7.5. Keyless authentication with robot accounts

Procedure

1. On the Red Hat Single Sign-On UI:

   1. Click Clients and then the name of the application or service that can request authentication of a user.

   2. On the Settings page of your client, ensure that the following options are set or enabled:

      • Client ID
      • Valid redirect URI
      • Client authentication
      • Authorization
      • Standard flow

      • Direct access grants

        참고

        Settings can differ depending on your setup.

   3. On the Credentials page, store the Client Secret for future use.
   4. On the Users page, click Add user and enter a username, for example, service-account-quaydev. Then, click Create.
   5. Click the name of of the user, for example service-account-quaydev on the Users page.
   6. Click the Credentials tab Set password and provide a password for the user. If warranted, you can make this password temporary by selecting the Temporary option.

   7. Click the Realm settings tab OpenID Endpoint Configuration. Store the /protocol/openid-connect/token endpoint. For example:

      http://localhost:8080/realms/master/protocol/openid-connect/token

2. On a web browser, navigate to the following URL:

   http://<keycloak_url>/realms/<realm_name>/protocol/openid-connect/auth?response_type=code&client_id=<client_id>

3. When prompted, log in with the service-account-quaydev user and the temporary password you set. Complete the login by providing the required information and setting a permanent password if necessary.

4. You are redirected to the URI address provided for your client. For example:

   https://localhost:3000/cb?session_state=5c9bce22-6b85-4654-b716-e9bbb3e755bc&iss=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Fmaster&code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43

   Take note of the code provided in the address. For example:

   code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43

   참고

   This is a temporary code that can only be used one time. If necessary, you can refresh the page or revisit the URL to obtain another code.

5. On your terminal, use the following curl -X POST command to generate a temporary OAuth2 access token:

   $ curl -X POST "http://localhost:8080/realms/master/protocol/openid-connect/token" 

   1

   
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "client_id=quaydev" 

   2

   
   -d "client_secret=g8gPsBLxVrLo2PjmZkYBdKvcB9C7fmBz" 

   3

   
   -d "grant_type=authorization_code"
   -d "code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43" 

   4

   1

   The protocol/openid-connect/token endpoint found on the Realm settings page of the Red Hat Single Sign-On UI.

   2

   The Client ID used for this procedure.

   3

   The Client Secret for the Client ID.

   4

   The code returned from the redirect URI.

   Example output

   {"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJTVmExVHZ6eDd2cHVmc1dkZmc1SHdua1ZDcVlOM01DN1N5T016R0QwVGhVIn0...",
   "expires_in":60,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJiNTBlZTVkMS05OTc1LTQwMzUtYjNkNy1lMWQ5ZTJmMjg0MTEifQ.oBDx6B3pUkXQO8m-M3hYE7v-w25ak6y70CQd5J8f5EuldhvTwpWrC1K7yOglvs09dQxtq8ont12rKIoCIi4WXw","token_type":"Bearer","not-before-policy":0,"session_state":"5c9bce22-6b85-4654-b716-e9bbb3e755bc","scope":"profile email"}

6. Store the access_token from the previously step, as it will be exchanged for a Red Hat Quay robot account token in the following procedure.