Bug 1784145
| Summary: | Need the ability to configure the appliance for OpenID-Connect using the appliance console CLI | ||
|---|---|---|---|
| Product: | Red Hat CloudForms Management Engine | Reporter: | Satoe Imaishi <simaishi> |
| Component: | Appliance | Assignee: | abellott |
| Status: | CLOSED ERRATA | QA Contact: | John Dupuy <jdupuy> |
| Severity: | high | Docs Contact: | Red Hat CloudForms Documentation <cloudforms-docs> |
| Priority: | high | ||
| Version: | unspecified | CC: | abellott, dmetzger, mshriver, obarenbo |
| Target Milestone: | GA | Keywords: | ZStream |
| Target Release: | 5.11.2 | Flags: | pm-rhel:
cfme-5.11.z+
simaishi: mirror+ |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 5.11.2.0 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1783385 | Environment: | |
| Last Closed: | 2020-02-12 05:02:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | CFME Core | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1783385 | ||
| Bug Blocks: | |||
|
Comment 2
CFME Bot
2019-12-16 20:34:34 UTC
New commit detected on ManageIQ/manageiq-appliance/ivanchuk: https://github.com/ManageIQ/manageiq-appliance/commit/e430272cac7fd707d1590121a4a8f94b8a228984 commit e430272cac7fd707d1590121a4a8f94b8a228984 Author: Jason Frey <jfrey> AuthorDate: Fri Dec 6 10:34:06 2019 -0500 Commit: Jason Frey <jfrey> CommitDate: Fri Dec 6 10:34:06 2019 -0500 Merge pull request #265 from abellotti/support_oidc_config Support OIDC Authentication configuration from CLI (cherry picked from commit b1cbc6debebd6f8950295fcd74a684674d80e5a7) Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1784145 TEMPLATE/etc/httpd/conf.d/manageiq-external-auth-openidc.conf | 16 - TEMPLATE/etc/httpd/conf.d/manageiq-external-auth-openidc.conf.erb | 16 + manageiq-appliance-dependencies.rb | 2 +- 3 files changed, 17 insertions(+), 17 deletions(-) Verified in CFME 5.11.2.0 with a keycloak/rhsso server. Steps of verification: 1) Created the client for the appliance in a keycloak server - I followed the docs here https://github.com/ManageIQ/manageiq_docs/blob/master/auth/openid_connect.adoc - NOTE: the "Client ID" cannot have "https://" in the string - Note: I set the root URL to be the "https://<FQDN of the appliance>", with the base URL as "/" - make note of the client secret in the "Credentials" tab of the client's details 2) Created the mappers for the client, "Client Host", "Client ID", "Client IP Address", "groups" 3) Created an open ID test user and assign a MIQGroup to them (e.g. "EvmGroup-super_administrator") 4) SSH'ed into the appliance and ran """ appliance_console_cli --oidc-config --oidc-url=<keycloak-server>:8080/auth/realms/CFME-OpenID/.well-known/openid-configuration --oidc-client-id <appliance-fqdn> --oidc-client-secret <client-secret> """ 5) After waiting for that to finish, I pointed my browser to the appliance, hit "Log In to Corporate System", verified that I was redirected to a sign-in page for the keycloak server and signed in with the user created in (3) 6) Verified that the appliance UI loaded properly. Thanks for the help @Alberto! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0452 |