Skip to content
This repository was archived by the owner on Mar 9, 2020. It is now read-only.

Commit e77ef5b

Browse files
xmlkingxmlking
committed
polish
1 parent cc1a961 commit e77ef5b

File tree

49 files changed

+3927
-80
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+3927
-80
lines changed

‎.deploy/keycloak/Dockerfile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM jboss/keycloak-openshift:4.3.0.Final
2+
LABEL maintainer="Sumanth <xmlking@gmail.com>"
3+
4+
COPY configuration/* $JBOSS_HOME/standalone/configuration/
5+
6+
ENV DB_VENDOR H2
7+
EXPOSE 9080
8+
9+
CMD ["start-keycloak.sh", "-b", "0.0.0.0", "-Dkeycloak.migration.action=import", "-Dkeycloak.migration.provider=dir", "-Dkeycloak.migration.strategy=OVERWRITE_EXISTING","-Dkeycloak.migration.dir=/opt/jboss/keycloak/realm-config", "-Djboss.socket.binding.port-offset=1000"]
10+

‎.deploy/keycloak/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
KeyClock
2+
========
3+
Deploying KeyCloak on OpenShift Origin
4+
5+
### Build
6+
```bash
7+
# build stateless KeyCloak docker image
8+
cd .deploy/keycloak
9+
docker build --tag=keycloak-openshift-stateless .
10+
# Tag
11+
docker tag xmlking/keycloak-openshift-stateless:4.3.0.Final
12+
docker tag xmlking/keycloak-openshift-stateless:4.3.0.Final xmlking/keycloak-openshift-stateless:latest
13+
# Push
14+
docker push xmlking/keycloak-openshift-stateless:4.3.0.Final
15+
docker push xmlking/keycloak-openshift-stateless:latest
16+
```
17+
18+
### Deploy
19+
20+
#### OpenShift Deployment
21+
> Deploy KeyCloak to OpenShift
22+
23+
```bash
24+
# login with your ID
25+
oc login <my OpenShift URL>
26+
# oc login https://console.starter-us-west-1.openshift.com
27+
oc project ngx-starter-kit
28+
cd .deploy/keycloak
29+
30+
# create app (first time deployment)
31+
oc new-app -f keycloak.tmpl.yml -p APPNAME=keycloak -n ngx-starter-kit
32+
33+
# follow next steps if you want completely delete and deploy.
34+
# delete only deploymentConfig
35+
oc delete all -l app=keycloak -n ngx-starter-kit
36+
37+
# delete fully
38+
oc delete all,configmap,secret -l app=keycloak -n ngx-starter-kit
39+
40+
# redeploy
41+
From OpenShift Console UI
42+
Applications > Deployments > ngx-starter-kit > Deploy
43+
```
44+
45+
#### Envelopment Variables
46+
```bash
47+
# When running Keycloak behind a proxy, you will need to enable proxy address forwarding.
48+
PROXY_ADDRESS_FORWARDING=true
49+
```
50+
51+
### Export
52+
> if you change keycloak config via UI,
53+
> you may want to export changes and check-in in Git for automated deployment next time.
54+
```bash
55+
# get keycloak pod name
56+
oc get pods
57+
# ssh to pod
58+
oc rsh <keycloak-pod-name>
59+
# in the shell , run
60+
/bin/sh /opt/jboss/keycloak/bin/standalone.sh -Dkeycloak.migration.realmName=kubernetes -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=dir -Dkeycloak.migration.dir=/tmp/sumo
61+
# copy files back to codebase
62+
oc rsync <pod-name>:/tmp/sumo /Developer/Work/SPA/ngx-starter-kit/.deploy/keycloak
63+
```
64+
65+
### Reference
66+
* Secure a Spring Boot Rest app with Spring Security and Keycloak
67+
* https://sandor-nemeth.github.io/java/spring/2017/06/15/spring-boot-with-keycloak.html
68+
69+
* https://github.com/clevercloud-jhipster/clevercloud-keycloak-jhipster-ldap/blob/master/Dockerfile

