Skip to content

Commit 82f58a8

Browse files
aolleaolle
committed
Rewrite
1 parent f9cade7 commit 82f58a8

5 files changed

Lines changed: 114 additions & 148 deletions

File tree

‎documentation/modules/ROOT/nav.adoc‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
1-
* xref:setup.adoc[1. Environment Setup]
2-
** xref:setup.adoc#tools[1.1. Workshop Tools]
3-
** xref:setup.adoc#deploy[1.2. Deploying Red Hat build of Keycloak on OpenShift]
4-
*** xref:setup.adoc#deploy-operator[1.2.1 Deploying Red Hat build of Keycloak on OpenShift using the Operator]
1+
* xref:setup.adoc[Environment Setup]
2+
** xref:setup.adoc#tools[Workshop Tools]
3+
** xref:setup.adoc#deploy[Deploying Red Hat build of Keycloak on OpenShift]
4+
*** xref:setup.adoc#deploy-operator[Deploying Red Hat build of Keycloak on OpenShift using the Operator]
55
//*** xref:setup.adoc#deploy-templates[1.2.2 Deploying Red Hat build of Keycloak on OpenShift with GitOps ]
6-
** xref:setup.adoc#deploy-ipa[1.3 Deploying an Identity Management (IdM/FreeIPA) on Red Hat OpenShift]
6+
** xref:setup.adoc#deploy-ipa[Deploying an Identity Management (IdM/FreeIPA) on Red Hat OpenShift]
77
8-
* xref:secapp.adoc[2. Authorization Services]
9-
** xref:secapp.adoc#presetup[2.1 Configuration]
10-
** xref:secapp.adoc#quarkus-apps[2.2 Securing Web Applications]
8+
* xref:secapp.adoc[Authorization Services]
9+
** xref:secapp.adoc#presetup[Configuration]
10+
** xref:secapp.adoc#quarkus-apps[Securing Web Applications]
1111
12-
* xref:openid-jwt.adoc[3. OpenID Connect + JWT]
13-
** xref:openid-jwt.adoc#architecture[3.1. Architecture]
14-
** xref:openid-jwt.adoc#rhbk[3.2. Configuration]
15-
** xref:openid-jwt.adoc#backend[3.3. Backend]
16-
** xref:openid-jwt.adoc#frontend[3.4. Frontend]
12+
* xref:openid-jwt.adoc[OpenID Connect + JWT]
13+
** xref:openid-jwt.adoc#architecture[Architecture]
14+
** xref:openid-jwt.adoc#rhbk[Configuration]
15+
** xref:openid-jwt.adoc#backend[Backend]
16+
** xref:openid-jwt.adoc#frontend[Frontend]
1717
18+
* xref:migration.adoc[Migrating from Red Hat Single Sign-On 7.6 to Red Hat Build of Keycloak]
19+
** xref:migration.adoc#setup[Lab Setup for Migration]

‎documentation/modules/ROOT/pages/index.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@
77

88
Red Hat Build of Keycloak enables you to secure your web applications by providing Web SSO capabilities based on popular standards such as OpenID Connect, OAuth 2.0, and SAML 2.0.
99

10-
IMPORTANT: This is not an official guide or workshop provided by Red Hat. For more information on training or guidelines related to this topic or product, please reach out to your designated Red Hat representative.
10+
IMPORTANT: This is not an official guide or workshop provided by Red Hat. For official training, documentation, or guidance related to this product, please contact your designated Red Hat representative.

‎documentation/modules/ROOT/pages/migration.adoc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
= Migrating from Red Hat Single Sign-On 7.6 to Red Hat Build of Keycloak
2+
include::_attributes.adoc[]
3+
4+
[#setup]
5+
== Lab Setup for Migration
6+

‎documentation/modules/ROOT/pages/secapp.adoc‎

Lines changed: 61 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ include::_attributes.adoc[]
44
[#presetup]
55
== Configuration
66

7-
Before proceeding with the next sections, we need to configure the realm, roles and users in our Red Hat build of Keycloak instance.
7+
Before proceeding with the next sections, we need to configure the realm, roles, and users in our Red Hat build of Keycloak instance.
88

