Keycloak is Open Source Identity and Access Management for Modern Applications and Services.
It can also act as a Federated OpenID Connect provider. It can connect to a variety of backends. In this deployment it is not connected to a backend, and just uses its own internal format persisted to a local Postgres DB.
This chart can be deployed alongside onos-umbrella or any other umbrella chart that requires an OpenID provider.
Add the Bitnami repo to helm, if you don't already have them:
helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update
To install the standalone Keycloak server in to a namespace e.g. aether use:
helm -n aether install keycloak bitnami/keycloak -f onosproject/onos-helm-charts/keycloak/values.yaml
This will make it available at http://localhost:80
Now GUI applications with security enabled will redirect to this localhost:80 and when login is successful will redirect to an authenticated GUI.
To test it, browse to http://localhost/realms/master/.well-known/openid-configuration to see the configuration.
There are 7 users in 8 groups with the LDIF defined in values.yaml
User login Group: mixedGroup charactersGroup AetherROCAdmin EnterpriseAdmin starbucks acme defaultent aiab-enterprise =================================================================================================================================================================== Alice Admin alicea@opennetworking.org ✓ ✓ Bob Cratchit bobc@opennetworking.org ✓ ✓ Charlie Brown charlieb@opennetworking.org ✓ Daisy Duke daisyd@opennetworking.org ✓ ✓ ✓ ✓ Elmer Fudd elmerf@opennetworking.org ✓ ✓ ✓ Fred Flintstone fredf@opennetworking.org ✓ ✓ ✓ ✓ Gandalf The Grey gandalfg@opennetworking.org ✓ ✓ ✓
The password for each is password
Verify the login details at http://localhost/realms/master/account/
To use this service with aether-roc-umbrella chart, deploy in Helm with the following flags:
helm -n aether install aether-roc-umbrella aether/aether-roc-umbrella \
--set onos-config.openpolicyagent.enabled=true \
--set onos-config.openpolicyagent.regoConfigMap=aether-roc-umbrella-opa-rbac \
--set onos-config.openidc.issuer=http://keycloak/realms/master \
--set aether-roc-api.openidc.issuer=http://keycloak/realms/master \
--set aether-roc-gui-v2-1.openidc.issuer=http://localhost/realms/master \
--set prom-label-proxy-acc.config.openidc.issuer=http://keycloak/realms/master \
--set prom-label-proxy-amp.config.openidc.issuer=http://keycloak/realms/master
Note here that the connection to keycloak is inside the cluster for the backend services at
http://keycloakwhereas the GUI connects tohttp://localhost
Note also that the
regoConfigMapvalue includes the name of the deployment
The Keycloak Admin console can be reached at http://localhost admin/admin