Chapter 5. Configuring OAuth authorization

Procedure

• Set up the GitHub OAuth client. The Authorization callback URL is filled in the next steps.

  1. Go to the RH-SSO administration console and select the Identity Providers tab.
  2. Select the GitHub identity provider in the drop-down list.
  3. Paste the Redirect URI to the Authorization callback URL of the GitHub OAuth application.
  4. Fill the Client ID and Client Secret from the GitHub oauth app.
  5. Enable Store Tokens.
  6. Save the changes of the Github Identity provider and click Register application in the GitHub oauth app page.

Prerequisites

• The oc tool is available.

Procedure

• To enable OpenShift OAuth automatically, deploy CodeReady Workspaces using the crwctl with the --os-oauth option. See the crwctl server:start specification chapter.

• For CodeReady Workspaces deployed in single-user mode:

  1. Register CodeReady Workspaces OAuth client in OpenShift. See the Register an OAuth client in OpenShift chapter.

     $ oc create -f <(echo '
     kind: OAuthClient
     apiVersion: oauth.openshift.io/v1
     metadata:
      name: che
     secret: "<random set of symbols>"
     redirectURIs:
      - "<CodeReady Workspaces api url>/oauth/callback"
     grantMethod: prompt
     ')

  2. Add the OpenShift TLS certificate to the CodeReady Workspaces Java trust store.

     • See Adding self-signed SSL certificates to CodeReady Workspaces.

  3. Update the OpenShift deployment configuration.

     CHE_OAUTH_OPENSHIFT_CLIENTID: <client-ID>
     CHE_OAUTH_OPENSHIFT_CLIENTSECRET: <openshift-secret>
     CHE_OAUTH_OPENSHIFT_OAUTH__ENDPOINT: <oauth-endpoint>
     CHE_OAUTH_OPENSHIFT_VERIFY__TOKEN__URL: <verify-token-url>

     • <client-ID> a name specified in the OpenShift OAuthClient.
     • <openshift-secret> a secret specified in the OpenShift OAuthClient.

     • <oauth-endpoint> the URL of the OpenShift OAuth service:

       • For OpenShift 3 specify the OpenShift master URL.
       • For OpenShift 4 specify the oauth-openshift route.
     • <verify-token-url> request URL that is used to verify the token. <OpenShift master url>/api can be used for OpenShift 3 and 4.
     • See CodeReady Workspaces configMaps and their behavior.