‎.deploy/keycloak/TESTING.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
KeyCloak Testing
2+
================
3+
4+
Pre-configured KeyCloak OpenID Connect server for testing.
5+
6+
* **Realm**: kubernetes
7+
* **Client ID**: kube-tenant
8+
* **Accounts**:
9+
* *ROLE_ADMIN*
10+
1. kubeadmin : kubeadmin
11+
* *ROLE_USER*
12+
1. sumo: demo
13+
2. sumo1: demo
14+
3. sumo2: demo
15+
4. sumo3: demo
16+
17+
18+
### Configure SPA Client
19+
20+
> set issuer, clientId in apps/webapp/src/environments/environment.ts
21+
22+
```json
23+
auth: {
24+
clientId: 'cockpit',
25+
issuer: 'http://localhost:9080/auth/realms/kubernetes'
26+
}
27+
```
28+
29+
### Start
30+
31+
```bash
32+
# Start keycloak
33+
docker-compose up keycloak
34+
35+
# Stop keycloak
36+
docker-compose stop keycloak
37+
# this will remove volume created by docker.
38+
docker-compose down
39+
40+
# SSH into keycloak container
41+
docker-compose exec keycloak sh
42+
43+
# if you want to export keycloak config to local host
44+
/bin/sh /opt/jboss/keycloak/bin/standalone.sh -Dkeycloak.migration.realmName=kubernetes -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=dir -Dkeycloak.migration.dir=/tmp/sumo
45+
# copy exported files to localhost
46+
docker cp <containerId>:/tmp/sumo /Developer/Work/SPA/ngx-starter-ki/.deploy/keycloak
47+
```
48+
49+
50+
### Use
51+
52+
http://localhost:9080/
53+
> admin: admin123
54+
55+
### Test
56+
57+
```bash
58+
# Environment variable. change as per your server setup
59+
OIDC_BASE_URL=http://localhost:9080/auth/realms/kubernetes
60+
CLIENT_ID=kube-tenant
61+
62+
USERNAME=sumo
63+
PASSWORD=demo
64+
65+
# get URLs
66+
curl $OIDC_BASE_URL/.well-known/openid-configuration | jq .
67+
#get certs
68+
curl $OIDC_BASE_URL/protocol/openid-connect/certs | jq .
69+
70+
# Get tokens
71+
response=$(curl -X POST $OIDC_BASE_URL/protocol/openid-connect/token \
72+
-H "Content-Type: application/x-www-form-urlencoded" \
73+
-d username=$USERNAME \
74+
-d password=$PASSWORD \
75+
-d client_id=$CLIENT_ID \
76+
-d 'grant_type=password' \
77+
-d 'scope=openid')
78+
79+
access_token=$(echo $response | jq -r '.access_token')
80+
id_token=$(echo $response | jq -r '.id_token')
81+
refresh_token=$(echo $response | jq -r '.refresh_token')
82+
83+
# Print tokens
84+
echo $access_token
85+
echo $id_token
86+
echo $refresh_token
87+
88+
# Get User Profile
89+
curl -X POST $OIDC_BASE_URL/protocol/openid-connect/userinfo \
90+
-H "Content-Type: application/x-www-form-urlencoded" \
91+
-d "access_token=$access_token" | jq .
92+
93+
# Logout
94+
curl -X POST $OIDC_BASE_URL/protocol/openid-connect/logout \
95+
-H "Content-Type: application/x-www-form-urlencoded" \
96+
-d client_id=$CLIENT_ID \
97+
-d "refresh_token=$refresh_token" | jq .
98+
```
99+
100+
#### Example Access Token
101+
```json
102+
{
103+
"jti": "726d3a1b-4d1c-44e0-b645-f6c8b38ed83f",
104+
"exp": 1529217929,
105+
"nbf": 0,
106+
"iat": 1529217629,
107+
"iss": "http://localhost:9080/auth/realms/kubernetes",
108+
"aud": "kube-tenant",
109+
"sub": "8602c118-9778-4eda-98a0-673382934688",
110+
"typ": "Bearer",
111+
"azp": "kube-tenant",
112+
"auth_time": 0,
113+
"session_state": "698b3e16-4f53-46b4-aa7f-ddc05c2f9ae8",
114+
"acr": "1",
115+
"allowed-origins": [
116+
"http://localhost:4200"
117+
],
118+
"realm_access": {
119+
"roles": [
120+
"offline_access",
121+
"uma_authorization"
122+
]
123+
},
124+
"resource_access": {
125+
"kube-tenant": {
126+
"roles": [
127+
"ROLE_USER"
128+
]
129+
},
130+
"account": {
131+
"roles": [
132+
"manage-account",
133+
"manage-account-links",
134+
"view-profile"
135+
]
136+
}
137+
},
138+
"scope": "openid profile email",
139+
"email_verified": false,
140+
"name": "sumo demo",
141+
"preferred_username": "sumo",
142+
"given_name": "sumo",
143+
"family_name": "demo",
144+
"email": "sumo@demo.com"
145+
}
146+
```
147+
148+
149+
### References
150+
* Kubernetes Day 2 Operations: AuthN/AuthZ with OIDC and a Little Help From Keycloak
151+
* https://medium.com/@mrbobbytables/kubernetes-day-2-operations-authn-authz-with-oidc-and-a-little-help-from-keycloak-de4ea1bdbbe
152+
* https://github.com/making/k8s-keycloak-oidc-helper/blob/master/k8s-keycloak-oidc-helper.sh

0 commit comments

Comments
 (0)