Chapter 3. Configure additional OpenID Connect providers

Procedure

1. Open a terminal on your workstation, and log in to OpenShift:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.

2. Update the RHTAS configuration.

   1. Open for editing the Securesign resource:

      Syntax

      oc edit Securesign NAME -n NAMESPACE

      Example

      $ oc edit Securesign securesign-sample -n trusted-artifact-signer

      Note

      You must use the project name created for the RHTAS installation as the namespace.

   2. Under the OIDCIssuers section, add a new subsection with your Google client identifier, issuer’s URL, and set the Type value to email:

      Syntax

      ...
      OIDCIssuers:
        - Issuer: "https://accounts.google.com"
          IssuerURL: "https://accounts.google.com"
          ClientID: "CLIENT_ID"
          Type: email
      ...

      Add you Google client identifier to the ClientID field.

   3. Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack.

3. Change the OIDC issuer, and client id environment variables to use Google:

   Example

   $ export OIDC_ISSUER_URL=https://accounts.google.com
   $ export COSIGN_OIDC_CLIENT_ID="314919563931-35zke44ouf2oiztjg7v8o8c2ge9usnd1.apps.googleexample.com"

4. Copy and paste your secret from the Google Console to a plain text file:

   Syntax

   echo SECRET > my-google-client-secret

5. If you already have the RHTAS service running, you can verify the updated configuration by signing a test container image.

   1. Create an empty container image:

      Example

      $ echo "FROM scratch" > ./tmp.Dockerfile
      $ podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h

   2. Push the empty container image to the ttl.sh ephemeral registry:

      Example

      $ podman push ttl.sh/rhtas/test-image:1h

   3. Remove the temporary Docker file:

      Example

      $ rm ./tmp.Dockerfile

   4. Sign the container image:

      Syntax

      cosign sign -y --oidc-client-secret-file=SECRET_FILE IMAGE_NAME:TAG

      Example

      $ cosign sign -y --oidc-client-secret-file=my-google-client-secret ttl.sh/rhtas/test-image:1h

      A web browser opens allowing you to sign the container image with an email address.

Procedure

1. Log in to the OpenShift web console with a user that has the cluster-admin role.

2. Create a new project to deploy the Keycloak service.

   1. From the Administrator perspective, expand Home from the navigation menu, and click Projects.
   2. Click the Create Project button.
   3. The new project name is keycloak-system, and click the Create button.
3. Expand Operators from the navigation menu, and click OperatorHub.
4. In the search field, type sso, and click the Red Hat Single Sign-on tile.
5. Click the Install button to show the operator details.
6. If not already set, select keycloak-system from the Installed Namespace drop-down menu.
7. Click Install on the Install Operator page, and wait for the installation to finish.
8. After the installation finishes, click View Operator.

9. From your workstation terminal, log in to the OpenShift cluster:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL to use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.

10. Switch to the Keycloak project:

    Example

    $ oc project keycloak-system

11. Create a Keycloak instance:

    Example

    $ cat <<EOF | oc apply -f -
    apiVersion: keycloak.org/v1alpha1
    kind: Keycloak
    metadata:
      labels:
        app: sso
      name: keycloak
    spec:
      externalAccess:
        enabled: true
      instances: 1
      keycloakDeploymentSpec:
        imagePullPolicy: Always
      postgresDeploymentSpec:
        imagePullPolicy: Always
    EOF

12. Create a Keycloak realm:

    Example

    $ cat <<EOF | oc apply -f -
    apiVersion: keycloak.org/v1alpha1
    kind: KeycloakRealm
    metadata:
      labels:
        app: sso
      name: trusted-artifact-signer
    spec:
      instanceSelector:
        matchLabels:
          app: sso
      realm:
        displayName: Red-Hat-Trusted-Artifact-Signer
        enabled: true
        id: trusted-artifact-signer
        realm: trusted-artifact-signer
        sslRequired: none
    EOF

