aap: align OIDC admin path with access-aap-admin

Author: gprocunier

aws-metal-openshift-demo/docs/authentication-model.md

@@ -79,7 +79,7 @@ Today those IdM local groups are:
 | `access-linux-admin` | Linux/RHEL admin | Granted passwordless sudo by `admins-nopasswd-all` |
 | `access-virt-admin` | reserved virtualization role | group exists; no broad privilege binding documented as default |
 | `access-developer` | reserved non-admin role | group exists; no broad privilege binding documented as default |
-| `access-aap-admin` | reserved AAP policy target | group exists in IdM and AD-trust mapping; current clean-build AAP superuser binding still uses `access-openshift-admin` |
+| `access-aap-admin` | AAP admin | Grants AAP gateway superuser through the Keycloak authenticator map |
 
 That means:
 
@@ -141,7 +141,7 @@ In the validated clean-build path:
 
 - AAP uses the Keycloak realm already deployed for cluster SSO
 - the AAP client ID is `aap`
-- the required admin group is `access-openshift-admin`
+- the required admin group is `access-aap-admin`
 - direct AAP LDAP is not the supported default path
 
 ### RHEL Hosts

aws-metal-openshift-demo/docs/manual-process.md

@@ -1784,10 +1784,12 @@ ipa pwpolicy-mod access-linux-admin \
 ipa user-add sysop --first=Sys --last=Op --shell=/bin/bash --password <<< '<lab-default-password>'
 ipa user-add virtadm --first=Virt --last=Admin --shell=/bin/bash --password <<< '<lab-default-password>'
 ipa user-add dev --first=Dev --last=User --shell=/bin/bash --password <<< '<lab-default-password>'
+ipa user-add aapadmin --first=AAP --last=Admin --shell=/bin/bash --password <<< '<lab-default-password>'
 
 ipa user-mod sysop --setattr=krbPasswordExpiration=20360313235039Z
 ipa user-mod virtadm --setattr=krbPasswordExpiration=20360313235039Z
 ipa user-mod dev --setattr=krbPasswordExpiration=20360313235039Z
+ipa user-mod aapadmin --setattr=krbPasswordExpiration=20360313235039Z
 
 ipa dnsrecord-add workshop.lan virt-01 --a-rec=172.16.0.1 2>/dev/null || \
 ipa dnsrecord-mod workshop.lan virt-01 --a-rec=172.16.0.1
@@ -1832,6 +1834,7 @@ ipa group-add-member access-linux-admin --users=sysop
 ipa group-add-member access-openshift-admin --users=sysop
 ipa group-add-member access-virt-admin --users=virtadm
 ipa group-add-member access-developer --users=dev
+ipa group-add-member access-aap-admin --users=aapadmin
 
 ipa sudorule-add admins-nopasswd-all \
   --desc='Permit access-linux-admin group members to run any command on any host without authentication'
@@ -4548,7 +4551,7 @@ The validated clean-build path uses:
 - Keycloak realm: `openshift`
 - AAP client ID: `aap`
 - AAP authenticator name: `Red Hat build of Keycloak`
-- required AAP admin group: `access-openshift-admin`
+- required AAP admin group: `access-aap-admin`
 
 ```bash
 # Configure Keycloak SSO for AAP.
@@ -4667,12 +4670,12 @@ curl -sk -X POST https://${AAP_ROUTE}/api/gateway/v1/authenticator_maps/ \
   -H 'Content-Type: application/json' \
   -d @- <<JSON
 {
-  "name": "access-openshift-admin AAP superuser",
+  "name": "access-aap-admin AAP superuser",
   "map_type": "is_superuser",
   "triggers": {
     "groups": {
       "has_or": [
-        "access-openshift-admin"
+        "access-aap-admin"
       ]
     }
   },
@@ -4694,8 +4697,8 @@ before the final browser-style login proof:
    expected group claims
 
 If the lab trust path is enabled, the validated user is
-`ad-ocpadmin@corp.lan`. Without AD trust, use the native IdM admin-path user
-instead.
+`ad-aapadmin@corp.lan`. Without AD trust, use the native IdM AAP admin user
+`aapadmin` instead.
 
