Authenticate with OpenID Connect

Integrate Red Hat Edge Manager with an external OpenID Connect (OIDC) identity provider to enable Single Sign-On (SSO) for user authentication.

Before you begin

  • A running Red Hat Edge Manager installation on Red Hat Enterprise Linux. See Installing the Red Hat Edge Manager RPM package.
  • Administrative access (root or sudo) on the Red Hat Edge Manager host.
  • An external OIDC provider configured with a client application for Red Hat Edge Manager (for example, a realm and client in Red Hat Build of Keycloak).

Procedure

  1. Stop the flightctl services before editing your service-config.yaml file: 
    sudo systemctl stop flightctl.target
  2. Configure the integration settings by editing the configuration file: 
    sudo vi /etc/flightctl/service-config.yaml
  3. Update the configuration file to integrate with OIDC: 
    global:
  baseDomain: YOUR_EDGE_MANAGER_HOSTNAME
  auth:
    type: oidc
    insecureSkipTlsVerify: false
    oidc:
      oidcAuthority: "https://YOUR_IDP_HOST/realms/YOUR_REALM"
      externalOidcAuthority: "https://YOUR_IDP_PUBLIC_HOST/realms/YOUR_REALM"
      oidcClientId: "YOUR_OIDC_CLIENT_ID"
    baseDomain
    The DNS name for the Red Hat Edge Manager host that clients use with the HTTPS gateway on port 443 (for example, edge.example.com). Register OIDC redirect URIs that use https://<baseDomain>/ on port 443.
    type
    Set this to oidc to enable OIDC authentication.
    insecureSkipTlsVerify
    Set to false. Only set this to true to skip TLS certificate verification for your identity provider URLs. For production environments, configure a proper CA truststore instead of leaving verification disabled.
    oidcAuthority
    The base URL to your Realm’s OpenID Connect configuration endpoint.
    externalOidcAuthority
    The publicly accessible URL for the same Keycloak realm endpoint.
    oidcClientId
    The Client ID you defined when registering your application in the Keycloak console.
  4. Start the services: 
    sudo systemctl start flightctl.target

Results

  • sudo systemctl status flightctl.target reports active services.
  • Sign in to the Red Hat Edge Manager web console at https://<baseDomain>/ by using an OIDC-backed user account.
  • flightctl login https://<baseDomain> --web completes the browser-based sign-in flow successfully.