13. Create a Keycloak client:

    Example

    $ cat <<EOF | oc apply -f -
    apiVersion: keycloak.org/v1alpha1
    kind: KeycloakClient
    metadata:
      labels:
        app: sso
      name: trusted-artifact-signer
    spec:
      client:
        attributes:
          request.object.signature.alg: RS256
          user.info.response.signature.alg: RS256
        clientAuthenticatorType: client-secret
        clientId: trusted-artifact-signer
        defaultClientScopes:
        - profile
        - email
        description: Client for Red Hat Trusted Artifact Signer authentication
        directAccessGrantsEnabled: true
        implicitFlowEnabled: false
        name: trusted-artifact-signer
        protocol: openid-connect
        protocolMappers:
        - config:
            claim.name: email
            id.token.claim: "true"
            jsonType.label: String
            user.attribute: email
            userinfo.token.claim: "true"
          name: email
          protocol: openid-connect
          protocolMapper: oidc-usermodel-property-mapper
        - config:
            claim.name: email-verified
            id.token.claim: "true"
            user.attribute: emailVerified
            userinfo.token.claim: "true"
          name: email-verified
          protocol: openid-connect
          protocolMapper: oidc-usermodel-property-mapper
        - config:
            claim.name: aud
            claim.value: trusted-artifact-signer
            id.token.claim: "true"
            access.token.claim: "true"
            userinfo.token.claim: "true"
          name: audience
          protocol: openid-connect
          protocolMapper: oidc-hardcoded-claim-mapper
        publicClient: true
        standardFlowEnabled: true
        redirectUris:
        - "*"
      realmSelector:
        matchLabels:
          app: sso
    EOF

14. Create a Keycloak user:

    Example

    $ cat <<EOF | oc apply -f -
    apiVersion: keycloak.org/v1alpha1
    kind: KeycloakUser
    metadata:
      labels:
        app: sso
      name: jdoe
    spec:
      realmSelector:
        matchLabels:
          app: sso
      user:
        email: jdoe@redhat.com
        enabled: true
        emailVerified: true
        credentials:
          - type: "password"
            value: "secure"
        firstName: Jane
        lastName: Doe
        username: jdoe
    EOF

    Set a user name, the user’s email address, and a password or reference a secret object.

15. Go back to the OpenShift web console, click the All instances tab to watch and wait until the Keycloak system initializes successfully.

Procedure

1. Log in to the OpenShift web console with a user that has the cluster-admin role.

2. Create a new project to deploy the Keycloak service.

   1. From the Administrator perspective, expand Home from the navigation menu, and click Projects.
   2. Click the Create Project button.
   3. The new project name is keycloak-system, and click the Create button.

3. Deploy an instance of PostgreSQL for use by Keycloak to store persistent data.

   Important

   If a database already exists for use by Keycloak, replace the username, password and database name values for the Secret resource that corresponds with your database instance. You can skip the creation of the PostgreSQL Service and StatefulSet steps, and move ahead to the next step.

   1. Create a Secret resource to store the database information.

      1. Expand Workloads from the navigation menu, and click Secrets.
      2. Select the keycloak-system from the Project drop-down menu.
      3. Click the Create drop-down menu, and select Key/Value secret.
      4. Enter postgresql-db in the Secret name field.
      5. Enter username in the Key field.
      6. Enter keycloak in the Value field. This is the user name Keycloak uses to authenticate to the PostgreSQL database instance.
      7. Click the Add key/value link to add another key-value pair.
      8. Enter password in the Key field.
      9. Enter a password of your choice in the Value field. This is the password Keycloak uses to authenticate to the PostgreSQL database instance.
      10. Click the Add key/value link to add another key-value pair.
      11. Enter database in the Key field.
      12. Enter keycloak in the Value field. This is the name of the database for storing Keycloak data within the PostgreSQL database instance.
      13. Click the Create button.

   2. Create the PostgreSQL Service and StatefulSet.

      1. Click the + icon.
      2. Copy the Service and StatefulSet YAML configuration text, and on the Import YAML page, paste the text into the text editor box.
      3. Click the Create button to add the Service and StatefulSet to the keycloak-system project.

4. Open a terminal from your workstation, and log in to the OpenShift cluster:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL to use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.

5. Create a new Secret resource to contain the Transport Layer Security (TLS) certificate and the corresponding private key:

   Syntax

   oc create secret tls SECRET_NAME -n NAMESPACE --cert CERTIFICATE_FILE_NAME --key PRIVATE_KEY_FILE_NAME

   Example

   $ oc create secret tls keycloak-tls -n keycloak-system --cert certificate.pem --key key.pem

   Note

   The OpenShift’s service serving certificate can automate the generation and management of a TLS certificates for use by Keycloak. Refer to the appendix for more information.