 ```bash
 # Validate the AAP SSO entry and token flow.
@@ -4706,13 +4709,17 @@ KEYCLOAK_ROUTE="$(oc -n keycloak get route workshop-keycloak -o jsonpath='{.spec
 
 curl -sk "https://${AAP_ROUTE}/api/gateway/v1/ui_auth/" | jq .
 
+AAP_VALIDATION_USER="ad-aapadmin@corp.lan"
+# When AD trust is disabled, switch this to the native IdM AAP admin user instead.
+# AAP_VALIDATION_USER="aapadmin"
+
 curl --cacert /etc/ipa/ca.crt -sS \
   -X POST "https://${KEYCLOAK_ROUTE}/realms/openshift/protocol/openid-connect/token" \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'client_id=aap' \
   --data-urlencode 'client_secret=<lab-default-password>' \
   --data-urlencode 'grant_type=password' \
-  --data-urlencode 'username=ad-ocpadmin@corp.lan' \
+  --data-urlencode "username=${AAP_VALIDATION_USER}" \
   --data-urlencode 'password=<lab-default-password>' \
   | jq .
 EOF

aws-metal-openshift-demo/docs/orchestration-guide.md

@@ -804,7 +804,7 @@ Execution model:
 - creates or updates the Keycloak `aap` client in the existing realm
 - creates or updates the Keycloak `groups` and `aap-audience` protocol mappers
 - creates the `Red Hat build of Keycloak` gateway authenticator
-- creates the `access-openshift-admin AAP superuser` authenticator map
+- creates the `access-aap-admin AAP superuser` authenticator map
 - removes the legacy direct-LDAP authenticator when present
 - validates AD-backed OIDC login after the gateway rollout when trust is
   enabled, otherwise validates the native IdM user path
@@ -813,7 +813,7 @@ Validated live result:
 
 - route `https://aap.apps.ocp.workshop.lan`
 - login page shows `Red Hat build of Keycloak`
-- `ad-ocpadmin@corp.lan` authenticates through Keycloak/IdM on the live trust
+- `ad-aapadmin@corp.lan` authenticates through Keycloak/IdM on the live trust
   path
 - the resulting AAP user has `is_superuser: true`
 - a clean AAP teardown and redeploy was revalidated on the same OIDC path

aws-metal-openshift-demo/vars/day2/openshift_aap.yml

@@ -13,7 +13,7 @@ openshift_aap:
   idm_ca_secret_name: workshop-aap-idm-ca
   route_host: aap.apps.ocp.workshop.lan
   bundle_cacert_secret: workshop-aap-idm-ca
-  validation_username: sysop
+  validation_username: aapadmin
   validation_password: "{{ lab_default_password | default('') }}"
   database:
     postgres_storage_class: ocs-storagecluster-ceph-rbd
@@ -45,7 +45,7 @@ openshift_aap:
     client_secret: "{{ lab_default_password | default('') }}"
     groups_claim: groups
     required_group_names:
-      - access-openshift-admin
+      - access-aap-admin
     protocol_mapper:
       name: groups
       claim_name: groups
@@ -55,9 +55,15 @@ openshift_aap:
       included_client_audience: aap
     validation_username: >-
       {{
-        openshift_oidc_auth.validation.ad_test_user
+        ('ad-aapadmin@' ~ ad_server.domain_name)
         if (lab_configure_ad_trust | default(false) | bool)
-        else openshift_oidc_auth.validation.native_test_user
+        else (
+          idm_server.identity_users
+          | selectattr('groups', 'contains', 'access-aap-admin')
+          | map(attribute='name')
+          | first
+          | default('')
+        )
       }}
     validation_password: >-
       {{

aws-metal-openshift-demo/vars/guests/idm_vm.yml

@@ -254,6 +254,13 @@ idm_server:
       password: "{{ lab_default_password | default('') }}"
       groups:
         - access-developer
+    - name: aapadmin
+      first_name: AAP
+      last_name: Admin
+      shell: /bin/bash
+      password: "{{ lab_default_password | default('') }}"
+      groups:
+        - access-aap-admin
   sudo_policy:
     enabled: true
     rule_name: admins-nopasswd-all