Chapter 12. Managing identities and authorizations

Procedure

1. Update the authentication configuration parameters that are stored in the multiuser.properties file (such as client ID, authentication URL, realm name).
2. Write a single filter or a chain of filters to validate tokens, create the user in the CodeReady Workspaces dashboard, and compose the subject object.
3. If the new authorization provider supports the OpenID protocol, use the OIDC JS client library available at the settings endpoint because it is decoupled from specific implementations.
4. If the selected provider stores additional data about the user (first and last name, job title), it is recommended to write a provider-specific ProfileDao implementation that provides this information.

Procedure

1. Create an OAuth application in GitHub with the following URLs:

   • Enter the CodeReady Workspaces URL as Homepage URL. The default value is https://codeready-openshift-workspaces.<domain>/.

   • Enter the Authorization callback URL as follows:

     • If the Dev Workspace engine is not enabled, enter the RH-SSO GitHub endpoint URL as Authorization callback URL. The default value is https://keycloak-openshift-workspaces.<domain>/auth/realms/codeready/broker/github/endpoint.
     • If the Dev Workspace engine is enabled, enter the CodeReady Workspaces OAuth callback URL as Authorization callback URL. The default value is https://codeready-openshift-workspaces.<domain>/api/oauth/callback.

2. Create a new secret in the project where CodeReady Workspaces is deployed.

   $ oc apply -f - <<EOF
   kind: Secret
   apiVersion: v1
   metadata:
     name: github-oauth-config
     namespace: <...> 1
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: github
   type: Opaque
   data:
     id: <...> 2
     secret: <...> 3
   EOF

   1

   CodeReady Workspaces namespace. The default is openshift-workspaces

   2

   base64 encoded GitHub OAuth Client ID

   3

   base64 encoded GitHub OAuth Client Secret

3. If CodeReady Workspaces was already installed wait until rollout of RH-SSO component finishes.

Procedure

1. Provision the CA of the BB server to the CodeReady Workspaces server to enable it to read the devfiles stored in the BB server. To do so, add the following ConfigMap to the openshift-workspaces project:

   $ oc create configmap bitbucket-ca-cert-for-factory --from-file=ca.crt -n openshift-workspaces

   $ oc label configmap bitbucket-ca-cert-for-factory app.kubernetes.io/part-of=che.eclipse.org app.kubernetes.io/component=ca-bundle -n openshift-workspaces

2. Provision the CA of the BB server to the CodeReady Workspaces server to be able to use Git operations. To do so, add a new ConfigMap to the openshift-workspaces project:

   $ oc create configmap che-git-self-signed-cert --from-file=ca.crt --from-literal=githost=<bitbucket_server_url> -n openshift-workspaces

3. Edit the CheCluster Custom Resource (CR) to configure the CodeReady Workspaces server.

   spec:
     server:
       # …
       gitSelfSignedCert: <boolean> 1

   1

   Use true for a BB server that use a self-signed cert. Default value: false.

   • For more information, see https://access.redhat.com/documentation/en-us/red_hat_codeready_workspaces/2.15/html-single/installation_guide/index#advanced-configuration-options-for-the-che-server-component.adoc.

Procedure

1. Generate an RSA key pair and a stripped-down version of the public key:

   $ openssl genrsa -out <private.pem> 2048

   $ openssl rsa -in <private.pem> -pubout > <public.pub>

   $ openssl pkcs8 -topk8 -inform pem -outform pem -nocrypt -in <private.pem> -out <privatepkcs8.pem>

   $ cat <public.pub> | sed 's/-----BEGIN PUBLIC KEY-----//g' | sed 's/-----END PUBLIC KEY-----//g' | tr -d '\n' > <public-stripped.pub>

2. Generate a consumer key and a shared secret.

   $ openssl rand -base64 24 > <bitbucket_server_consumer_key>

   $ openssl rand -base64 24 > <bitbucket_shared_secret>

3. Configure an Application Link in Bitbucket to enable the communication from CodeReady Workspaces to Bitbucket Server.

   1. In Bitbucket Server, click the cog in the top navigation bar to navigate to Administration > Application Links.
   2. Enter the application URL: \https://codeready-<openshift_deployment_name>.<domain_name> and click the Create new link button.
   3. In the warning message stating No response was received from the URL click the Continue button.

   4. Complete the Link Applications form and click the Continue button.

      Application Name

      <CodeReady Workspaces>

      Application Type

      Generic Application.

