ceph/doc/radosgw/keycloak.rst

   1 =================================
   2 Keycloak integration with RadosGW
   3 =================================
   4
   5 Keycloak can be setup as an OpenID Connect Identity Provider, which can be used by mobile/ web apps
   6 to authenticate their users. The Web token returned as a result of authentication can be used by the
   7 mobile/ web app to call AssumeRoleWithWebIdentity to get back a set of temporary S3 credentials,
   8 which can be used by the app to make S3 calls.
   9
  10 Setting up Keycloak
  11 ====================
  12
  13 Installing and bringing up Keycloak can be found here: https://www.keycloak.org/docs/latest/server_installation/.
  14
  15 Configuring Keycloak to talk to RGW
  16 ===================================
  17
  18 The following configurables have to be added for RGW to talk to Keycloak::
  19
  20   [client.radosgw.gateway]
  21   rgw sts key = {sts key for encrypting/ decrypting the session token}
  22   rgw s3 auth use sts = true
  23
  24 Example showing how to fetch a web token from Keycloak
  25 ======================================================
  26
  27 Several examples of apps authenticating with Keycloak are given here: https://github.com/keycloak/keycloak-quickstarts/blob/latest/docs/getting-started.md
  28 Taking the example of app-profile-jee-jsp app given in the link above, its client id and client secret, can be used to fetch the
  29 access token (web token) for an application using grant type 'client_credentials' as given below::
  30
  31     KC_REALM=demo
  32     KC_CLIENT=<client id>
  33     KC_CLIENT_SECRET=<client secret>
  34     KC_SERVER=<host>:8080
  35     KC_CONTEXT=auth
  36
  37     # Request Tokens for credentials
  38     KC_RESPONSE=$( \
  39     curl -k -v -X POST \
  40     -H "Content-Type: application/x-www-form-urlencoded" \
  41     -d "scope=openid" \
  42     -d "grant_type=client_credentials" \
  43     -d "client_id=$KC_CLIENT" \
  44     -d "client_secret=$KC_CLIENT_SECRET" \
  45     "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token" \
  46     | jq .
  47     )
  48
  49     KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
  50
  51 An access token can also be fetched for a particular user with grant type 'password', using client id, client secret, username and its password
  52 as given below::
  53
  54     KC_REALM=demo
  55     KC_USERNAME=<username>
  56     KC_PASSWORD=<userpassword>
  57     KC_CLIENT=<client id>
  58     KC_CLIENT_SECRET=<client secret>
  59     KC_SERVER=<host>:8080
  60     KC_CONTEXT=auth
  61
  62    # Request Tokens for credentials
  63     KC_RESPONSE=$( \
  64     curl -k -v -X POST \
  65     -H "Content-Type: application/x-www-form-urlencoded" \
  66     -d "scope=openid" \
  67     -d "grant_type=password" \
  68     -d "client_id=$KC_CLIENT" \
  69     -d "client_secret=$KC_CLIENT_SECRET" \
  70     -d "username=$KC_USERNAME" \
  71     -d "password=$KC_PASSWORD" \
  72     "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token" \
  73     | jq .
  74     )
  75
  76     KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
  77
  78
  79 KC_ACCESS_TOKEN can be used to invoke AssumeRoleWithWebIdentity as given in
  80 :doc:`STS`.
  81
  82 Attaching tags to a user in Keycloak
  83 ====================================
  84
  85 We need to create a user in keycloak, and add tags to it as its attributes.
  86
  87 Add a user as shown below:
  88
  89 .. image:: ../images/keycloak-adduser.png
  90    :align: center
  91
  92 Add user details as shown below:
  93
  94 .. image:: ../images/keycloak-userdetails.png
  95    :align: center
  96
  97 Add user credentials as shown below:
  98
  99 .. image:: ../images/keycloak-usercredentials.png
 100    :align: center
 101
 102 Add tags to the 'attributes' tab of the user as shown below:
 103
 104 .. image:: ../images/keycloak-usertags.png
 105    :align: center
 106
 107 Add a protocol mapper for the user attribute to a client as shown below:
 108
 109 .. image:: ../images/keycloak-userclientmapper.png
 110    :align: center
 111
 112
 113 After following the steps shown above, the tag 'Department' will appear in the JWT (web token), under 'https://aws.amazon.com/tags' namespace.
 114 The tags can be verified using token introspection of the JWT. The command to introspect a token using client id and client secret is shown below::
 115
 116     KC_REALM=demo
 117     KC_CLIENT=<client id>
 118     KC_CLIENT_SECRET=<client secret>
 119     KC_SERVER=<host>:8080
 120     KC_CONTEXT=auth
 121
 122     curl -k -v \
 123     -X POST \
 124     -u "$KC_CLIENT:$KC_CLIENT_SECRET" \
 125     -d "token=$KC_ACCESS_TOKEN" \
 126     "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token/introspect" \
 127     | jq .