第3章 Configuring Apicurio Registry security options

Procedure

1. In the Red Hat build of Keycloak Admin Console, create a Red Hat build of Keycloak realm for Apicurio Registry. By default, Apicurio Registry expects a realm name of registry. For details on creating realms, see the the Red Hat build of Keycloak user documentation.

2. Create a Red Hat build of Keycloak client for the Apicurio Registry API. By default, Apicurio Registry expects the following settings:

   • Client ID: registry-api
   • Client Protocol: openid-connect

   • Access Type: bearer-only

     You can use the defaults for the other client settings.

     注記

     If you are using Red Hat build of Keycloak service accounts, the client Access Type must be confidential instead of bearer-only.

3. Create a Red Hat build of Keycloak client for the Apicurio Registry web console. By default, Apicurio Registry expects the following settings:

   • Client ID: apicurio-registry
   • Client Protocol: openid-connect
   • Access Type: public
   • Valid Redirect URLs: http://my-registry-url:8080/*

   • Web Origins: +

     You can use the defaults for the other client settings.

4. In your Apicurio Registry deployment on OpenShift, set the following Apicurio Registry environment variables to configure authentication using Red Hat build of Keycloak:

   表3.1 Configuration for Apicurio Registry authentication with Red Hat build of Keycloak

   Environment variable	Description	Type	Default
   QUARKUS_OIDC_TENANT_ENABLED	Enables authentication for Apicurio Registry. When set to true, the environment variables that follow are required for authentication using Red Hat build of Keycloak.	String	false
   QUARKUS_OIDC_AUTH_SERVER_URL	The URL of the Red Hat build of Keycloak authentication server. For example, http://localhost:8080.	String	-
   QUARKUS_OIDC_CLIENT_ID	The client ID for the Apicurio Registry REST API.	String	registry-api
   APICURIO_UI_AUTH_OIDC_CLIENT-ID	The client ID for the Apicurio Registry web console.	String	apicurio-registry

   ヒント

   For an example of setting environment variables on OpenShift, see 「Configuring Apicurio Registry health checks on OpenShift」.

5. Set the following option to true to enable Apicurio Registry user roles in Red Hat build of Keycloak:

   表3.2 Configuration for Apicurio Registry role-based authorization

   Environment variable	Java system property	Type	Default value
   APICURIO_AUTH_ROLE-BASED-AUTHORIZATION	apicurio.auth.role-based-authorization	Boolean	false

6. When Apicurio Registry user roles are enabled, you must assign Apicurio Registry users to at least one of the following default user roles in your Red Hat build of Keycloak realm:

   表3.3 Default user roles for registry authentication and authorization

   Role	Read artifacts	Write artifacts	Global rules	Summary
   sr-admin	Yes	Yes	Yes	Full access to all create, read, update, and delete operations.
   sr-developer	Yes	Yes	No	Access to create, read, update, and delete operations, except configuring global rules. This role can configure artifact-specific rules.
   sr-readonly	Yes	No	No	Access to read and search operations only. This role cannot configure any rules.

7. Set the following to true to enable owner-only authorization for updates to schema and API artifacts in Apicurio Registry:

   表3.4 Configuration for owner-only authorization

   Environment variable	Java system property	Type	Default value
   APICURIO_AUTH_OWNER-ONLY-AUTHORIZATION_LIMIT-GROUP-ACCESS	apicurio.auth.owner-only-authorization.limit-group-access	Boolean	false