6. In OpenShift web console, expand Operators from the navigation menu, and click OperatorHub.
7. In the search field, type keycloak, and click the Keycloak Operator tile from the certified Red Hat catalog.
8. Click the Install button to show the operator details.
9. On the Install Operator page, select keycloak-system from the Installed Namespace drop-down menu, and click the Install button. Wait for the installation to finish.
10. After the installation finishes, click the View Operator button.
11. Click Create instance on the Keycloak tile.

12. On the Create Keycloak page, select YAML view.

    1. On the name line, replace example-keycloak with your custom name, for example, keycloak.

    2. The host name can either be explicitly specified within the hostname property or automatically generated similar to other routes. On the hostname line, replace example.org with your custom host name.

       Note

       See the appendix for the steps necessary to have OpenShift generate the host name for the Keycloak instance.

    3. Under the spec section, add your database details:

       Example

       spec:
       ...
         db:
           vendor: postgres
           host: postgresql-db
           usernameSecret:
             name: postgresql-db
             key: username
           passwordSecret:
             name: postgresql-db
             key: password
       ...

    4. Also, under the spec section, for the http property, specify the name of the Secret resource containing the TLS certificates.

       Example

       spec:
       ...
         http:
           tlsSecret: keycloak-tls
       ...

    5. Click the Create button.
13. Expand the Networking navigation menu, and click Routes.
14. To open the Keycloak Administration Console, click the link to the route associated with the Keycloak instance.
15. The default credentials for the admin user are stored in a Secret called keycloak-initial-admin. To locate the password, expand the Workloads navigation menu, and click Secrets.
16. Select the keycloak-initial-admin Secret.
17. Under the Data section, locate the password key, and click the icon.
18. On the Keycloak Administration Console log in page, enter admin as the username, and paste the contents of the previous step as the password.

19. Create a new realm called trusted-artifact-signer.

    1. On the navigation menu, select the Red Hat Build of Keycloak drop-down menu.
    2. Select Create Realm.
    3. Enter trusted-artifact-signer as the Resource name.
    4. Click Create to create the new realm.

20. Create a new User. The new user can log in to the Keycloak Administration Console, and can also sign containers and commits using RHTAS.

    1. On the navigation menu, under the Manage section, and select Clients.
    2. Click the Create Client button
    3. In the Client Id field, enter trusted-artifact-signer.
    4. Optionally, you can enter a Name and Description into the corresponding fields.
    5. Click Next.
    6. Accept the default options for the Capability Config step of the new client creation process.
    7. Click Next.
    8. In the Valid redirect URIs field, enter *.
    9. Click Save to create the client.
21. On the navigation menu, under the Configure section, select Realm Settings to locate the Issuer URL for the trusted-artifact-signer realm.
22. Next to Endpoints, click the OpenID Endpoint Configuration link.
23. Copy the URL from the issuer property.

24. Under the .spec.fulcio.config.OIDCIssuers section of the SecureSign resource for RHTAS, replace CLIENT_ID with trusted-artifact-signer, and paste the URL content to replace RHBK_REALM_ISSUER_URL:

    Syntax

    spec:
    ...
      fulcio:
        config:
          OIDCIssuers:
            - ClientID: CLIENT_ID
              Issuer: 'RHBK_REALM_ISSUER_URL'
              IssuerURL: 'RHBK_REALM_ISSUER_URL'
              Type: email
    ...

    Example

    spec:
    ...
      fulcio:
        config:
          OIDCIssuers:
            - ClientID: trusted-artifact-signer
              Issuer: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer'
              IssuerURL: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer'
              Type: email
    ...

Procedure

1. Open a terminal on your workstation, and log in to OpenShift:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.

2. Find the AWS OIDC provider URL:

   Example

   $ oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}'

3. Update RHTAS the configuration.

   1. Open for editing the Securesign resource:

      Syntax

      oc edit Securesign NAME -n NAMESPACE

      Example

      $ oc edit Securesign securesign-sample -n trusted-artifact-signer

      Note

      You must use the project name created for the RHTAS installation as the namespace.

   2. Under the OIDCIssuers section, add a new subsection with your AWS STS client identifier, issuer’s URL, and set the Type value to kubernetes:

      Example

      ...
      OIDCIssuers:
        - Issuer: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c"
          IssuerURL: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c"
          ClientID: "trusted-artifact-signer"
          Type: kubernetes
      ...

   3. Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack.

