Chapter 7. Using Red Hat Single Sign-On Operator with automation hub

Procedure

1. Navigate to Operator Installed Operators.
2. Select the rh-sso project.
3. Select the Red Hat Single Sign-On Operator.
4. On the Red Hat Single Sign-On Operator details page select Keycloak.
5. Click Create instance.

6. Click YAML view.

   The default Keycloak custom resource is as follows:

   apiVersion: keycloak.org/v1alpha1
   kind: Keycloak
   metadata:
     name: example-keycloak
     labels:
   	app: sso
     namespace: aap
   spec:
     externalAccess:
   	enabled: true
     instances: 1

7. Click Create.
8. When deployment is complete, you can use this credential to login to the administrative console.
9. You can find the credentials for the administrator in the credential-<custom-resource> (example keycloak) secret in the namespace.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak Realm.

4. On the Keycloak Realm form, select YAML view. Edit the YAML file as follows:

   kind: KeycloakRealm
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: ansible-automation-platform-keycloakrealm
     namespace: rh-sso
     labels:
       app: sso
       realm: ansible-automation-platform
   spec:
     realm:
       id: ansible-automation-platform
       realm: ansible-automation-platform
       enabled: true
       displayName: Ansible Automation Platform
     instanceSelector:
       matchLabels:
         app: sso

   Field	Description
   metadata.name	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.namespace	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.labels.app	Set labels to a unique value. This is used when creating the client CR.
   metadata.labels.realm	Set labels to a unique value. This is used when creating the client CR.
   spec.realm.id	Set the realm name and id. These must be the same.
   spec.realm.realm	Set the realm name and id. These must be the same.
   spec.realm.displayname	Set the name to display.

5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Client tab and click Create Keycloak Client.
4. On the Keycloak Realm form, select YAML view.

5. Replace the default YAML file with the following:

   kind: KeycloakClient
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: automation-hub-client-secret
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     client:
       name: Automation Hub
       clientId: automation-hub
       secret: <client-secret>                        1
       clientAuthenticatorType: client-secret
       description: Client for automation hub
       attributes:
         user.info.response.signature.alg: RS256
         request.object.signature.alg: RS256
       directAccessGrantsEnabled: true
       publicClient: true
       protocol: openid-connect
       standardFlowEnabled: true
       protocolMappers:
         - config:
             access.token.claim: "true"
             claim.name: "family_name"
             id.token.claim: "true"
             jsonType.label: String
             user.attribute: lastName
             userinfo.token.claim: "true"
           consentRequired: false
           name: family name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
         - config:
             userinfo.token.claim: "true"
             user.attribute: email
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: email
             jsonType.label: String
           name: email
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             multivalued: "true"
             access.token.claim: "true"
             claim.name: "resource_access.${client_id}.roles"
             jsonType.label: String
           name: client roles
           protocol: openid-connect
           protocolMapper: oidc-usermodel-client-role-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: firstName
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: given_name
             jsonType.label: String
           name: given name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             userinfo.token.claim: "true"
           name: full name
           protocol: openid-connect
           protocolMapper: oidc-full-name-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: username
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: preferred_username
             jsonType.label: String
           name: <username>
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             access.token.claim: "true"
             claim.name: "group"
             full.path: "true"
             id.token.claim: "true"
             userinfo.token.claim: "true"
           consentRequired: false
           name: group
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
         - config:
             multivalued: 'true'
             id.token.claim: 'true'
             access.token.claim: 'true'
             userinfo.token.claim: 'true'
             usermodel.clientRoleMapping.clientId:  'automation-hub'
             claim.name: client_roles
             jsonType.label: String
           name: client_roles
           protocolMapper: oidc-usermodel-client-role-mapper
           protocol: openid-connect
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             included.client.audience: 'automation-hub'
           protocol: openid-connect
           name: audience mapper
           protocolMapper: oidc-audience-mapper
     roles:
       - name: "hubadmin"
         description: "An administrator role for automation hub"

   1

   Replace this with a unique value.

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak User.
4. On the Keycloak User form, select YAML view.

