Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion artifacts/attributes.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
:ocp-version: 4.15
// First mention of OpenShift CLI or `oc` in a module
:openshift-cli: pass:quotes[OpenShift CLI (`oc`)]
:rhsso-brand-name: Red Hat Single-Sign On
:rhsso: RHSSO

// Partner Platforms
:aws-brand-name: Amazon Web Services
Expand Down Expand Up @@ -100,4 +102,4 @@
:upgrading-book-title: Upgrading {product}

:plugins-configure-book-url: https://docs.redhat.com/en/documentation/red_hat_developer_hub/{product-version}/html/configuring_dynamic_plugins/index
:plugins-configure-book-title: Configuring dynamic plugins
:plugins-configure-book-title: Configuring dynamic plugins
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[id="provisioning-users-from-rhsso-to-the-software-catalog"]
= Creating a custom transformer to provision users from Red Hat Single-Sign On (RHSSO) to the software catalog
= Creating a custom transformer to provision users from {rhsso-brand-name} ({rhsso}) to the software catalog

To customize how RHSSO users and groups are mapped to {product} entities, you can create a backend module that uses the `keycloakTransformerExtensionPoint` to provide custom user and group transformers for the Keycloak backend.
To customize how {rhsso} users and groups are mapped to {product} entities, you can create a backend module that uses the `keycloakTransformerExtensionPoint` to provide custom user and group transformers for the Keycloak backend.

.Prerequisites
* You have xref:provisioning-users-from-rhsso-to-the-software-catalog[enabled provisioning users from Red Hat Single-Sign On (RHSSO) to the software catalog].
* You have xref:provisioning-users-from-rhsso-to-the-software-catalog[enabled provisioning users from {rhsso-brand-name} ({rhsso}) to the software catalog].

.Procedure
. Create a new backend module with the `yarn new` command.
Expand Down Expand Up @@ -85,8 +85,8 @@ Check the console logs to verify that the synchronization is completed.

* After the first import is complete, navigate to the *Catalog* page and select **User** to view the list of users.

* When you select a user, you see the information imported from RHSSO.
* When you select a user, you see the information imported from {rhsso}.

* You can select a group, view the list, and access or review the information imported from RHSSO.
* You can select a group, view the list, and access or review the information imported from {rhsso}.

* You can log in with an RHSSO account.
* You can log in with an {rhsso} account.
24 changes: 12 additions & 12 deletions modules/authentication/proc-enabling-authentication-with-rhsso.adoc
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
[id="enabling-authentication-with-rhsso"]
= Enabling authentication with Red Hat Single-Sign On (RHSSO)
= Enabling authentication with {rhsso-brand-name} ({rhsso})

To authenticate users with Red Hat Single Sign-On (RHSSO), enable the OpenID Connect (OIDC) authentication provider in {product}.
To authenticate users with Red Hat Single Sign-On ({rhsso}), enable the OpenID Connect (OIDC) authentication provider in {product}.


.Prerequisites
* You link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/{product-version}/html/administration_guide_for_red_hat_developer_hub/assembly-add-custom-app-file-openshift_admin-rhdh[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
* You have sufficient permissions in RHSSO to create and manage a realm.
* You have sufficient permissions in {rhsso} to create and manage a realm.

.Procedure
. To allow {product-short} to authenticate with RHSSO, complete the steps in RHSSO, to link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#realms-apps_[create a realm and a user] and link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#registering-app_[register the {product-short} application]:
. To allow {product-short} to authenticate with {rhsso}, complete the steps in {rhsso}, to link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#realms-apps_[create a realm and a user] and link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#registering-app_[register the {product-short} application]:

.. Use an existing realm, or link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#create-realm_[create a realm], with a distinctive **Name** such as __<my_realm>__.
Save the value for the next step:
* **RHSSO realm base URL**, such as: __<your_rhsso_URL>__/auth/realms/__<your_realm>__.
* **{rhsso} realm base URL**, such as: __<your_rhsso_URL>__/auth/realms/__<your_realm>__.

