Skip to content

Commit b96d2f9

Browse files
jageefrenzyfriday
jagee
authored and
frenzyfriday
committed
Add federation role to ci-framework
This role will setup keycloak as and OpenID provider for user access to openstack.
1 parent 21a8cd5 commit b96d2f9

16 files changed

+753
-0
lines changed

‎docs/dictionary/en-custom.txt

+2
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ https
219219
ic
220220
icjbuue
221221
icokicagy
222+
IdP
222223
idrac
223224
iface
224225
igfsbg
@@ -254,6 +255,7 @@ jzxbol
254255
kcgpby
255256
keepalived
256257
kerberos
258+
keycloak
257259
keypair
258260
keyring
259261
keytab

‎hooks/playbooks/federation-controlplane-config.yml

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
---
2+
- name: Create kustomization to update Keystone to use Federation
3+
hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
4+
tasks:
5+
- name: Create file to customize keystone for Federation resources deployed in the control plane
6+
ansible.builtin.copy:
7+
dest: "{{ cifmw_basedir }}/artifacts/manifests/kustomizations/controlplane/keystone_federation.yaml"
8+
content: |-
9+
apiVersion: kustomize.config.k8s.io/v1beta1
10+
kind: Kustomization
11+
resources:
12+
- namespace: {{ namespace }}
13+
patches:
14+
- target:
15+
kind: OpenStackControlPlane
16+
name: .*
17+
patch: |-
18+
- op: add
19+
path: /spec/tls
20+
value: {}
21+
- op: add
22+
path: /spec/tls/caBundleSecretName
23+
value: keycloakca
24+
- op: add
25+
path: /spec/keystone/template/httpdCustomization
26+
value:
27+
customConfigSecret: keystone-httpd-override
28+
- op: add
29+
path: /spec/keystone/template/customServiceConfig
30+
value: |
31+
[DEFAULT]
32+
insecure_debug=true
33+
debug=true
34+
[federation]
35+
trusted_dashboard={{ '{{ .KeystoneEndpointPublic }}' }}/dashboard/auth/websso/
36+
[openid]
37+
remote_id_attribute=HTTP_OIDC_ISS
38+
[auth]
39+
methods = password,token,oauth1,mapped,application_credential,openid
40+
41+
- name: Get ingress operator CA cert
42+
ansible.builtin.slurp:
43+
src: "{{ [ ansible_user_dir, 'ci-framework-data', 'tmp', 'ingress-operator-ca.crt'] | path_join }}"
44+
register: federation_sso_ca
45+
46+
- name: Add Keycloak CA secret
47+
kubernetes.core.k8s:
48+
kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
49+
state: present
50+
definition:
51+
apiVersion: v1
52+
kind: Secret
53+
type: Opaque
54+
metadata:
55+
name: keycloakca
56+
namespace: "openstack"
57+
data:
58+
KeyCloakCA: "{{ federation_sso_ca.content }}"
59+
60+
- name: Create Keystone httpd override secret for Federation
61+
kubernetes.core.k8s:
62+
kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
63+
state: present
64+
definition:
65+
apiVersion: v1
66+
kind: Secret
67+
metadata:
68+
name: keystone-httpd-override
69+
namespace: openstack
70+
type: Opaque
71+
stringData:
72+
federation.conf: |
73+
OIDCClaimPrefix "{{ cifmw_keystone_OIDC_ClaimPrefix }}"
74+
OIDCResponseType "{{ cifmw_keystone_OIDC_ResponseType }}"
75+
OIDCScope "{{ cifmw_keystone_OIDC_Scope }}"
76+
OIDCClaimDelimiter "{{ cifmw_keystone_OIDC_ClaimDelimiter }}"
77+
OIDCPassUserInfoAs "{{ cifmw_keystone_OIDC_PassUserInfoAs }}"
78+
OIDCPassClaimsAs "{{ cifmw_keystone_OIDC_PassClaimsAs }}"
79+
OIDCCacheType "{{ cifmw_keystone_OIDC_CacheType }}"
80+
OIDCMemCacheServers "{{ '{{ .MemcachedServers }}' }}"
81+
OIDCProviderMetadataURL "{{ cifmw_keystone_OIDC_ProviderMetadataURL }}"
82+
OIDCClientID "{{ cifmw_keystone_OIDC_ClientID }}"
83+
OIDCClientSecret "{{ cifmw_keystone_OIDC_ClientSecret }}"
84+
OIDCCryptoPassphrase "{{ cifmw_keystone_OIDC_CryptoPassphrase }}"
85+
OIDCOAuthClientID "{{ cifmw_keystone_OIDC_OAuthClientID }}"
86+
OIDCOAuthClientSecret "{{ cifmw_keystone_OIDC_OAuthClientSecret }}"
87+
OIDCOAuthIntrospectionEndpoint "{{ cifmw_keystone_OIDC_OAuthIntrospectionEndpoint }}"
88+
OIDCRedirectURI "{{ '{{ .KeystoneEndpointPublic }}' }}/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso"
89+
90+
<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso">
91+
AuthType "openid-connect"
92+
Require valid-user
93+
</LocationMatch>
94+
95+
<Location ~ "/v3/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/auth">
96+
AuthType oauth20
97+
Require valid-user
98+
</Location>
99+
100+
<LocationMatch "/v3/auth/OS-FEDERATION/websso/openid">
101+
AuthType "openid-connect"
102+
Require valid-user
103+
</LocationMatch>

