Chapter 6. Using Red Hat Single Sign-On Operator with automation hub

Procedure

1. Navigate to Operator Installed Operators.
2. Select the rh-sso project.
3. Select the Red Hat Single Sign-On Operator.
4. On the Red Hat Single Sign-On Operator details page select Keycloak.
5. Click Create instance.

6. Click YAML view.

   The default Keycloak custom resource is as follows:

   apiVersion: keycloak.org/v1alpha1
   kind: Keycloak
   metadata:
     name: example-keycloak
     labels:
   	app: sso
     namespace: aap
   spec:
     externalAccess:
   	enabled: true
     instances: 1

   Copy to Clipboard Toggle word wrap
7. Click Create
8. When deployment is complete, you can use this credential to login to the administrative console.
9. You can find the credentials for the administrator in the credential-<custom-resource> (example keycloak) secret in the namespace.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak Realm.

4. On the Keycloak Realm form, select YAML view. Edit the YAML file as follows:

   kind: KeycloakRealm
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: ansible-automation-platform-keycloakrealm
     namespace: rh-sso
     labels:
       app: sso
       realm: ansible-automation-platform
   spec:
     realm:
       id: ansible-automation-platform
       realm: ansible-automation-platform
       enabled: true
       displayName: {PlatformNameShort}
     instanceSelector:
       matchLabels:
         app: sso

   Copy to Clipboard Toggle word wrap
   Expand

   Field	Description
   metadata.name	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.namespace	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.labels.app	Set labels to a unique value. This is used when creating the client CR.
   metadata.labels.realm	Set labels to a unique value. This is used when creating the client CR.
   spec.realm.id	Set the realm name and id. These must be the same.
   spec.realm.realm	Set the realm name and id. These must be the same.
   spec.realm.displayname	Set the name to display.

   Show more
5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Client tab and click Create Keycloak Client.
4. On the Keycloak Realm form, select YAML view.

5. Replace the default YAML file with the following:

   kind: KeycloakClient
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: automation-hub-client-secret
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     client:
       name: Automation Hub
       clientId: automation-hub
       secret: <client-secret>                        

   1

   
       clientAuthenticatorType: client-secret
       description: Client for {HubNameStart}
       attributes:
         user.info.response.signature.alg: RS256
         request.object.signature.alg: RS256
       directAccessGrantsEnabled: true
       publicClient: true
       protocol: openid-connect
       standardFlowEnabled: true
       protocolMappers:
         - config:
             access.token.claim: "true"
             claim.name: "family_name"
             id.token.claim: "true"
             jsonType.label: String
             user.attribute: lastName
             userinfo.token.claim: "true"
           consentRequired: false
           name: family name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
         - config:
             userinfo.token.claim: "true"
             user.attribute: email
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: email
             jsonType.label: String
           name: email
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             multivalued: "true"
             access.token.claim: "true"
             claim.name: "resource_access.${client_id}.roles"
             jsonType.label: String
           name: client roles
           protocol: openid-connect
           protocolMapper: oidc-usermodel-client-role-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: firstName
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: given_name
             jsonType.label: String
           name: given name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             userinfo.token.claim: "true"
           name: full name
           protocol: openid-connect
           protocolMapper: oidc-full-name-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: username
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: preferred_username
             jsonType.label: String
           name: <username>
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             access.token.claim: "true"
             claim.name: "group"
             full.path: "true"
             id.token.claim: "true"
             userinfo.token.claim: "true"
           consentRequired: false
           name: group
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
         - config:
             multivalued: 'true'
             id.token.claim: 'true'
             access.token.claim: 'true'
             userinfo.token.claim: 'true'
             usermodel.clientRoleMapping.clientId:  '{HubName}'
             claim.name: client_roles
             jsonType.label: String
           name: client_roles
           protocolMapper: oidc-usermodel-client-role-mapper
           protocol: openid-connect
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             included.client.audience: '{HubName}'
           protocol: openid-connect
           name: audience mapper
           protocolMapper: oidc-audience-mapper
     roles:
       - name: "hubadmin"
         description: "An administrator role for {HubNameStart}"

   Copy to Clipboard Toggle word wrap

   1

   Replace this with a unique value.

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak User.
4. On the Keycloak User form, select YAML view.