4. Configure the AWS command-line tool by entering your access key, secret key, default region, and output format:

   Example

   $ aws configure

5. Set the following environment variables:

   Example

   $ export account_id=$(aws sts get-caller-identity --query "Account" --output text)
   $ export oidc_provider="$(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}' | cut -d '/' -f3-)"
   $ export role_name=rhtas-sts
   $ export namespace=rhtas-sts
   $ export service_account=cosign-sts

6. Create a Trust Policy that gets associated with newly created IAM roles:

   Example

   $ cat >trust-relationship.json <<EOF
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::${account_id}:oidc-provider/${oidc_provider}"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "${oidc_provider}:aud": "trusted-artifact-signer"
           }
         }
       }
     ]
   }
   EOF

7. Create a new IAM role for the RHTAS service by using the trust policy:

   Example

   $ aws iam create-role --role-name rhtas-sts --assume-role-policy-document file://trust-relationship.json --description "Red Hat Trusted Artifact Signer STS Role"

8. On the OpenShift cluster with STS enabled, create a new project namespace:

   Syntax

   oc new-project NAMESPACE

   Example

   $ oc new-project rhtas-sts

9. Create a service account for assuming an IAM role, and running a workload within the OpenShift project namespace.

   1. Create the service account manifest:

      Example

      $ cat >service_account.yaml <<EOF
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: $service_account
        namespace: $namespace
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::${account_id}:role/${role_name}"
          # optional: Defaults to "sts.amazonaws.com" if not set
          eks.amazonaws.com/audience: "trusted-artifact-signer"
          # optional: When "true", adds AWS_STS_REGIONAL_ENDPOINTS env var to containers
          eks.amazonaws.com/sts-regional-endpoints: "true"
          # optional: Defaults to 86400 for expirationSeconds if not set
          eks.amazonaws.com/token-expiration: "86400"
      EOF

   2. Apply the service account manifest to OpenShift:

      Example

      $ oc apply -f service_account.yaml

10. Create a new deployment workload for signing container images within a image registry.

    1. Create the deployment manifest:

       Example

       $ cat >deployment.yaml <<EOF
       apiVersion: apps/v1
       kind: Deployment
       metadata:
         name: cosign-sts
         namespace: ${namespace}
       spec:
         selector:
           matchLabels:
             app: cosign-sts
         template:
           metadata:
             labels:
               app: cosign-sts
           spec:
             securityContext:
               runAsNonRoot: true
             serviceAccountName: cosign-sts
             containers:
             - args:
               - -c
               - env; cosign initialize --mirror=\$COSIGN_MIRROR --root=\$COSIGN_ROOT; while true; do sleep 86400; done
               command:
               - /bin/sh
               name: cosign
               image: registry.redhat.io/rhtas-tech-preview/cosign-rhel9@sha256:f4c2cec3fc1e24bbe094b511f6fe2fe3c6fa972da0edacaf6ac5672f06253a3e
               pullPolicy: IfNotPresent
               env:
               - name: AWS_ROLE_SESSION_NAME
                 value: signer-identity-session
               - name: AWS_REGION
                 value: us-east-1
               - name: OPENSHIFT_APPS_SUBDOMAIN
                 value: $(oc get cm -n openshift-config-managed  console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
               - name: OIDC_AUTHENTICATION_REALM
                 value: "trusted-artifact-signer"
               - name: COSIGN_FULCIO_URL
                 value: $(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
               - name: COSIGN_OIDC_ISSUER
                 value: $(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}')
               - name: COSIGN_CERTIFICATE_OIDC_ISSUER
                 value: $(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}')
               - name: COSIGN_REKOR_URL
                 value: $(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
               - name: COSIGN_MIRROR
                 value: $(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
               - name: COSIGN_ROOT
                 value: "$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)/root.json"
               - name: COSIGN_YES
                 value: "true"
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities:
                   drop:
                   - ALL
             dnsPolicy: ClusterFirst
             restartPolicy: Always
             schedulerName: default-scheduler
             securityContext:
               runAsNonRoot: true
             serviceAccount: ${service_account}
             serviceAccountName: ${service_account}
             terminationGracePeriodSeconds: 30
       EOF

    2. Apply the deployment manifest to OpenShift:

       Example

       $ oc apply -f deployment.yaml

11. Create a test container image to sign.

    1. Create an empty container image:

       Example

       $ echo "FROM scratch" > ./tmp.Dockerfile
       $ podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h