‎hooks/playbooks/federation-post-deploy.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Run federation setup on openstack post reproducer deploy
18+
hosts: "{{ cifmw_target_host | default('localhost') }}"
19+
gather_facts: true
20+
tasks:
21+
- name: Set urls for install type uni
22+
ansible.builtin.set_fact:
23+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
24+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
25+
when: cifmw_federation_deploy_type == "uni"
26+
27+
- name: Set urls for install type crc
28+
ansible.builtin.set_fact:
29+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
30+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
31+
when: cifmw_federation_deploy_type == "crc"
32+
33+
- name: Run federation setup on OSP
34+
ansible.builtin.import_role:
35+
name: federation
36+
tasks_from: run_openstack_setup.yml
37+
38+
- name: Run federation OSP User Auth test
39+
ansible.builtin.import_role:
40+
name: federation
41+
tasks_from: run_openstack_auth_test.yml

‎hooks/playbooks/federation-pre-deploy.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Run federation SSO setup on reproducer
18+
hosts: "{{ cifmw_target_host | default('localhost') }}"
19+
gather_facts: true
20+
tasks:
21+
- name: Set urls for install type uni
22+
ansible.builtin.set_fact:
23+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
24+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
25+
when: cifmw_federation_deploy_type == "uni"
26+
27+
- name: Set urls for install type crc
28+
ansible.builtin.set_fact:
29+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
30+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
31+
when: cifmw_federation_deploy_type == "crc"
32+
33+
- name: Run SSO pod setup on Openshift
34+
ansible.builtin.import_role:
35+
name: federation
36+
tasks_from: run_keycloak_setup.yml
37+
38+
- name: Run SSO realm setup for OSP
39+
ansible.builtin.import_role:
40+
name: federation
41+
tasks_from: run_keycloak_realm_setup.yml

‎roles/federation/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
federation
2+
=========
3+
4+
This role will setup Openstack for user federation. The keycloak system will be used for the IdP provider.

‎roles/federation/defaults/main.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
# defaults file for federation
3+
#
4+
cifmw_federation_keycloak_namespace: openstack
5+
cifmw_federation_keycloak_realm: openstack
6+
cifmw_federation_keycloak_admin_username: admin
7+
cifmw_federation_keycloak_admin_password: nomoresecrets
8+
cifmw_federation_keycloak_testuser1_username: kctestuser1
9+
cifmw_federation_keycloak_testuser1_password: nomoresecrets1
10+
cifmw_federation_keycloak_testuser2_username: kctestuser2
11+
cifmw_federation_keycloak_testuser2_password: nomoresecrets2
12+
cifmw_federation_keycloak_testgroup1_name: kctestgroup1
13+
cifmw_federation_keycloak_testgroup2_name: kctestgroup2
14+
cifmw_federation_keycloak_client_id: rhoso
15+
cifmw_federation_keycloak_client_secret: COX8bmlKAWn56XCGMrKQJj7dgHNAOl6f
16+
cifmw_federation_keycloak_url_validate_certs: false
17+
cifmw_federation_run_osp_cmd_namespace: openstack
18+
cifmw_federation_domain: SSO
19+
cifmw_federation_IdpName: kcIDP
20+
cifmw_federation_remote_id: '{{ cifmw_federation_keycloak_url }}/auth/realms/{{ cifmw_federation_keycloak_realm }}'
21+
cifmw_federation_project_name: SSOproject
22+
cifmw_federation_group_name: SSOgroup
23+
cifmw_federation_mapping_name: SSOmap
24+
cifmw_federation_rules_file: rules.json
25+
cifmw_federation_clame_id: OIDC-preferred_username