5. Replace the default YAML file with the following:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakUser
   metadata:
     name: hubadmin-user
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     user:
       username: hub_admin
       firstName: Hub
       lastName: Admin
       email: hub_admin@example.com
       enabled: true
       emailVerified: false
       credentials:
         - type: password
           value: <ch8ngeme>
       clientRoles:
         automation-hub:
           - hubadmin

   Copy to Clipboard Toggle word wrap
6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Operator Hub and search for the Ansible Automation Platform Operator.
2. Select the Ansible Automation Platform Operator project.
3. Click on the Operator tile.
4. Click Install.

5. Select a Project to install the Operator into. Red Hat recommends using the Operator recommended Namespace name.

   1. If you want to install the Operator into a project other than the recommended one, select Create Project from the drop down menu.
   2. Enter the Project name.
   3. Click Create.
6. Click Install.
7. When the Operator has been installed, click View Operator.

Procedure

1. Navigate to https://<sso_host>/auth/realms/ansible-automation-platform.
2. Copy the public_key value.
3. In the OpenShift Web UI, navigate to Workloads Secrets.
4. Select the ansible-automation-platform project.
5. Click Create, and select From YAML.

6. Edit the following YAML to create the secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: automation-hub-sso                       

   1

   
     namespace: ansible-automation-platform
   type: Opaque
   stringData:
     keycloak_host: "keycloak-rh-sso.apps-crc.testing"
     keycloak_port: "443"
     keycloak_protocol: "https"
     keycloak_realm: "ansible-automation-platform"
     keycloak_admin_role: "hubadmin"
     social_auth_keycloak_key: "automation-hub"
     social_auth_keycloak_secret: "client-secret"   

   2

   
     social_auth_keycloak_public_key: >-            

   3

   Copy to Clipboard Toggle word wrap

   1

   This name is used in the next step when creating the automation hub instance.

   2

   If the secret was changed when creating the Keycloak client for automation hub be sure to change this value to match.

   3

   Enter the value of the public_key copied in Installing the Ansible Automation Platform Operator.

7. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the Ansible Automation Platform.
3. Select the Automation hub tab and click Create Automation hub.

4. Select YAML view. The YAML should be similar to:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: private-ah                              

   1

   
     namespace: ansible-automation-platform
   spec:
     sso_secret: automation-hub-sso                

   2

   
     pulp_settings:
       verify_ssl: false
     route_tls_termination_mechanism: Edge
     ingress_type: Route
     loadbalancer_port: 80
     file_storage_size: 100Gi
     image_pull_policy: IfNotPresent
     web:
       replicas: 1
     file_storage_access_mode: ReadWriteMany
     content:
       log_level: INFO
       replicas: 2
     postgres_storage_requirements:
       limits:
         storage: 50Gi
       requests:
         storage: 8Gi
     api:
       log_level: INFO
       replicas: 1
     postgres_resource_requirements:
       limits:
         cpu: 1000m
         memory: 8Gi
       requests:
         cpu: 500m
         memory: 2Gi
     loadbalancer_protocol: http
     resource_manager:
       replicas: 1
     worker:
       replicas: 2

   Copy to Clipboard Toggle word wrap

   1

   Set metadata.name to the name to use for the instance.

   2

   Set spec.sso_secret to the name of the secret created in Creating a Secret to hold the Red Hat Single Sign On connection details.

   Note

   This YAML turns off SSL verification (ssl_verify: false). If you are not using self-signed certificates for OpenShift this setting can be removed.

5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Networking Routes.
2. Select the project you used for the install.
3. Copy the location of the private-ah-web-svc service. The name of the service is different if you used a different name when creating the automation hub instance. This is used later to update the Red Hat Single Sign-On client.

Procedure

1. Navigate to Operator Installed Operators.
2. Select the RH-SSO project.
3. Click Red Hat Single Sign-On Operator.
4. Select Keycloak Client.
5. Click on the automation-hub-client-secret client.
6. Select YAML.

7. Update the Client YAML to add the Valid Redirect URIs and Web Origins settings.

   redirectUris:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*'
   webOrigins:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing'

   Copy to Clipboard Toggle word wrap
   Expand

   Field	Description
   redirectURIs	This is the location determined in Determine Automation Hub Route. Be sure to add the /* to the end of the redirectUris setting.
   webOrigins	This is the location determined in Determine Automation Hub Route.

   Show more
   Note

   Ensure the indentation is correct when entering these settings.

8. Click Save.

To verify connectivity

1. Navigate to the automation hub route.
2. Enter the hub_admin user credentials and sign in.
3. Red Hat Single Sign-On processes the authentication and redirects back to automation hub.