Chapter 7. Managing users

• Valid Redirect URIs: Use this URL to access CodeReady Workspaces.
• Web Origins

Prerequisites

• In the administration console of the external installation of RH-SSO, define a realm containing the users intended to connect to CodeReady Workspaces:

  

• In this realm, define an OIDC client that CodeReady Workspaces will use to authenticate the users. This is an example of such a client with the correct settings:

  
  Note
  • CodeReady Workspaces only supports public OIDC clients. Therefore, selecting the openid-connect Client Protocol option and the public Access Type option is recommended.
  • The list of Valid Redirect URIs must contain at least two URIs related to the CodeReady Workspaces server, one using the http protocol and the other https. These URIs must contain the base URL of the CodeReady Workspaces server, followed by /* wildcards.

  • The list of Web Origins must contain at least two URIs related to the CodeReady Workspaces server, one using the http protocol and the other https. These URIs must contain the base URL of the CodeReady Workspaces server, without any path after the host.

    The number of URIs depends on the number of installed product tools.

• With CodeReady Workspaces that uses the default OpenShift OAuth support, user authentication relies on the integration of RH-SSO with OpenShift OAuth. This allows users to log in to CodeReady Workspaces with their OpenShift login and have their workspaces created under personal OpenShift projects.

  This requires setting up an OpenShift identity provider ins RH-SSO. When using an external RH-SSO, set up the identity provider manually. For instructions, see the appropriate RH-SSO documentations for either link:OpenShift 3[OpenShift 3] or link:OpenShift 4[OpenShift 4].

• The configured identity provider has the options Store Tokens and Stored Tokens Readable enabled.

Prerequisites

• A user or an administrator authorization token. To delete any other data except the data bound to a user account, admin privileges are required. The admin is a special CodeReady Workspaces administrator account pre-created and enabled using the CHE_SYSTEM_ADMIN__NAME and CHE_SYSTEM_SUPER__PRIVILEGED__MODE = true Custom Resource definitions.

  spec:
   server:
     customCheProperties:
       CHE_SYSTEM_SUPER__PRIVILEGED__MODE: 'true'
       CHE_SYSTEM_ADMIN__NAME: '<admin-name>'

  If needed, use commands below for creating the admin user:

  $ oc patch checluster codeready-workspaces \
    --type merge \
    -p '{ "spec": { "server": {"customCheProperties": {"CHE_SYSTEM_SUPER__PRIVILEGED__MODE": "true"} } }}' \
    -n openshift-workspaces

  $ oc patch checluster codeready-workspaces \
    --type merge \
    -p '{ "spec": { "server": {"customCheProperties": {"CHE_SYSTEM_ADMIN__NAME": "<admin-name>"} } }}' \
    -n openshift-workspaces

  Note

  All system permissions are granted to the administrative user who is configured in the CHE_SYSTEM_ADMIN__NAME property (the default is admin). The system permissions are granted when the CodeReady Workspaces server starts. If the user is not present in the CodeReady Workspaces user database, it happens after the first user’s login.

  Authorization token privileges:

  • admin - Can delete all personal data of all users
  • user - Can delete only the data related to the user
• A user or an administrator is logged in the OpenShift cluster with deployed CodeReady Workspaces.

• A user ID is obtained. Get the user ID using the commands below:

  • For the current user:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user'

  • To find a user by name:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user/find?name=<username>'

  • To find a user by email:

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://<codeready-<openshift_deployment_name>.<domain_name>>/api/user/find?email=<email>'

    Example of obtaining a user ID

    This example uses vparfono as a local user name.

    $ curl -X GET \
      --header 'Authorization: Bearer <user-token>' \
      'https://che-vp-che.apps.che-dev.x6e0.p1.openshiftapps.com/api/user/find?name=vparfono'

    The user ID is at the bottom of the curl command output.

    {
     "name": "vparfono",
     "links": [
       {
    .
    .
    .
       }
     ],
     "email": "vparfono@redhat.com",
     "id": "921b6f33-2657-407e-93a6-fb14cf2329ce"
    }