9-
* Open a browser window and log in to the Red Hat build of Keycloak administration web console.
9+
* Open a browser window and log in to the Red Hat build of Keycloak administration console.
1010
11-
* Create the `demo` realm. Click on the `master` realm dropdown menu, click `Create Realm`.
11+
* Create the `demo` realm. Click the `master` realm dropdown menu and select `Create Realm`.
1212
1313
image::authservices/create-realm.png[]
1414

@@ -24,29 +24,29 @@ image::authservices/groups.png[]
2424
2525
image::authservices/groups2.png[]
2626

27-
* Set `staff` as the group name, and click `Create`.
27+
* Set `staff` as the group name and click `Create`.
2828
2929
image::authservices/groups3.png[]
3030

31-
* Create the child group named `Personal staff`. Click on the kebab button of the `staff` group and click `Create child group`.
31+
* Create the child group named `Personal staff`. Click on the kebab menu (⋮) of the `staff` group and select `Create child group`.
3232
3333
image::authservices/groups4.png[]
3434

35-
* Set `Personal staff` as the name, and click `Create`.
35+
* Set `Personal staff` as the name and click `Create`.
3636
3737
image::authservices/groups5.png[]
3838

39-
* Create the role `vet`. Click on `Realm roles`, then `Create role`.
39+
* Create the `vet` role. Click on `Realm roles`, then `Create role`.
4040
4141
image::authservices/roles.png[]
4242

4343
image::authservices/roles2.png[]
4444

45-
* Set the Role name, and click `Save`.
45+
* Set the role name and click `Save`.
4646
4747
image::authservices/roles3.png[]
4848

49-
* Repeat the same steps for creating a role named `assistant`.
49+
* Repeat the same steps to create a role named `assistant`.
5050
5151
image::authservices/roles4.png[]
5252

@@ -56,11 +56,11 @@ image::authservices/users.png[]
5656

5757
image::authservices/users2.png[]
5858

59-
* Set the username, and click `Create`.
59+
* Set the username and click `Create`.
6060
6161
image::authservices/users3.png[]
6262

63-
* Open the `Credentials` tab and set the password for the user. Make sure to set `Temporary` to `OFF` before setting the password.
63+
* Open the `Credentials` tab and set a password for the user. Ensure that `Temporary` is set to `OFF` before setting the password.
6464
6565
image::authservices/users4.png[]
6666

@@ -80,14 +80,14 @@ image::authservices/users9.png[]
8080

8181
image::authservices/users10.png[]
8282

83-
* Repeat the same steps for creating a user named `elisabeth` but assign the `assistant` role. Also, remember to incude the user in the `Personal staff` group.
83+
* Repeat the same steps to create a user named `elisabeth`, assigning the `assistant` role and adding the user to the `Personal staff` group.
8484
8585
[#quarkus-apps]
8686
== Securing Web Applications
8787

88-
The sample application that we will use in this section is the `Quarkus Petclinic project`.
88+
The sample application used in this section is the `Quarkus Petclinic` project.
8989

90-
In this tutorial, we will work with a version that has been modified for the tutorial.
90+
In this tutorial, we will work with a version that has been modified for demonstration purposes.
9191

