:
55+
baseUrl: ${AUTH_OIDC_METADATA_URL}
56+
clientId: ${AUTH_OIDC_CLIENT_ID}
57+
clientSecret: ${AUTH_OIDC_CLIENT_SECRET}
58+
----
59+
60+
`baseUrl`::
61+
Your {rhbk} server URL, defined when xref:enabling-authentication-with-rhbk[enabling authentication with {rhbk}].
62+
63+
`clientId`::
64+
Your {product-short} application client ID in {rhbk}, defined when xref:enabling-authentication-with-rhbk[enabling authentication with {rhbk}].
65+
66+
`clientSecret`::
67+
Your {product-short} application client secret in {rhbk}, defined when xref:enabling-authentication-with-rhbk[enabling authentication with {rhbk}].
68+
69+
Optional: Consider adding the following optional fields:
70+
71+
`realm`::
72+
Realm to synchronize.
73+
Default value: `master`.
74+
+
75+
.`{my-app-config-file}` fragment with optional `realm` field
76+
[source,yaml]
77+
----
78+
catalog:
79+
providers:
80+
keycloakOrg:
81+
default:
82+
realm: master
83+
----
84+
85+
`loginRealm`::
86+
Realm used to authenticate.
87+
Default value: `master`.
88+
+
89+
.`{my-app-config-file}` fragment with optional `loginRealm` field
90+
[source,yaml]
91+
----
92+
catalog:
93+
providers:
94+
keycloakOrg:
95+
default:
96+
loginRealm: master
97+
----
98+
99+
`userQuerySize`::
100+
User number to query simultaneously.
101+
Default value: `100`.
102+
+
103+
.`{my-app-config-file}` fragment with optional `userQuerySize` field
104+
[source,yaml]
105+
----
106+
catalog:
107+
providers:
108+
keycloakOrg:
109+
default:
110+
userQuerySize: 100
111+
----
112+
113+
`groupQuerySize`::
114+
Group number to query simultaneously.
115+
Default value: `100`.
116+
+
117+
.`{my-app-config-file}` fragment with optional `groupQuerySize` field
118+
[source,yaml]
119+
----
120+
catalog:
121+
providers:
122+
keycloakOrg:
123+
default:
124+
groupQuerySize: 100
125+
----
126+
127+
`schedule.frequency`::
128+
To specify custom schedule frequency.
129+
Supports cron, ISO duration, and "human duration" as used in code.
130+
+
131+
.`{my-app-config-file}` fragment with optional `schedule.frequency` field
132+
[source,yaml]
133+
----
134+
catalog:
135+
providers:
136+
keycloakOrg:
137+
default:
138+
schedule:
139+
frequency: { hours: 1 }
140+
----
141+
142+
`schedule.timeout`::
143+
To specify custom timeout.
144+
Supports ISO duration and "human duration" as used in code.
145+
+
146+
.`{my-app-config-file}` fragment with optional `schedule.timeout` field
147+
[source,yaml]
148+
----
149+
catalog:
150+
providers:
151+
keycloakOrg:
152+
default:
153+
schedule:
154+
timeout: { minutes: 50 }
155+
----
156+
157+
`schedule.initialDelay`::
158+
To specify custom initial delay.
159+
Supports ISO duration and "human duration" as used in code.
160+
+
161+
.`{my-app-config-file}` fragment with optional `schedule.initialDelay` field
162+
[source,yaml]
163+
----
164+
catalog:
165+
providers:
166+
keycloakOrg:
167+
default:
168+
schedule:
169+
initialDelay: { seconds: 15}
170+
----
171+
--
172+
34173
. To set up the {rhbk} authentication provider in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `{my-app-config-file}` content:
35174

36175
.. Configure mandatory fields:
@@ -212,6 +351,17 @@ If multiple valid refresh tokens are issued due to frequent refresh token reques
212351
====
213352

214353
.Verification
215-
. Go to the {product-short} login page.
216-
. Your {product-short} sign-in page displays *Sign in using OIDC* and the Guest user sign-in is disabled.
217-
. Log in with OIDC by using the saved **Username** and **Password** values.
354+
355+
. To verify user and group provisioning, check the console logs.
356+
+
357+
.Successful synchronization example:
358+
[source,json]
359+
----
360+
{"class":"KeycloakOrgEntityProvider","level":"info","message":"Read 3 Keycloak users and 2 Keycloak groups in 1.5 seconds. Committing...","plugin":"catalog","service":"backstage","taskId":"KeycloakOrgEntityProvider:default:refresh","taskInstanceId":"bf0467ff-8ac4-4702-911c-380270e44dea","timestamp":"2024-09-25 13:58:04"}
361+
{"class":"KeycloakOrgEntityProvider","level":"info","message":"Committed 3 Keycloak users and 2 Keycloak groups in 0.0 seconds.","plugin":"catalog","service":"backstage","taskId":"KeycloakOrgEntityProvider:default:refresh","taskInstanceId":"bf0467ff-8ac4-4702-911c-380270e44dea","timestamp":"2024-09-25 13:58:04"}
362+
----
363+
364+
. To verify {rhbk} user authentication:
365+
.. Go to the {product-short} login page.
366+
.. Your {product-short} sign-in page displays *Sign in using OIDC* and the Guest user sign-in is disabled.
367+
.. Log in with OIDC by using the saved **Username** and **Password** values.

‎modules/authentication/proc-provisioning-users-from-rhbk-to-the-software-catalog.adoc‎

Lines changed: 0 additions & 158 deletions
This file was deleted.

0 commit comments

Comments
 (0)