Chapter 12. OpenID Connect integration

Procedure

1. Run the following command to get a proper certificate chain:

   echo -n | openssl s_client -connect <rhsso_fqdn>:<rhsso_port> -servername <rhsso_fqdn> --showcerts | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > customCA.pem

Procedure

1. Validate the new certificate with the following cURL command. The expected response is a JSON configuration of the realm. If validation fails it is an indicator that your certificate may not be correct.

   curl -v https://<secure-sso-host>/auth/realms/master --cacert customCA.pem

2. Add the certificate bundle to the Zync pod:

   1. Gather the existing content of the /etc/pki/tls/cert.pem file on the Zync pod. Run:

      oc exec <zync-que-pod-id> cat /etc/pki/tls/cert.pem > zync.pem

   2. Append the contents of the custom CA certificate file to zync.pem:

      cat customCA.pem >> zync.pem

   3. Attach the new file to the Zync pod as ConfigMap:

      oc create configmap zync-ca-bundle --from-file=./zync.pem

      oc set volume dc/zync-que --add --name=zync-ca-bundle --mount-path /etc/pki/tls/zync/zync.pem --sub-path zync.pem --source='{"configMap":{"name":"zync-ca-bundle","items":[{"key":"zync.pem","path":"zync.pem"}]}}'

3. After deployment, verify that the certificate is attached and the content is correct:

   oc exec <zync-pod-id> cat /etc/pki/tls/zync/zync.pem

4. Configure the SSL_CERT_FILE environment variable on Zync to point to the new CA certificate bundle:

   oc set env dc/zync-que SSL_CERT_FILE=/etc/pki/tls/zync/zync.pem

1. Create a realm (<realm_name>).

2. Create a client:

   1. Specify a client ID.
   2. In the Client Protocol field, select openid-connect.

3. To configure the client permissions, set the following values:

   1. Access Type to confidential.
   2. Standard Flow Enabled to OFF.
   3. Direct Access Grants Enabled to OFF.
   4. Service Accounts Enabled to ON.

4. Set the service account roles for the client:

   1. Navigate to the Service Account Roles tab of the client.
   2. In the Client Roles dropdown list, click realm-management.
   3. In the Available Roles pane, select the manage-clients list item and assign the role by clicking Add selected >>.

5. Note the client credentials:

   1. Make a note of the client ID (<client_id>).
   2. Navigate to the Credentials tab of the client and make a note of the Secret field (<client_secret>).

6. Add a user to the realm:

   1. Click the Users menu on the left side of the window.
   2. Click Add user.
   3. Type the username, set the Email Verified switch to ON, and click Save.
   4. On the Credentials tab, set the password. Enter the password in both the fields, set the Temporary switch to OFF to avoid the password reset at the next login, and click Reset Password.
   5. When the pop-up window displays, click Change password.

1. Enable OpenID Connect.

   1. Select the service on which you want to enable the OpenID Connect authentication, navigate to [your_API_name] > Integration > Configuration.
   2. Select edit integration settings.
   3. Under the Authentication deployment options, select OpenID Connect.
   4. Click Update Service to save the settings.

2. Edit the APIcast Configuration:

   1. Navigate to [your_API_name] > Integration > Configuration.
   2. Select edit APIcast configuration.

   3. Under the Authentication Settings heading, in the OpenID Connect Issuer field, enter the previously noted client credentials with the URL of your RH-SSO server (located at host <rhsso_host> and port <rhsso_port>).

      https://<client_id>:<client_secret>@<rhsso_host>:<rhsso_port>/auth/realms/<realm_name>

   4. To save the configuration, click Update the Staging Environment.

1. Navigate to [Your_API_name] > Integration > edit APIcast configuration > Authentication Settings.
2. Under OpenID Connect Issuer Type, select REST API.
3. In OpenID Connect Issuer. specify the location of your OpenID Provider.
4. To save your changes, click Update the Staging Environment.

1. Navigate to the Authentication Settings section: [Your_API_name] > Integration > edit integration settings > Authentication
2. Choose OpenId Connect.

3. The corresponding flows are enabled on the client on RH SSO side. You can view them by navigating through [Your_API_name] > Integration > Edit APIcast configuration > Authentication Settings

   • standardFlowEnabled (Authorization Code flow) [selected by default]
   • implicitFlowEnabled (Implicit flow)
   • serviceAccountsEnabled (Service Accounts Flow)
   • directAccessGrantsEnabled (Direct Access Grant Flow)
4. Choose one or multiple flows.
5. To save your changes, click Update the Staging Environment.

1. Create an application for the service where you configured the OpenID Connect integration.
2. Note the client ID and the client Secret of the generated application.
3. Verify that the client with the same client ID and client secret is now present in the configured RH-SSO realm.
4. Update the Redirect URL of the application in the 3scale Admin Portal. Redirect URLs should be as specific as possible.
5. Verify that the Valid Redirect URIs field of the client in RH-SSO has been updated accordingly.

1. Get the access token from the RH-SSO server using an OAuth 2.0 flow that is enabled on the corresponding RH-SSO client.
2. Use the value of the access_token retrieved from RH-SSO in the Authorization header as follows: Authorization: Bearer <access_token>