.. To register your {product-short} in RHSSO, in the created realm, link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#registering-app_[create a Client ID], with:
.. To register your {product-short} in {rhsso}, in the created realm, link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#registering-app_[create a Client ID], with:
... **Client ID**: A distinctive client ID, such as __<{product-very-short}>__.
... **Valid redirect URIs**: Set to the OIDC handler URL: `https://__<RHDH_URL>__/api/auth/oidc/handler/frame`.
... Navigate to the **Credentials** tab and copy the **Client secret**.
Expand All @@ -25,16 +25,16 @@ Save the value for the next step:

.. To prepare for the verification steps, in the same realm, get the credential information for an existing user or link:https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html-single/getting_started_guide/index#create-user_[create a user]. Save the user credential information for the verification steps.

. To add your RHSSO credentials to your {product-short} secrets, edit your {product-short} secrets, such as `secrets-rhdh`, and add the following key/value pairs:
. To add your {rhsso} credentials to your {product-short} secrets, edit your {product-short} secrets, such as `secrets-rhdh`, and add the following key/value pairs:
+
`AUTH_OIDC_CLIENT_ID`:: Enter the saved **Client ID**.
`AUTH_OIDC_CLIENT_SECRET`:: Enter the saved **Client Secret**.
`AUTH_OIDC_METADATA_URL`:: Enter the saved **RHSSO realm base URL**.
`AUTH_OIDC_METADATA_URL`:: Enter the saved **{rhsso} realm base URL**.

. To set up the RHSSO authentication provider in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
. To set up the {rhsso} authentication provider in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
+
--
.`app-config-rhdh.yaml` fragment with mandatory fields to enable authentication with RHSSO
.`app-config-rhdh.yaml` fragment with mandatory fields to enable authentication with {rhsso}
[source,yaml]
----
auth:
Expand Down Expand Up @@ -85,7 +85,7 @@ dangerouslyAllowSignInWithoutUserInCatalog: true

`callbackUrl`::
--
RHSSO callback URL.
{rhsso} callback URL.

.`app-config-rhdh.yaml` fragment with optional `callbackURL` field
[source,yaml]
Expand Down Expand Up @@ -130,7 +130,7 @@ auth:

`scope`::
--
RHSSO scope.
{rhsso} scope.

.`app-config-rhdh.yaml` fragment with optional `scope` field
[source,yaml]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
[id="provisioning-users-from-rhsso-to-the-software-catalog"]
= Provisioning users from Red Hat Single-Sign On (RHSSO) to the software catalog
= Provisioning users from {rhsso-brand-name} ({rhsso}) to the software catalog

.Prerequisites
* You xref:enabling-authentication-with-rhsso[enabled authentication with RHSSO].
* You xref:enabling-authentication-with-rhsso[enabled authentication with {rhsso}].

.Procedure

* To enable RHSSO member discovery, edit your custom {product-short} ConfigMap, such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
* To enable {rhsso} member discovery, edit your custom {product-short} ConfigMap, such as `app-config-rhdh`, and add the following lines to the `app-config-rhdh.yaml` content:
+
--
[id=keycloakOrgProviderId]
Expand All @@ -27,13 +27,13 @@ catalog:
Allow authentication only for users present in the {product-short} software catalog.

`baseUrl`::
Your RHSSO server URL, defined when xref:enabling-authentication-with-rhsso[enabling authentication with RHSSO].
Your {rhsso} server URL, defined when xref:enabling-authentication-with-rhsso[enabling authentication with {rhsso}].

`clientId`::
Your {product-short} application client ID in RHSSO, defined when xref:enabling-authentication-with-rhsso[enabling authentication with RHSSO].
Your {product-short} application client ID in {rhsso}, defined when xref:enabling-authentication-with-rhsso[enabling authentication with {rhsso}].

`clientSecret`::
Your {product-short} application client secret in RHSSO, defined when xref:enabling-authentication-with-rhsso[enabling authentication with RHSSO].
Your {product-short} application client secret in {rhsso}, defined when xref:enabling-authentication-with-rhsso[enabling authentication with {rhsso}].

Optional: Consider adding the following optional fields:

Expand Down Expand Up @@ -150,4 +150,4 @@ catalog:
{"class":"KeycloakOrgEntityProvider","level":"info","message":"Committed 3 Keycloak users and 2 Keycloak groups in 0.0 seconds.","plugin":"catalog","service":"backstage","taskId":"KeycloakOrgEntityProvider:default:refresh","taskInstanceId":"bf0467ff-8ac4-4702-911c-380270e44dea","timestamp":"2024-09-25 13:58:04"}
----

. Log in with an RHSSO account.
. Log in with an {rhsso} account.