Chapter 11. Configuring OIDC for Red Hat Quay

Procedure

1. Navigate to the Red Hat Single Sign-On Admin Console.

   1. On the OpenShift Container Platform Web Console, navigate to Network Route.
   2. Select the Red Hat Single Sign-On project from the drop-down list.
   3. Find the Red Hat Single Sign-On Admin Console in the Routes table.
2. Select the Realm that you will use to configure Red Hat Quay.
3. Click Clients under the Configure section of the navigation panel, and then click the Create button to add a new OIDC for Red Hat Quay.

4. Enter the following information.

   • Client ID: quay-enterprise
   • Client Protocol: openid-connect
   • Root URL: https://<quay_endpoint>/
5. Click Save. This results in a redirect to the Clients setting panel.
6. Navigate to Access Type and select Confidential.

7. Navigate to Valid Redirect URIs. You must provide three redirect URIs. The value should be the fully qualified domain name of the Red Hat Quay registry appended with /oauth2/redhatsso/callback. For example:

   • https://<quay_endpoint>/oauth2/redhatsso/callback
   • https://<quay_endpoint>/oauth2/redhatsso/callback/attach
   • https://<quay_endpoint>/oauth2/redhatsso/callback/cli
8. Click Save and navigate to the new Credentials setting.
9. Copy the value of the Secret.

Procedure

1. Update your config.yaml file with the following information:

   AUTHENTICATION_TYPE: OIDC
   # ...
   OIDC_LOGIN_CONFIG:
     CLIENT_ID: 1
     CLIENT_SECRET: 2
     OIDC_SERVER: 3
     SERVICE_NAME: 4
     PREFERRED_GROUP_CLAIM_NAME: 5
     LOGIN_SCOPES: [ 'openid', '<example_scope>' ] 6
     OIDC_DISABLE_USER_ENDPOINT: false 7
   # ...
   FEATURE_TEAM_SYNCING: true 8
   FEATURE_NONSUPERUSER_TEAM_SYNCING_SETUP: true 9
   FEATURE_UI_V2: true
   # ...

   1

   Required. The registered OIDC client ID for this Red Hat Quay instance.

   2

   Required. The registered OIDC client secret for this Red Hat Quay instance.

   3

   Required. The address of the OIDC server that is being used for authentication. This URL should be such that a GET request to <OIDC_SERVER>/.well-known/openid-configuration returns the provider’s configuration information. This configuration information is essential for the relying party (RP) to interact securely with the OpenID Connect provider and obtain necessary details for authentication and authorization processes.

   4

   Required. The name of the service that is being authenticated.

   5

   Required. The key name within the OIDC token payload that holds information about the user’s group memberships. This field allows the authentication system to extract group membership information from the OIDC token so that it can be used with Red Hat Quay.

   6

   Required. Adds additional scopes that Red Hat Quay uses to communicate with the OIDC provider. Must include 'openid'. Additional scopes are optional.

   7

   Whether to allow or disable the /userinfo endpoint. If using Azure Entra ID, set this field to true. Defaults to false.

   8

   Required. Whether to allow for team membership to be synced from a backing group in the authentication engine.

   9

   Optional. If enabled, non-superusers can setup team synchronization.

2. Restart your Red Hat Quay registry.

1. Log in to your Red Hat Quay registry via your OIDC provider.
2. On the Red Hat Quay v2 UI dashboard, click Create Organization.
3. Enter and Organization name, for example, test-org.
4. Click the name of the Organization.
5. In the navigation pane, click Teams and membership.
6. Click Create new team and enter a name, for example, testteam.

7. On the Create team pop-up:

   1. Optional. Add this team to a repository.
   2. Add a team member, for example, user1, by typing in the user’s account name.
   3. Add a robot account to this team. This page provides the option to create a robot account.
8. Click Next.
9. On the Review and Finish page, review the information that you have provided and click Review and Finish.
10. To enable team synchronization for your Red Hat Quay OIDC deployment, click Enable Directory Sync on the Teams and membership page.

11. You are prompted to enter the group Object ID if your OIDC authenticator is Azure Entra ID, or the group name if using a different provider. Note the message in the popup:

    Warning

    Please note that once team syncing is enabled, the membership of users who are already part of the team will be revoked. OIDC group will be the single source of truth. This is a non-reversible action. Team’s user membership from within Quay will be ready-only.

12. Click Enable Sync.

13. You are returned to the Teams and membership page. Note that users of this team are removed and are re-added upon logging back in. At this stage, only the robot account is still part of the team.

    A banner at the top of the page confirms that the team is synced:

    This team is synchronized with a group in OIDC and its user membership is therefore read-only.

    By clicking the Directory Synchronization Config accordion, the OIDC group that your deployment is synchronized with appears.

14. Log out of your Red Hat Quay registry and continue on to the verification steps.

1. Log back in to your Red Hat Quay registry.
2. Click Organizations test-org test-team Teams and memberships. user1 now appears as a team member for this team.

1. Navigate to your OIDC provider’s administration console.
2. Navigate to the Users page of your OIDC provider. The name of this page varies depending on your provider.
3. Click the name of the user associated with Red Hat Quay, for example, user1.
4. Remove the user from group in the configured identity provider.
5. Remove, or unassign, the access permissions from the user.
6. Log in to your Red Hat Quay registry.
7. Click Organizations test-org test-team Teams and memberships. user1 has been removed from this team.