1 =================================
2 Keycloak integration with RadosGW
3 =================================
5 Keycloak can be setup as an OpenID Connect Identity Provider, which can be used by mobile/ web apps
6 to authenticate their users. The Web token returned as a result of authentication can be used by the
7 mobile/ web app to call AssumeRoleWithWebIdentity to get back a set of temporary S3 credentials,
8 which can be used by the app to make S3 calls.
13 Installing and bringing up Keycloak can be found here: https://www.keycloak.org/docs/latest/server_installation/.
15 Configuring Keycloak to talk to RGW
16 ===================================
18 The following configurables have to be added for RGW to talk to Keycloak.
19 The format of token inspection url is https://[base-server-url]/token/introspect::
21 [client.radosgw.gateway]
22 rgw sts key = {sts key for encrypting/ decrypting the session token}
23 rgw s3 auth use sts = true
25 Example showing how to fetch a web token from Keycloak
26 ======================================================
28 Several examples of apps authenticating with Keycloak are given here: https://github.com/keycloak/keycloak-quickstarts/blob/latest/docs/getting-started.md
29 Taking the example of app-profile-jee-jsp app given in the link above, its client secret and client password, can be used to fetch the
30 access token (web token) as given below::
34 KC_CLIENT_SECRET=<client secret>
38 # Request Tokens for credentials
41 -H "Content-Type: application/x-www-form-urlencoded" \
43 -d "grant_type=client_credentials" \
44 -d "client_id=$KC_CLIENT" \
45 -d "client_secret=$KC_CLIENT_SECRET" \
46 "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token" \
50 KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
52 KC_ACCESS_TOKEN can be used to invoke AssumeRoleWithWebIdentity as given in