Chapter 7. Securing data

Procedure

1. From a browser, log in to the Red Hat Single Sign-On Admin Console.

2. Create a realm for your data virtualization service.

   1. From the menu for the master realm, hover over Master and then click Add realm.
   2. Type a name for the realm, such as datavirt, and then click Create.

3. Add roles.

   1. From the menu, click Roles.
   2. Click Add Role.
   3. Type a name for the role, for example ReadRole, and then click Save.
   4. Create other roles as needed to map to the roles in your organization’s LDAP or Active Directory. For information about federating user data from external identity providers, see the Server Administration Guide.

4. Add users.

   1. From the menu, click Users, and then click Add user.
   2. On the Add user form, type a user name, for example, user, specify other user properties that you want to assign, and then click Save.
      Only the user field is mandatory.
   3. From the details page for the user, click the Credentials tab.
   4. Type and confirm a password for the user, click Reset Password, and then click Change password when prompted.

5. Assign roles to the user.

   1. Click the Role Mappings tab.
   2. In the Available Roles field, click ReadRole and then click Add selected.
6. Create a second user called developer, and assign a password and roles to the user.

7. Create a data virtualization client entry.

   The client entry represents the data virtualization service as an SSO client application. .. From the menu, click Clients. .. Click Create to open the Add Client page. .. In the Client ID field, type a name for the client, for example, dv-client. .. In the Client Protocol field, choose openid-connect. .. Leave the Root URL field blank, and click Save.

Procedure

1. Log in to the Red Hat Single Sign-On Admin Console to find the values for the required authentication properties.

2. In a text editor, open the CR YAML file that you used to deploy your virtual database, and define authentication environment variables that are based on the values of your Red Hat Single Sign-On properties.

   For example:

   env:
     - name: KEYCLOAK_REALM
       value: master
     - name: KEYCLOAK_AUTH_SERVER_URL
       value: http://rh-sso-datavirt.openshift.example.com/auth
       - name: KEYCLOAK_RESOURCE
         value: datavirt
     - name: KEYCLOAK_SSL_REQUIRED
       value: external
     - name: KEYCLOAK_PUBLIC_CLIENT
       value: true

3. Declare a build source dependency for the following Maven artifact for securing data virtualizations: org.teiid:spring-keycloak

   For example:

   env:
     ....
     build:
       source:
         dependencies:
           - org.teiid:spring-keycloak

4. Save the CR.

Procedure

1. In a text editor, open the file that contains the DDL description that you used to deploy the virtual database.

2. Insert statements to add any roles that you defined for virtual database users in Red Hat Single Sign-On. For example, to add a role with the name ReadRole add the following statement to the DDL:

   CREATE ROLE ReadRole WITH FOREIGN ROLE ReadRole;

   Add separate CREATE ROLE statements for each role that you want to implement for the virtual database.

3. Insert statements that specify the level of access that users with the role have to database objects. For example,

   GRANT SELECT ON TABLE "portfolio.CustomerZip" TO ReadRole

   Add separate GRANT statements for each role that you want to implement for the virtual database.

4. Save and close the CR or DDL file.

   You are now ready to redeploy the virtual database. For information about how to run the Data Virtualization Operator to deploy the virtual database, see Chapter 6, Running the data virtualization operator to deploy a virtual database.

   After you redeploy the virtual database, add a redirect URL in the Red Hat Single Sign-On Admin Console. For more information, see Section 7.1.4, “Adding a redirect URI for the data virtualization client in the Red Hat Single Sign-On Admin Console”.

Procedure

1. From a browser, sign in to the Red Hat Single Sign-On Admin Console.
2. From the security realm where you created the client for the data virtualization service, click Clients in the menu, and then click the ID of the data virtualization client that you created previously (for example, dv-client).
3. In the Valid Redirect URIs field, type the root URL for the OData service and append an asterisk to it. For example, http://datavirt.odata.example.com/*

4. Test whether Red Hat Single Sign-On intercepts calls to the OData API.

   1. From a browser, type the address of an OData endpoint, for example:

      http://datavirt.odata.example.com/odata/CustomerZip

      A login page prompts you to provide credentials.

5. Sign in with the credentials of an authorized user.

   Your view of the data depends on the role of the account that you use to sign in.