Multi-tenancy needs authentication and authorization. Keycloack serves these two features.
In order to provide multi-tenancy of A&AI, A&AI can leverage Springboot security feature to interact with Keycloak. This document explains how to set up Keycloak and A&AI to provide essential authentication and authorization services for multi-tenancy
Keycloak setup
If you run Keycloak on your laptop instead of running on Kubernetes, docker run -p 8080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin quay.io/keycloak/keycloak:11.0.2
https://www.keycloak.org/getting-started/getting-started-docker
To install on Kubernetes, run the command below
kubectl create -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/latest/kubernetes-examples/keycloak.yaml
You can use kubernetes manifest file below.
It exposes Keycloak as a LoadBalancer service of Kubernetes. You can connect the Keycloak instance via 8080 port.
Tips. For development purposes, you can use port-forwarding feature of Kubernetes to connect the Keycloak instance. kubectl port-forward keycloak-pod-name source-port:target-port e.g kubectl port-forward keycloak-54b8bd56b9-tqsgb 8080:8080
1. realm setting
Realm in Keycloak manages users, applications and groups. The first step of Keycloak setting is log-in to admin console via a web browser.
Since, you port-forward your 8080 port into Keycloack instance running in a Kubernetes cluster, you can log in with http://localhost:8080/auth/admin/
For more information, https://www.keycloak.org/docs/latest/getting_started/
You can set up a new realm through the admin console or simply import realm json file.
Here's a sample realm file
2. Create a client
The client is an entity requesting a credential from a Keycloak. Click the Clients menu
Select Client Protocol to openid-connect and Root URL as http://localhost:8080 then click Save.
Once Settings page, change Access type to confidential, service account, Authorization to on, and leave the default values as they are.
click save.
3. Create a client role
Select Roles tab
Click the Add Role button and create user and admin roles
4. Create a realm role
Select Roles from the main menu on the left and click Add role button.
Create app-admin and app-user realm roles.
Realm roles and client roles are different but there are associations.
Once you finished adding role, click app-admin role
Select a client for auth-demo-app that we just created above.
Associate realm roles to corresponding clients roles
5. Create a user
Users are entities that are able to log into your system
Now, create a user employee and grant app-user roles
Set Temporary button off because we like to use a permanent password.
Set a password then click Set Password button
aai-resource setup
aai-resource should be configured to interact with Keycloak
1. Configure aai-resource
We assume you have Kubernetes cluster with helm server running. If you like to run aai-resource on your laptop, Run AAI-Resources on your laptop
Clone OOM repository from ONAP gerrit.
git clone -b <BRANCH> <http://gerrit.onap.org/r/oom> --recurse-submodules
cd oom/kubernetes
Open oom/kubernetes/aai/values.yaml file to turn on Spring security with Keycloak.
Edit profiles.active to include keycloak
# Active spring profiles for the resources microservice
profiles:
#active: production,dmaap,aaf-auth
active: production,keycloak
edit /oom/kubernetes/aai/components/aai-resources/values.yaml file to change keycloak.host and keycloak.port properties.
If you like to config keycloak server and port after deployment, you can skip modifying aai-resource/values.yaml file.
Once you finished editing value.yaml file, run
SKIP_LINT=true make all command from oom/kubernetes directory to build helm charts for ONAP deployment
Once, building charts are done, you can modify aai-resource's value.yaml and deploy aai-resource onto Kubernetes cluster.
You can find onap-core-sdc.yaml here.
Run the command below.
helm deploy dev local/onap --namespace onap -f onap-core-sdc.yaml --timeout 900
2. verify configmap
In order to verify aai-resource is properly configured, run kubectl describe configmap dev-aai-resources-configmap -n onap | grep keycloak
You command outputs should show spring.properties.active=production,keycloak as we modified value.yaml earlier.
As you can see the output above keycloak.auth-server-url is not properly configured.
3. Fix configmap after deployment
aai-resource is configured to connect Keycloak server. You can configure before and after aai-resource is deployed.
To configure after its deployment, you need to know keycloak server ip address.
kubectl get pod and kubectl describe pod keycloak-xxx will show you keycloak server IP and port.
To edit aai-resource's configmap, run the command below. It will open an editor.
kubectl edit configmap -n onap dev-aai-resources-configmap -o yaml
Modify the keycloak.auth-server-url line with the IP address and port you got from kubectl get svc
To apply the change on configmap, run
kubectl get configmap dev-aai-resources-configmap -n onap -o yaml | kubectl apply -f -
Then restart aai-resource deployment.
To find aai-resource's deployment
kubectl get deployment -n onap
kubectl rollout restart deployments/dev-aai-resources -n onap
Test Multi-tenancy Locally
In order to test multi-tenancy locally, you need to run aai-resource and aai-traversal locally, along with Keycloak and Cassandra, following steps below:
Setup Keycloak and Cassandra by downloading a configuration zip file attached and run
docker-compose up
- Clone required repositories, aai-common, aai-resource and aai-traversal.
Install aai-common with
mvn clean install -DskipTests=true
- Modify application.properties file under resources/aai-resources/src/main/resources directory.
# Switch to keycloak
spring.profiles.active=production, keycloak - Modify application.properties file under traversal/aai-traversal/src/main/resources directory.
# Switch to keycloak
spring.profiles.active=production, keycloak Run resources and traversal with the commands below:
cd aai-resources mvn -N -P runAjsc -Dserver.local.startpath=src/main/resources/ cd aai-traversal mvn -N -P runAjsc -Dserver.local.startpath=src/main/resources/
Demo
Running test suites
The test suites has the following sequences
2 Comments
Dasarathi Swain
Hello William Reehil / Mohammad Hosnidokht ,
I am referring to the above steps to run locally, below are issues we are getting
Ideally, it should work without any changes in the Istanbul branch code. Could you please suggest
Regard's
Dasarathi Swain
FABIO CONTORNO
Hello William Reehil / Mohammad Hosnidokht ,
I tried with a local configuration of the module aai-resources version 1.9.5, I have the same error:
how can i solve?
Regard's
FABIO CONTORNO