Red Hat Single Sign-On Administration

Procedure 2.3. Instructions

1. On workstation, log in to the sso system as the rhsso user.

   [student@workstation ~]$ ssh rhsso@sso
   ...output omitted...
   [rhsso@sso ~]$

2. Add the RH-SSO directory to your PATH environment variable so you can use the RH-SSO Admin CLI from any location on your file system.

   [rhsso@sso ~]$ export PATH=$PATH:/opt/rh-sso-7.6/bin

3. Log in to the RH-SSO Admin CLI as the admin user in the master realm.

   [rhsso@sso ~]$ kcadm.sh config credentials \
     --server https://sso.lab.example.com:8080/auth --realm master --user admin
   Logging into https://sso.lab.example.com:8080/auth as user admin of realm master
   Enter password: redhat

4. Use the Admin CLI to get all the realms displaying only their name.

   [rhsso@sso ~]$ kcadm.sh get realms --fields realm
   [ {
     "realm" : "master"
   }, {
     "realm" : "rhtraining"
   } ]

5. List the users in the rhtraining realm. The ID for the user might differ in your system.

   [rhsso@sso ~]$ kcadm.sh get users -r rhtraining
   [ {
     "id" : "96c41b1e-4368-4181-af46-efa2e7ba4f1d",
     "username" : "alice",
     "enabled" : true,
     "totp" : false,
     "emailVerified" : false,
     "firstName" : "Alice",
     "lastName" : "Liddel",
     "email" : "alice@keycloak.org",
     "disableableCredentialTypes" : [ ],
     "requiredActions" : [ ],
     "notBefore" : 0,
     "access" : {
       "manageGroupMembership" : true,
       "view" : true,
       "mapRoles" : true,
       "impersonate" : true,
       "manage" : true
     }
   } ]

6. Create the demo realm.

   [rhsso@sso ~]$ kcadm.sh create realms -s realm=demo -s enabled=true
   Created new realm with id 'demo'

7. Create the johndoe user in the demo realm. The ID for the user might differ in your system.

   [rhsso@sso ~]$ kcadm.sh create users -r demo -s username=johndoe -s enabled=true
   Created new user with id 'f4a7ba22-c591-4baf-b053-645a5bdd0687'

8. Update the johndoe user email. Use the user ID from the previous step.

   [rhsso@sso ~]$ kcadm.sh update users/f4a7ba22-c591-4baf-b053-645a5bdd0687 \
     -r demo -s email=johndoe@example.com

9. Set the password for the jonndoe user.

   [rhsso@sso ~]$ kcadm.sh set-password -r demo --username johndoe \
     --new-password redhat

10. Verify that the johndoe user can start an authenticated session to the demo realm, but cannot retrieve the realm information or list the users in the realm.

    1. Log in to the RH-SSO Admin CLI as the johndoe user in the demo realm.

       [rhsso@sso ~]$ kcadm.sh config credentials \
         --server https://sso.lab.example.com:8080/auth --realm demo --user johndoe
       Logging into https://sso.lab.example.com:8080/auth as user johndoe of realm demo
       Enter password: redhat

    2. Retrieve the demo realm information. This command fails because the johndoe user does not have the appropriate permissions.

       [rhsso@sso ~]$ kcadm.sh get realms/demo
       null [unknown_error]

    3. List the users in the demo realm. This command fails because the johndoe user does not have the appropriate permissions.

       [rhsso@sso ~]$ kcadm.sh get users -r demo
       null [unknown_error]

11. Add the view-realm and view-users roles from the realm-management client to the johndoe user. Try to retrieve the realm information and list the users in the realm. These operations should succeed now, because you are assigning the user permissions to view the realm information and list the users in the realm.

    1. Log in to the RH-SSO Admin CLI as the admin user in the master realm. Add the view-realm and view-users roles from the realm-management client to the johndoe user.

       [rhsso@sso ~]$ kcadm.sh config credentials \
         --server https://sso.lab.example.com:8080/auth --realm master --user admin
       Logging into https://sso.lab.example.com:8080/auth as user admin of realm master
       Enter password: redhat
       [rhsso@sso ~]$ kcadm.sh add-roles -r demo --uusername johndoe \
         --cclientid realm-management --rolename view-realm --rolename view-users

    2. Log in to the RH-SSO Admin CLI as the johndoe user in the demo realm. Retrieve the demo realm information and list the users in the realm. The IDs and timestamps might differ in your system.

       [rhsso@sso ~]$ kcadm.sh config credentials \
         --server https://sso.lab.example.com:8080/auth --realm demo --user johndoe
       Logging into https://sso.lab.example.com:8080/auth as user johndoe of realm demo
       Enter password: redhat
       [rhsso@sso ~]$ kcadm.sh get realms/demo
       {
         "id" : "aaa4f976-c6ca-4c38-9810-6ff39feece16",
         "realm" : "demo",
         "notBefore" : 0,
         "defaultSignatureAlgorithm" : "RS256",
         "revokeRefreshToken" : false,
         "refreshTokenMaxReuse" : 0,
         "accessTokenLifespan" : 300,
         "accessTokenLifespanForImplicitFlow" : 900,
       ...output omitted...
       [rhsso@sso ~]$ kcadm.sh get users -r demo
       [ {
         "id" : "f4a7ba22-c591-4baf-b053-645a5bdd0687",
         "createdTimestamp" : 1671104982423,
         "username" : "johndoe",
         "enabled" : true,
         "totp" : false,
         "emailVerified" : false,
         "email" : "johndoe@example.com",
         "disableableCredentialTypes" : [ ],
         "requiredActions" : [ ],
         "notBefore" : 0,
         "access" : {
           "manageGroupMembership" : false,
           "view" : true,
           "mapRoles" : false,
           "impersonate" : false,
           "manage" : false
         }
       } ]

    3. Return to the workstation system as the student user.

       [rhsso@sso ~]$ exit
       logout
       Connection to sso closed.
       [student@workstation ~]$