    2. Push the empty container image to the ttl.sh ephemeral registry:

       Example

       $ podman push ttl.sh/rhtas/test-image:1h

    3. Remove the temporary Docker file:

       Example

       $ rm ./tmp.Dockerfile

12. Validate the configuration by signing and verifying the test container image.

    1. Open a remote shell session within a running pod:

       Syntax

       oc rsh -n NAMESPACE deployment/cosign-sts env IMAGE=IMAGE_NAME:TAG /bin/sh

       Example

       $ oc rsh -n rhtas-sts deployment/cosign-sts env IMAGE=ttl.sh/rhtas/test-image:1h /bin/sh

    2. Sign the container image:

       Example

       $ cosign sign -y --identity-token=$(cat $AWS_WEB_IDENTITY_TOKEN_FILE) ttl.sh/rhtas/test-image:1h

    3. Verify the signed container image:

       Example

       $ cosign verify --certificate-identity=https://kubernetes.io/namespaces/$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/serviceaccounts/cosign-sts --certificate-oidc-issuer=$COSIGN_CERTIFICATE_OIDC_ISSUER ttl.sh/rhtas/test-image:1h

Procedure

1. Open a terminal on your workstation, and log in to OpenShift:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.

2. Log in to the Red Hat SSO console.

   1. Find the Red Hat SSO console URL from the command line:

      Example

      $ oc get routes -n keycloak-system keycloak -o jsonpath='https://{.spec.host}'

   2. Copy and paste the Red Hat SSO console URL into your web browser.
   3. Click Administration Console.

   4. Retrieve the admin password from the command line:

      Example

      $ oc get secret/credential-keycloak -n keycloak-system -o jsonpath='{ .data.ADMIN_PASSWORD }' | base64 -d

      Copy the output from this command.

   5. From your web browser, log in as the admin user, and paste the password in the corresponding field. Click the Sign In button.
3. Select your realm from the dropdown on the navigation menu.

4. Add the GitHub identity provider.

   1. From the navigational menu, click Identity Providers.
   2. From the Add provider… drop-down menu, select GitHub.
   3. Add your GitHub OAuth client identifier to the Client ID field.
   4. Add your GitHub OAuth client secret to the Client Secret field.
   5. Turn on the Trust Email option.
   6. Click the Save button.

5. Add the identity provider mapper to the newly created identity provider.

   1. Click the Mapper tab.
   2. Click the Create button.
   3. Give a Name to the new mapper.
   4. Change the Mapper Type to Hardcoded Attribute.
   5. Set the User Attribute field to emailVerified.
   6. Set the User Attribute Value field to true.
   7. Click the Save button.
6. From the GitHub Identity Provider Settings page, copy the Redirect URI value and paste it to your GitHub OAuth app Authorization Callback URL field. Also, paste this same value into the Homepage URL field, but remove the broker/github/endpoint part of the URL string.
7. Click Update Application. You can now sign commits, and containers by using GitHub as your OIDC provider.
8. When signing artifacts, a web browser opens and prompts you to sign in to your Red Hat SSO account. Click the GitHub button to sign in with your credentials.
9. Click the Authorize button to enable GitHub user details to be accessible by Red Hat SSO.

Procedure

1. Open a terminal on your workstation.

2. Create an App Registration within Microsoft Entra ID representing a client:

   Example

   $ export RHTAS_APP_REGISTRATION=$(az ad app create --display-name=rhtas --web-redirect-uris=http://localhost:0/auth/callback --enable-id-token-issuance --query appId -o tsv)

3. Create a new client secret that allows user to use the App Registration to get a ID token:

   Example

   $ export RHTAS_APP_REGISTRATION_CLIENT_SECRET=$(az ad app credential reset --id=$RHTAS_APP_REGISTRATION --display-name="RHTAS Client Secret" -o tsv --query 'password')

   Note

   By default, client secrets are only valid for one year. You can customize this value by using the --years or --end-date flags.

4. Create a new Claim Mapping Policy to define a new JWT claim called email_verified, use a static value of true:

   Example

   $ az rest -m post --headers Content-Type=application/json --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies --body '{"definition": ["{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\":[{\"value\":\"true\",\"JwtClaimType\":\"email_verified\"}]}}"],"displayName": "EmailVerified"}'

5. Get the App Registration object identifier:

   Example

   $ export RHTAS_APP_REGISTRATION_OBJ_ID=$(az ad app show --id $RHTAS_APP_REGISTRATION --output tsv --query id)

6. Update the App Registration manifest:

   Example

   $ az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/${RHTAS_APP_REGISTRATION_OBJ_ID} --headers 'Content-Type=application/json' --body "{\"api\":{\"acceptMappedClaims\":true}}"