5. Replace the default YAML file with the following:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakUser
   metadata:
     name: hubadmin-user
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     user:
       username: hub_admin
       firstName: Hub
       lastName: Admin
       email: hub_admin@example.com
       enabled: true
       emailVerified: false
       credentials:
         - type: password
           value: <ch8ngeme>
       clientRoles:
         automation-hub:
           - hubadmin

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to https://<sso_host>/auth/realms/ansible-automation-platform.
2. Copy the public_key value.
3. In the OpenShift Web UI, navigate to Workloads Secrets.
4. Select the ansible-automation-platform project.
5. Click Create, and select From YAML.

6. Edit the following YAML to create the secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: automation-hub-sso                       1
     namespace: ansible-automation-platform
   type: Opaque
   stringData:
     keycloak_host: "keycloak-rh-sso.apps-crc.testing"
     keycloak_port: "443"
     keycloak_protocol: "https"
     keycloak_realm: "ansible-automation-platform"
     keycloak_admin_role: "hubadmin"
     social_auth_keycloak_key: "automation-hub"
     social_auth_keycloak_secret: "client-secret"   2
     social_auth_keycloak_public_key: >-            3

   1

   This name is used in the next step when creating the automation hub instance.

   2

   If the secret was changed when creating the Keycloak client for automation hub be sure to change this value to match.

   3

   Enter the value of the public_key for your Ansible Automation Platform Operator deployment.

7. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select your Ansible Automation Platform Operator deployment.
3. Select the Automation hub tab.
4. Click Create Automation hub.

5. Select YAML view. The YAML should be similar to:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: private-ah                              1
     namespace: aap
   spec:
     sso_secret: automation-hub-sso                2
     pulp_settings:
       verify_ssl: false
     route_tls_termination_mechanism: Edge
     ingress_type: Route
     loadbalancer_port: 80
     file_storage_size: 100Gi
     image_pull_policy: IfNotPresent
     replicas: 1                                   3
     web_replicas: N
     task_replicas: N
     file_storage_access_mode: ReadWriteMany
     content:
       log_level: INFO
       replicas: 2
     postgres_storage_requirements:
       limits:
         storage: 50Gi
       requests:
         storage: 8Gi
     api:
       log_level: INFO
       replicas: 1
     postgres_resource_requirements:
       limits:
         cpu: 1000m
         memory: 8Gi
       requests:
         cpu: 500m
         memory: 2Gi
     loadbalancer_protocol: http
     resource_manager:
       replicas: 1
     worker:
       replicas: 2

   1

   Set metadata.name to the name to use for the instance.

   2

   Set spec.sso_secret to the name of the secret created in Creating a Secret to hold the Red Hat Single Sign On connection details.

   3

   Scale replicas up or down for each deployment by using the web_replicas or task_replicas respectively, where N represents the number of replicas you want to create. Alternatively, you can scale all pods across both deployments by using replicas. See Scaling the Web and Task Pods independently for details.

   Note

   This YAML turns off SSL verification (ssl_verify: false). If you are not using self-signed certificates for OpenShift this setting can be removed.

6. Click Create and wait for the process to complete.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Home Search.
3. Select the Resources drop-down list and type "Image".
4. Select Image (config,openshift.io/v1).
5. Click Cluster under the Name heading.
6. Select the YAML tab.

7. Paste in the following under spec value:

   spec:
     registrySources:
       allowedRegistries:
       - quay.io
       - registry.redhat.io
       - image-registry.openshift-image-registry.svc:5000
       - <OCP route for your automation hub>

8. Click Save.

Procedure

1. Navigate to Networking Routes.
2. Select the project you used for the install.
3. Copy the location of the private-ah-web-svc service. The name of the service is different if you used a different name when creating the automation hub instance. This is used later to update the Red Hat Single Sign-On client.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the RH-SSO project.
3. Click Red Hat Single Sign-On Operator.
4. Select Keycloak Client.
5. Click on the automation-hub-client-secret client.
6. Select YAML.

7. Update the Client YAML to add the Valid Redirect URIs and Web Origins settings.

   redirectUris:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*'
   webOrigins:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing'

   Field	Description
   redirectURIs	This is the location determined in Determine Automation Hub Route. Be sure to add the /* to the end of the redirectUris setting.
   webOrigins	This is the location determined in Determine Automation Hub Route.

   Note

   Ensure the indentation is correct when entering these settings.

8. Click Save.

To verify connectivity

1. Navigate to the automation hub route.
2. Enter the hub_admin user credentials and sign in.
3. Red Hat Single Sign-On processes the authentication and redirects back to automation hub.