‎roles/federation/tasks/run_keycloak_realm_setup.yml

+129
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Create a Keycloak realm
18+
community.general.keycloak_realm:
19+
auth_client_id: admin-cli
20+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
21+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
22+
auth_realm: master
23+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
24+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
25+
id: "{{ cifmw_federation_keycloak_realm }}"
26+
realm: "{{ cifmw_federation_keycloak_realm }}"
27+
enabled: true
28+
state: present
29+
30+
- name: Create Keycloak client
31+
community.general.keycloak_client:
32+
auth_client_id: admin-cli
33+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
34+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
35+
auth_realm: master
36+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
37+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
38+
state: present
39+
realm: "{{ cifmw_federation_keycloak_realm }}"
40+
client_id: "{{ cifmw_federation_keycloak_client_id }}"
41+
id: 3fb4f68d-ad2c-46e7-a579-ea418f5d150b
42+
name: 'RHOSO Client'
43+
description: 'RHOSO client for keystone federation'
44+
root_url: "{{ cifmw_federation_keystone_url }}"
45+
admin_url: "{{ cifmw_federation_keystone_url }}"
46+
base_url: '/projects/dashboard'
47+
enabled: true
48+
client_authenticator_type: client-secret
49+
secret: "{{ cifmw_federation_keycloak_client_secret }}"
50+
redirect_uris:
51+
- "{{ cifmw_federation_keystone_url }}/v3/auth/OS-FEDERATION/identity_providers/kcIDP/protocols/openid/websso"
52+
- "{{ cifmw_federation_keystone_url }}/v3/auth/OS-FEDERATION/websso/openid"
53+
web_origins:
54+
- "{{ cifmw_federation_keystone_url }}"
55+
bearer_only: false
56+
public_client: false
57+
protocol: openid-connect
58+
59+
- name: Create a Keycloak group1
60+
community.general.keycloak_group:
61+
auth_client_id: admin-cli
62+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
63+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
64+
auth_realm: master
65+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
66+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
67+
state: present
68+
name: "{{ cifmw_federation_keycloak_testgroup1_name }}"
69+
realm: "{{ cifmw_federation_keycloak_realm }}"
70+
71+
- name: Create a Keycloak group2
72+
community.general.keycloak_group:
73+
auth_client_id: admin-cli
74+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
75+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
76+
auth_realm: master
77+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
78+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
79+
state: present
80+
name: "{{ cifmw_federation_keycloak_testgroup2_name }}"
81+
realm: "{{ cifmw_federation_keycloak_realm }}"
82+
83+
- name: Create keycloak user1
84+
community.general.keycloak_user:
85+
auth_client_id: admin-cli
86+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
87+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
88+
auth_realm: master
89+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
90+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
91+
state: present
92+
realm: "{{ cifmw_federation_keycloak_realm }}"
93+
username: "{{ cifmw_federation_keycloak_testuser1_username }}"
94+
firstName: firstname1
95+
lastName: lastname1
96+
email: "{{ cifmw_federation_keycloak_testuser1_username }}@ocp.openstack.lab"
97+
enabled: true
98+
emailVerified: false
99+
credentials:
100+
- type: password
101+
value: "{{ cifmw_federation_keycloak_testuser1_password }}"
102+
temporary: false
103+
groups:
104+
- name: "{{ cifmw_federation_keycloak_testgroup1_name }}"
105+
state: present
106+
107+
- name: Create keycloak user2
108+
community.general.keycloak_user:
109+
auth_client_id: admin-cli
110+
validate_certs: "{{ cifmw_federation_keycloak_url_validate_certs }}"
111+
auth_keycloak_url: "{{ cifmw_federation_keycloak_url }}/auth"
112+
auth_realm: master
113+
auth_username: "{{ cifmw_federation_keycloak_admin_username }}"
114+
auth_password: "{{ cifmw_federation_keycloak_admin_password }}"
115+
state: present
116+
realm: "{{ cifmw_federation_keycloak_realm }}"
117+
username: "{{ cifmw_federation_keycloak_testuser2_username }}"
118+
firstName: firstname2
119+
lastName: lastname2
120+
email: "{{ cifmw_federation_keycloak_testuser2_username }}@ocp.openstack.lab"
121+
enabled: true
122+
emailVerified: false
123+
credentials:
124+
- type: password
125+
value: "{{ cifmw_federation_keycloak_testuser2_password }}"
126+
temporary: false
127+
groups:
128+
- name: "{{ cifmw_federation_keycloak_testgroup2_name }}"
129+
state: present

0 commit comments

Comments
 (0)