7. Create a new Service Principal and associate it with the App Registration:

   Example

   $ export SERVICE_PRINCIPAL_ID=$(az ad sp create --id=${RHTAS_APP_REGISTRATION} -o tsv --query 'id')

8. Get the Claim Mapping Policy identifier:

   Example

   $ export CLAIM_MAPPING_POLICY_ID=$(az rest --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies -o tsv --query "value[?displayName=='EmailVerified'] | [0].id")

9. Associate the Claim Mapping Policy with the Service Principal:

   Example

   $ az rest -m post --headers Content-Type=application/json --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${SERVICE_PRINCIPAL_ID}/claimsMappingPolicies/\$ref" --body "{\"@odata.id\": \"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/${CLAIM_MAPPING_POLICY_ID}\"}"

10. Get the tenant identifier:

    Example

    $ export TENANT_ID=$(az account show -o tsv --query tenantId)

11. Get OIDC endpoint:

    Example

    $ export ENTRA_ID_OIDC_ENDPOINT=$(echo https://login.microsoftonline.com/${TENANT_ID}/v2.0)

12. Update the RHTAS configuration.

    1. Open for editing the Securesign resource:

       Syntax

       oc edit Securesign NAME -n NAMESPACE

       Example

       $ oc edit Securesign securesign-sample -n trusted-artifact-signer

       Note

       You must use the project name created for the RHTAS installation as the namespace.

    2. Under the OIDCIssuers section, add a new subsection with the client identifier, issuer’s URL, and set the Type value to email:

       Syntax

       ...
       OIDCIssuers:
         - Issuer: "${ENTRA_ID_OIDC_ENDPOINT}"
           IssuerURL: "${ENTRA_ID_OIDC_ENDPOINT}"
           ClientID: "${RHTAS_APP_REGISTRATION}"
           Type: email
       ...

    3. Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack.

13. Create a local client secret file:

    Example

    $ echo $RHTAS_APP_REGISTRATION_CLIENT_SECRET > rhtas-entra-id-client-secret

14. Configure your shell environment for signing artifacts:

    Example

    $ export TUF_URL=$(oc get tuf -n trusted-artifact-signer -o jsonpath='{.items[0].status.url}')
    $ export OIDC_ISSUER_URL=$(oc get securesign -n trusted-artifact-signer rhtas -o jsonpath='{ .spec.fulcio.config.OIDCIssuers[0].Issuer }')
    $ export COSIGN_REKOR_URL=$(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
    $ export COSIGN_MIRROR=$TUF_URL
    $ export COSIGN_ROOT=$TUF_URL/root.json
    $ export COSIGN_OIDC_CLIENT_ID=$RHTAS_APP_REGISTRATION
    $ export SIGSTORE_OIDC_CLIENT_ID=$COSIGN_OIDC_CLIENT_ID
    $ export COSIGN_OIDC_ISSUER=$OIDC_ISSUER_URL
    $ export COSIGN_CERTIFICATE_OIDC_ISSUER=$OIDC_ISSUER_URL
    $ export COSIGN_YES="true"
    $ export COSIGN_FULCIO_URL=$(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
    $ export SIGSTORE_FULCIO_URL=$COSIGN_FULCIO_URL
    $ export SIGSTORE_OIDC_ISSUER=$COSIGN_OIDC_ISSUER
    $ export SIGSTORE_REKOR_URL=$COSIGN_REKOR_URL
    $ export COSIGN_OIDC_CLIENT_SECRET_FILE=$(pwd)/rhtas-entra-id-client-secret

15. Initialize the local machine for signing:

    Example

    $ cosign initialize

16. Verify the updated configuration by signing a test container image.

    1. Create an empty container image:

       Example

       $ echo "FROM scratch" > ./tmp.Dockerfile
       $ podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h

    2. Push the empty container image to the ttl.sh ephemeral registry:

       Example

       $ podman push ttl.sh/rhtas/test-image:1h

    3. Remove the temporary Docker file:

       Example

       $ rm ./tmp.Dockerfile

    4. Sign the container image:

       Syntax

       cosign sign -y --oidc-client-secret-file=SECRET_FILE IMAGE_NAME:TAG

       Example

       $ cosign sign -y --oidc-client-secret-file=rhtas-entra-id-client-secret ttl.sh/rhtas/test-image:1h

       A web browser opens allowing you to sign the container image with an email address.