Red Hat Single Sign-On Administration

If your server is accessible from the localhost URL or the address that you configured, then you can use that URL to access the RH-SSO Admin Console. In that case, use your web browser to navigate to the RH-SSO web UI URL (by default https://localhost:8080/auth). Then, log in as the admin user with the password that you previously configured.

By default, the main page shows the Configure → Realm Settings menu. The first time you access the Admin Console the Master realm is selected, because it is the only realm in RH-SSO. In the Configure → Realm Settings menu you can configure the SSL mode and the realm keys, or control login options, among other parameters.

Figure 2.4: Admin Console Realm Settings menu

You can switch between realms by hovering over the Master realm name in the left menu of your screen and selecting the realm name. You can also create new realms by clicking the Add realm button in the same menu.

Figure 2.5: Admin Console realm selection menu

In the Configure → Clients menu, you can configure the trusted browser applications and web services in a realm, and define client specific roles.

The Configure → Roles menu allows you to define specific client permissions and access control.

In the Manage → Users menu, you can manage the users in a realm.

The Manage → Events menu displays saved events for the realm related to user accounts, events related to the admin account, and configuration options for that events.

When users log in to realms, RH-SSO maintains a user session for each user and remembers each client visited by the user within the session. Realm administrators can perform multiple actions on each user session, such as view login statistics for the realm, view active users and where they logged in, log a user out of their session, or revoke user tokens. To see all active sessions in the realm, you can click Manage → Sessions in the left menu.

The Admin Console provides important information for some of the menu items. To display it, hover over the question mark symbol (?) when it is shown.

Figure 2.6: Admin Console menu information

You can create new realms from the Master realm. To do this you must first log in as the admin user in the Admin Console. Then, hover over the Master realm name in the left menu of your screen and click the Add realm button.

In the Add realm configuration page, you can type the name for the new realm and click Create. You can also import a realm from an existing JSON file.

After you create or import a realm, the main page shows the Configure → Realm Settings menu. Then, the different tabs allow you to configure the realm parameters, as for example the login options for the users in the realm, the cryptographic key pairs for authentication, or the web UI appearance.

You can export or import a realm by using the RH-SSO Admin Console. Exporting a realm by using the RH-SSO Admin Console enables you to export the realm configuration, the groups, the roles, and the clients in the realm. However, you cannot export the realm users by using the RH-SSO Admin Console.

You can also export or import your entire database by using RH-SSO, including the users. This feature is useful to migrate your whole RH-SSO database from one environment to another, or migrate to a different database provider. To do so, you have to export or import the realm at server boot by using system properties.

To export a realm, first log in as the admin user in the RH-SSO Admin Console. Then, click the Manage → Export menu. Use the switch buttons to include realm groups, roles, and clients in the export file. Then, click Export to export your realm data in a JSON file.

The following JSON file is an example of a realm exported by using the RH-SSO Admin Console.

{
  "id": "30994549-9ada-4d7e-a8df-96acda9faf55", 
  "realm": "rhtraining",
  ...output omitted...
  "roles": { 
    "realm": [
      ...output omitted...
      {
        "id": "2a8717b1-dd28-482b-8ef0-96530de8d701",
        "name": "offline_access",
        "description": "${role_offline-access}",
        "composite": false,
        "clientRole": false,
        "containerId": "30994549-9ada-4d7e-a8df-96acda9faf55",
        "attributes": {}
      },
      ...output omitted...
    ],
    "client": {
      "realm-management": [
        {
          "id": "4a4a1b2f-e47f-454d-aeb0-cc57aa72948e",
          "name": "impersonation",
          "description": "${role_impersonation}",
          "composite": false,
          "clientRole": true,
          "containerId": "df86a657-7005-43a8-b585-8ae7c36c887a",
          "attributes": {}
        },
        ...output omitted...
      ],
      ...output omitted...
    }
  },
  "groups": [], 
  ...output omitted...
  "clients": [ 
    {
      "id": "8ce79755-3c7c-483c-88e6-f2106cf7aab2",
      "clientId": "account",
      "name": "${client_account}",
      "rootUrl": "${authBaseUrl}",
      "baseUrl": "/realms/rhtraining/account/",
      "surrogateAuthRequired": false,
      "enabled": true,
      "alwaysDisplayInConsole": false,
      "clientAuthenticatorType": "client-secret",
      "redirectUris": [
        "/realms/rhtraining/account/*"
      ],
      ...output omitted...
    },
    ...output omitted...
  ],
  ...output omitted...
}

To import a realm to RH-SSO, first log in as the admin user in the RH-SSO Admin Console. Then, click the Manage → Import menu. Click Select file and select the realm JSON file. After RH-SSO loads the file, use the switch buttons to configure the import of realm groups, roles, and clients. You can also select the RH-SSO behavior if an imported resource exists in the database. The three options are:

Finally, click Import to import the realm to RH-SSO.

If you import a realm by using the RH-SSO, then you can overwrite existing resources. Thus, use this feature with caution, especially on a production server. Note that JSON files obtained by exporting realms from the RH-SSO Admin Console are not appropriate for directly importing data because they contain invalid values for secrets. However, you can manually modify the secret values.

Furthermore, you can use the exported JSON files to know all the fields, and their values that the RH-SSO resources use. You can use the fields of the resources to configure them by using automated tools such as the kcadm.sh CLI tool, the REST API, or the YAML files used by the RH-SSO operator.

When you want to interact with applications accessed by people, and those persons require to be logged in, then you need to create a user. The user entity has:

You can create users internally in the realm by saving them in the database, or you can import them from an external identity provider. Other way to manage users is to federate an external user database, such as Lightweight Directory Access Protocol (LDAP) or Identity Management (IdM). This section only covers how to create users by saving them in the RH-SSO local database. Other ways to manage users are covered in more detail later in this course.

To create a user in the realm, click Manage → Users. Then, click Add user. The Add user configuration screen appears, where you can enter the details for the new user. Note that the username is the only required field. Click Save to create the user.

After you create the user, the user configuration page appears. In the Credentials tab you can apply limited types of credentials for the users, albeit the users should be responsible for managing the type of credentials they are going to use.

In the Sessions tab, you can verify the clients that the user is logged into. Then, you can log out the user from a specific client or log out from all the client sessions.

Clients are entities that can request authentication of a user. Clients come in two forms. The first type of client is an application that wants to interact with SSO. These clients just want RH-SSO to provide security for them. The other type of client is one that requests an access token so that it can invoke other services on behalf of the authenticated user.

There are two kind of clients with standard protocol for connections: the OpenID Connect (OIDC) client and the Security Assertion Markup Language (SAML). To create a client, in the Configure → Clients menu click Create. The Add Client configuration page appears, where you must provide a client ID, and select the client protocol between OIDC and SAML. Click Save to create the client. Configuration parameters for clients are covered in more detail later in this course.