Chapter 9. Managing identities and authorizations

• system
• organization
• workspace

• system
• organization
• workspace

• Valid Redirect URIs: Use this URL to access CodeReady Workspaces.
• Web Origins

Prerequisites

• In the administration console of the external installation of RH-SSO, define a realm containing the users intended to connect to CodeReady Workspaces:

  

• In this realm, define an OIDC client that CodeReady Workspaces will use to authenticate the users. This is an example of such a client with the correct settings:

  
  Note
  • Client Protocol must be openid-connect.
  • Access Type must be public. CodeReady Workspaces only supports the public access type.
  • Valid Redirect URIs must contain at least two URIs related to the CodeReady Workspaces server, one using the http protocol and the other https. These URIs must contain the base URL of the CodeReady Workspaces server, followed by /* wildcards.

  • Web Origins must contain at least two URIs related to the CodeReady Workspaces server, one using the http protocol and the other https. These URIs must contain the base URL of the CodeReady Workspaces server, without any path after the host.

    The number of URIs depends on the number of installed product tools.

• With CodeReady Workspaces that uses the default OpenShift OAuth support, user authentication relies on the integration of RH-SSO with OpenShift OAuth. This allows users to log in to CodeReady Workspaces with their OpenShift login and have their workspaces created under personal OpenShift projects.

  This requires setting up an OpenShift "RH-SSO Identity Provider". When using an external RH-SSO, configure the RH-SSO manually. For instructions, see the appropriate RH-SSO documentations for either OpenShift 3 or OpenShift 4.

• The configured RH-SSO has the options Store Tokens and Stored Tokens Readable enabled.

Prerequisites

• You are logged in as an administrator.

Prerequisites

• The oc tool is available.
• crwctl management tool is available. See Using the crwctl management tool.

Procedure

• Configure OpenShift identity providers on the cluster. See the Understanding identity provider configuration.

  When a user skips the Configuring step of OpenShift "RH-SSO Identity Provider", and the OpenShift cluster does not already contain a configured RH-SSO, CodeReady Workspaces creates an initial OpenShift user for the HTPasswd identity provider. Credentials of this user are stored in the openshift-oauth-user-credentials secret, located in the openshift-config namespace.

  Obtain the credentials for logging in to an OpenShift cluster and CodeReady Workspaces instance:

  1. Obtain OpenShift user name:

     $ oc get secret openshift-oauth-user-credentials -n openshift-config -o json | jq -r '.data.user' | base64 -d

  2. Obtain OpenShift user password:

     $ oc get secret openshift-oauth-user-credentials -n openshift-config -o json | jq -r '.data.password' | base64 -d

• Deploy CodeReady Workspaces using OperatorHub or the crwctl, see the crwctl server:deploy specification chapter. OpenShift OAuth will be enabled by default.

Prerequisites

• crwctl management tool is available. See Using the crwctl management tool.

Prerequisites

• The oc tool installed.
• An instance of Red Hat CodeReady Workspaces running on OpenShift.
• Logged in to OpenShift cluster using the oc tool.

Prerequisites

• A user or an administrator authorization token. To delete any other data except the data bound to a user account, admin privileges are required. The admin is a special CodeReady Workspaces administrator account pre-created and enabled using the CHE_SYSTEM_ADMIN__NAME and CHE_SYSTEM_SUPER__PRIVILEGED__MODE = true Custom Resource definitions.

  spec:
   server:
     customCheProperties:
       CHE_SYSTEM_SUPER__PRIVILEGED__MODE: 'true'
       CHE_SYSTEM_ADMIN__NAME: '<admin-name>'

  If needed, use commands below for creating the admin user:

  $ oc patch checluster/codeready-workspaces \
    --type merge \
    -p '{ "spec": { "server": {"customCheProperties": {"CHE_SYSTEM_SUPER__PRIVILEGED__MODE": "true"} } }}' \
    -n openshift-workspaces

  $ oc patch checluster/codeready-workspaces \
    --type merge \
    -p '{ "spec": { "server": {"customCheProperties": {"CHE_SYSTEM_ADMIN__NAME": "<admin-name>"} } }}' \
    -n openshift-workspaces

  Note

  All system permissions are granted to the administrative user who is configured in the CHE_SYSTEM_ADMIN__NAME property (the default is admin). The system permissions are granted when the CodeReady Workspaces server starts. If the user is not present in the CodeReady Workspaces user database, it happens after the first user’s login.

  Authorization token privileges:

  • admin - Can delete all personal data of all users
  • user - Can delete only the data related to the user
• A user or an administrator is logged in the OpenShift cluster with deployed CodeReady Workspaces.

• A user ID is obtained. Get the user ID using the commands below:

  • For the current user:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user'

  • To find a user by name:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user/find?name=<username>'

  • To find a user by email:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user/find?email=<email>'

    Example of obtaining a user ID

    This example uses vparfono as a local user name.

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://che-vp-che.apps.che-dev.x6e0.p1.openshiftapps.com/api/user/find?name=vparfono'

    The user ID is at the bottom of the curl command output.

    {
     "name": "vparfono",
     "links": [
       {
    .
    .
    .
       }
     ],
     "email": "vparfono@redhat.com",
     "id": "921b6f33-2657-407e-93a6-fb14cf2329ce"
    }