9292
The repository for this modified version is:
9393

@@ -117,13 +117,13 @@ image::authservices/petclinic-main.png[]
117117
118118
Before securing the application, let's configure a new client in our Red Hat build of Keycloak realm.
119119
120-
* Open a browser window and log in to the Red Hat build of Keycloak administration web console.
120+
* Open a browser window and log in to the Red Hat build of Keycloak administration console.
121121
122-
* Select our `demo` realm and click `Clients`. Click `Create client`.
122+
* Select the `demo` realm and click `Clients`. Click `Create client`.
123123
124124
image::authservices/client.png[]
125125
126-
* Set `quarkus-petclinic` as `Client ID`. Click `Next` until `Save`.
126+
* Set `quarkus-petclinic` as the `Client ID`. Click `Next` until `Save`.
127127
128128
image::authservices/client2.png[]
129129
@@ -135,76 +135,83 @@ image::authservices/client2.png[]
135135
136136
image::authservices/client3.png[]
137137
138-
At this point, we have the `demo` realm with the `quarkus-petclinic` client; additionally, we created two roles and two users: the user `angel` that has the `vet` role and the user `elisabeth` that has the role `assistant`.
138+
At this point, we have the `demo` realm with the `quarkus-petclinic` client. We also created two roles and two users:
139+
the user `angel` with the `vet` role, and the user `elisabeth` with the `assistant` role.
139140
140-
* The authorization granularity that we want to configure based on our application is the following:
141-
** Any user that belongs to the `demo` realm, like `elisabeth`, can browse the application except the `VETERINARIANS` resource.
142-
** Only the users with the role `vet` can view the `VETERINARIANS` resource (which has the `/vets.html` context).
143-
** Any other user access outside the realm will be rejected.
141+
* The authorization granularity we want to configure in our application is as follows:
142+
** Any user that belongs to the `demo` realm, like `elisabeth`, can browse the application except for the `VETERINARIANS` resource.
143+
** Only users with the `vet` role can view the `VETERINARIANS` resource (which corresponds to the `/vets.html` path).
144+
** Any user outside the realm will be denied access.
144145
145146
image::authservices/quarkus-petclinic-menu.png[]
146147
147148
Let's configure our client authorization.
148149
149-
* Open a browser window and log in to the Red Hat build of Keycloak administration web console. Browse to our `quarkus-petclinic` client and click the `Authorization` and then `Policies` tabs.
150+
* Open a browser window and log in to the Red Hat build of Keycloak administration console.
151+
Browse to the `quarkus-petclinic` client and click the `Authorization` tab, then the `Policies` tab.
150152
151153
image::authservices/client4.png[]
152154
153-
* Click `Create policy`, select `Group`.
155+
* Click `Create policy` and select `Group`.
154156
155157
image::authservices/client5.png[]
156158
157-
* Set `Default Group Policy` as the `Name`. Add the `staff` group to the `Groups` list. Make sure that the `Logic` is set to `Positive` and `Extend to Children` is checked (to enable the checkbox, you may need to click `Save` first). Finally, click `Save`.
159+
* Set `Default Group Policy` as the `Name`.
160+
Add the `staff` group to the `Groups` list.
161+
Ensure that the `Logic` is set to `Positive` and that `Extend to Children` is checked (to enable it, you may need to click `Save` first).
162+
Finally, click `Save`.
158163
159164
image::authservices/client6.png[]
160165
161-
* Come back, select the `Resources` tab and click `Create Permission` for the `Default Resource`.
166+
* Go back, select the `Resources` tab, and click `Create permission` for the `Default Resource`.
162167
163168
image::authservices/client7.png[]
164169
165-
* Set `Default Resource Permission` as `Name` and select `Default Resource` as `Resources`. Add the recently created `Default Group Policy` policy. Click `Save`.
170+
* Set `Default Resource Permission` as the `Name` and select `Default Resource` as the `Resource`.
171+
Add the previously created `Default Group Policy` and click `Save`.
166172
167173
image::authservices/client8.png[]
168174
169-
* Come back again, select the `Resources` tab and create a new resource by clicking on `Create resource`.
175+
* Go back again, select the `Resources` tab, and click `Create resource`.
170176
171177
image::authservices/client9.png[]
172178
173-
* Set `Vets Resource` as `Name` and `Display name`, and `/vets.html` as URI. Click `Save`.
179+
* Set `Vets Resource` as both the `Name` and `Display name`, and `/vets.html` as the `URI`. Click `Save`.
174180
175181
image::authservices/client10.png[]
176182
177-
* Browse to `Authorization` and `Policies` tabs. Click on `Create Policy`.
183+
* Navigate to the `Authorization` → `Policies` tab and click `Create policy`.
178184
179185
image::authservices/client11.png[]
180186
181-
* Select `Role`
187+
* Select `Role`.
182188
183189
image::authservices/client12.png[]
184190
185-
* Set `Vet Role Policy` as the Name, `vet` as `Realm Roles`, and check required. Click `Save`.
191+
* Set `Vet Role Policy` as the `Name`, select `vet` under `Realm Roles`, check `Required`, and click `Save`.
186192
187193
image::authservices/client13.png[]
188194
189-
* Browse to the `Authorization` and `Resources` tabs.
195+
* Navigate to the `Authorization` → `Resources` tab.
190196
191-
* Click on `Create Permission` for the `Vets Resource`.
197+
* Click `Create permission` for the `Vets Resource`.
192198
193199
image::authservices/client14.png[]
194200
195-
* Set `Vets Resource Permission` as `Name`. And apply the `Vet Role Policy`. Click `Save`.
201+
* Set `Vets Resource Permission` as the `Name` and apply the `Vet Role Policy`. Click `Save`.
196202
197203
image::authservices/client16.png[]
198204
199205
At this point, the Red Hat build of Keycloak client is properly configured.
200206
201207
Let's configure the application side.
202208
203-
* Open a browser window and log in to the Red Hat build of Keycloak administration web console. Browse to our `quarkus-petclinic` client and click the `Credentials` tab. Write down the `Secret` value, we will need it soon.
209+
* In the Keycloak administration console, browse to the `quarkus-petclinic` client and click the `Credentials` tab.
210+
Write down the `Secret` value — you will need it soon.
204211
205212
image::authservices/client15.png[]
206213
207-
* Export the client secret
214+
* Export the client secret:
208215
209216
[.lines_space]
210217
[.console-input]
@@ -219,17 +226,17 @@ export KEYCLOAK_CLIENT_SECRET=<the secret>
219226
[.console-input]
220227
[source,text, subs="+macros,+attributes"]
221228
----
222-
<dependency>
223-
<groupId>io.quarkus</groupId>
224-
<artifactId>quarkus-oidc</artifactId>
225-
</dependency>
226-
<dependency>
227-
<groupId>io.quarkus</groupId>
228-
<artifactId>quarkus-keycloak-authorization</artifactId>
229-
</dependency>
229+
<dependency>
230+
<groupId>io.quarkus</groupId>
231+
<artifactId>quarkus-oidc</artifactId>
232+
</dependency>
233+
<dependency>
234+
<groupId>io.quarkus</groupId>
235+
<artifactId>quarkus-keycloak-authorization</artifactId>
236+
</dependency>
230237
----
231238