      Service Provider Name

      <CodeReady Workspaces>

      Consumer Key

      Paste the content of the <bitbucket_server_consumer_key> file.

      Shared secret

      Paste the content of the <bitbucket_shared_secret> file.

      Request Token URL

      <Bitbucket Server URL>/plugins/servlet/oauth/request-token

      Access token URL

      <Bitbucket Server URL>/plugins/servlet/oauth/access-token

      Authorize URL

      <Bitbucket Server URL>/plugins/servlet/oauth/access-token

      Create incoming link

      Enabled.

   5. Complete the Link Applications form and click the Continue button.

      Consumer Key

      Paste the content of the <bitbucket_server_consumer_key> file.

      Consumer name

      <CodeReady Workspaces>

      Public Key

      Paste the content of the <public-stripped.pub> file.

4. Create a OpenShift Secret in CodeReady Workspaces project containing the consumer and private keys.

   $ oc apply -f - <<EOF
   kind: Secret
   apiVersion: v1
   metadata:
     name: bitbucket-oauth-config
     namespace: <CodeReady Workspaces-namespace> 1
     labels:
       app.kubernetes.io/component: oauth-scm-configuration
       app.kubernetes.io/part-of: che.eclipse.org
     annotations:
       che.eclipse.org/oauth-scm-server: bitbucket
       che.eclipse.org/scm-server-endpoint: '<scm-server-endpoint>' 2
   type: Opaque
   data:
     private.key: '<user-private-key>' 3
     consumer.key: '<bitbucket_server_consumer_key>' 4
   EOF

   1

   CodeReady Workspaces namespace. The default is openshift-workspaces

   2

   Bitbucket Server URL

   3

   base64 encoded content of the <privatepkcs8.pem> file without first and last lines.

   4

   base64 encoded content of the <bitbucket_server_consumer_key> file.

   Example

   #!/usr/bin/env bash
   
   NS=${1:-eclipse-che}
   CONSUMER_KEY=$(cat ./certs/bitbucket_server_consumer_key)
   PRIVATE_KEY=$(cat ./certs/privatepkcs8.pem | sed 's/-----BEGIN PRIVATE KEY-----//g' |  sed 's/-----END PRIVATE KEY-----//g' | tr -d '\n')
   BITBUCKET_HOST='<your-bitbucket-host-here>'
   unameOut="$(uname -s)"
   
   case "${unameOut}" in
       Linux*)     BASE64_FUNC='base64 -w 0';;
       Darwin*)    BASE64_FUNC='base64';;
       CYGWIN*)    BASE64_FUNC='base64 -w 0';;
       MINGW*)     BASE64_FUNC='base64 -w 0';;
       *)          BASE64_FUNC='base64 -w 0'
   esac
   
   cat <<EOF | oc apply -n $NS -f -
   kind: Secret
   apiVersion: v1
   metadata:
     name: bitbucket-oauth-config
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: bitbucket
       che.eclipse.org/scm-server-endpoint: https://$BITBUCKET_HOST
   type: Opaque
   data:
     private.key: $(echo -n $PRIVATE_KEY | $BASE64_FUNC)
     consumer.key: $(echo -n $CONSUMER_KEY | $BASE64_FUNC)
   EOF

   • See the whole script in this GitHub example.

Procedure

1. Create an OAuth2 Authorized application in Gitlab:

   • Enter Che as the application Name.
   • Enter the CodeReady Workspaces OAuth callback URL as the Redirect URI. The default value is https://codeready-openshift-workspaces.<domain>/api/oauth/callback.
   • Check the Confidential and Expire access tokens checkboxes.
   • Under Scopes, check the api, write_repository, and openid checkboxes.
2. Click Save application and store the Application ID and Secret values.

3. Create a new secret in the project where CodeReady Workspaces is deployed.

   $ oc apply -f - <<EOF
   kind: Secret
   apiVersion: v1
   metadata:
     name: gitlab-oauth-config
     namespace: <namespace> 1
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: gitlab
       che.eclipse.org/scm-server-endpoint: <your_GitLab_service_URL>
   type: Opaque
   data:
     id: <base64_encoded_GitLab_Application_ID>
     secret: <base64_encoded_GitLab_Secret>
   EOF

   1

   The CodeReady Workspaces namespace. The default is openshift-workspaces.