Red Hat Single Sign-On Administration

Bookmark this page
P123456
PreviousNext

Configure Red Hat Single Sign-On on Red Hat OpenShift

Objectives

  • Configure Red Hat Single Sign-On on Red Hat OpenShift using custom resource definitions.

Configure Red Hat Single Sign-On on Red Hat OpenShift

In other sections of this book you learned about the Keycloak custom resource definition (CRD), which defines the workloads running RH-SSO and the administrator credentials.

After you create a Keycloak custom resource, you must create one or more realms, the clients for those realms, and the users. The RH-SSO operator defines a CRD for each of those entities, plus one KeycloakBackup CRD. However, the KeycloakBackup CRD is deprecated and no longer supported in production environments.

The KeycloakRealm CRD

The KeycloakRealm resource represents a RH-SSO realm. It requires an existing Keycloak resource.

You can use the following YAML code to create a KeycloakRealm custom resource.

apiVersion: keycloak.org/v1alpha1
kind: KeycloakRealm
metadata:
  name: rhtraining 1
  labels:
    app: sso
spec:
  instanceSelector:
    matchLabels:
      app: sso 2
  realm: 3
    id: rhtraining 4
    enabled: True
    displayName: "RH Training Realm"
    sslRequired: "external"
    registrationAllowed: True 5
    passwordPolicy: "length(8) and specialChars(1)" 6

1

The name for this custom resource

2

The label selector, which must match a label from an existing Keycloak resource.

3

All the fields within the realm refer to a property for the configuration of the realm.

4

The name of the realm.

5

Enables the user registration in the realm.

6

Sets a password policy to force a minimum length of eight characters, and another password policy to force the inclusion of a special character.

Use the oc create command to create the KeycloakRealm custom resource. If you store the CRD in a keycloakrealm.yaml file , then you can create a KeycloakRealm custom resource in the rhsso namespace with the following command:

[user@demo ~]$ oc create -f keycloakrealm.yaml -n rhsso

Note that if you change any realm configuration by using the RH-SSO Admin Console, then the change persists in the RH-SSO database. However, the change does not reflect in the resource that the operator creates.

The KeycloakClient CRD

The KeycloakClient resource represents a RH-SSO client or application. It requires an existing KeycloakRealm resource. You can use the following YAML code to create a KeycloakClient custom resource.

apiVersion: keycloak.org/v1alpha1
kind: KeycloakClient
metadata:
  name: oidc-confidential-client 1
  labels:
    app: sso
spec:
  realmSelector:
    matchLabels:
      app: sso 2
  client: 3
    clientId: finance-webapp 4
    secret: passw0rd 5
    defaultClientScopes:
      - email
      - offline_access
      - profile
      - roles
    implicitFlowEnabled: False
    standardFlowEnabled: True
    directAccessGrantsEnabled: False 6
    publicClient: False 7
    bearerOnly: False
    serviceAccountsEnabled: True 8
    redirectUris: 9
      - http://finance-webapp.apps.ocp4.example.com/finance/*
    rootUrl: http://finance-webapp.apps.ocp4.example.com/finance

1

The name for the custom resource.

2

The label selector, which must match a label from an existing KeycloakRealm resource.

3

All the fields within the client refer to a property for the configuration of the client.

4

The client ID in the OIDC standard.

5

The secret for the client. The RH-SSO operator creates a Kubernetes secret with the following name pattern: keycloak-client-secret-clientId.

6

Disables the direct access grant OIDC flow.

7

Set this client as a confidential client.

8

Enable service accounts for this client.

9

The mandatory URIs to return from an authentication and authorization flow.

If you store the CRD in a keycloakclient.yaml file , then you can create a KeycloakClient custom resource in the rhsso namespace with the following command:

[user@demo ~]$ oc create -f keycloakclient.yaml -n rhsso

Note that if you change any client configuration by using the RH-SSO Admin Console, then the change persists in the RH-SSO database. However, the change does not reflect in the resource that the operator creates.

The KeycloakUser CRD

The KeycloakUser resource represents a RH-SSO user. It requires an existing KeycloakRealm resource.

You can use the following YAML code to create a KeycloakUser custom resource.

apiVersion: keycloak.org/v1alpha1
kind: KeycloakUser
metadata:
  name: user1 1
  labels:
    app: sso
spec:
  realmSelector:
    matchLabels:
      app: sso 2
  user: 3
    username: alice
    credentials:
      - temporary: False
        type: password
        value: redhat
    firstName: Alice
    lastName: Liddle
    email: alice@example.com
    enabled: True
    emailVerified: True
    realmRoles: 4
      - marketing-user

1

The name for the custom resource.

2

The label selector, which must match a label from an existing KeycloakRealm resource.

3

All the fields within the user refer to a property for the configuration of the user.

4

List of the user's realm roles.

If you store the CRD in a keycloakuser.yaml file , then you can create a KeycloakUser custom resource in the rhsso namespace with the following command:

[user@demo ~]$ oc create -f keycloakuser.yaml -n rhsso

If any field in the KeycloakUser resource is not valid, then the user creation fails. For example, if you use redhat as the password, and the password policies do not allow that word, then the user creation fails.

Note that if you change any client configuration by using the RH-SSO Admin Console, then the change persists in the RH-SSO database. However, the change does not reflect in the resource that the operator creates.

Choosing between CRDs versus the Admin Console or the Admin CLI

If you choose to deploy RH-SSO by installing the RH-SSO operator, then you must use the Keycloak CRD to create and configure the infrastructure for serving the RH-SSO endpoints.

However, as an RH-SSO administrator, you must choose a coherent way to modify the configuration of the realms, the clients, the roles, and all the other RH-SSO resources. If you create a realm as a KeycloakRealm resource, then you must modify it only by using the custom resource, not the Admin Console. For example, if you create a realm by using the RH-SSO admin CLI, then there is not a KeycloakRealm resource available to make modifications on it. Thus, you can only modify it by using the admin CLI, or the Admin Console.

References

For more information about the RH-SSO Operator CRDs, refer to the Red Hat Single Sign-On Operator chapter in the RH-SSO 7.6 documentation at https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.6/html-single/server_installation_and_configuration_guide/index#operator

Knowledgebase:"How to configure an Identity Provider on Red Hat Single Sign-On (RH SSO) using the Operator?"

Knowledgebase:"Filter out / exclude the operator events in the 'Login Events' and the 'Admin Events'"

PreviousNext
Revision: do313-7.6-bc10333