232-
* Add the following configuration to the `application.properties` file of the application, as shown below:
239+
* Add the following configuration to the application's `application.properties` file:
233240
234241
[.lines_space]
235242
[.console-input]
@@ -250,14 +257,14 @@ quarkus.oidc.webapp.roles.source=${quarkus.oidc.roles.source}
250257
quarkus.keycloak.policy-enforcer.enable=true
251258
----
252259

253-
* Redeploy and test the application accesses:
260+
* Redeploy and test the application access:
254261
** Open a new incognito browser session.
255-
** Browse to the context root of the Quarkus Petclinic application. The request will be redirected to the Red Hat Single Sign-On login page. Here, we checked that the anonymous access to the application is forbidden.
262+
** Browse to the context root of the Quarkus Petclinic application. The request should be redirected to the Red Hat Single Sign-On login page — confirming that anonymous access is blocked.
256263
** Log in as `elisabeth`. The request will be redirected to the application after a successful login.
257-
** Browse through the application, try to access the VETERINARIANS section. The access should be denied, as `elisabeth` has the `assistant` role and the access is restricted to the `vet` role. An error will be shown on the application page.
258-
** Close the browser and open a new one incognito session.
259-
** Visit the context root of the application again.
260-
** Login as `angel`.
261-
** Browse through the application, try to access the VETERINARIANS section. The access should be granted, as `angel` has the `vet` role.
264+
** Browse the application and try to access the *VETERINARIANS* section. Access should be denied since `elisabeth` has the `assistant` role and this resource is restricted to users with the `vet` role.
265+
** Close the browser and open a new incognito session.
266+
** Visit the context root again.
267+
** Log in as `angel`.
268+
** Browse the application and try to access the *VETERINARIANS* section. This time, access should be granted since `angel` has the `vet` role.
262269
263-
NOTE: A complete OIDC working Petclinic Quarkus application is available at `rhbk-oidc-22` branch.
270+
NOTE: A complete OIDC-enabled Quarkus Petclinic application is available in the `rhbk-oidc-22` branch.

0 commit comments

Comments
 (0)