...

• Call the Keycloak Admin Console: http://localhost:8080/auth/admin/
• Select the tenant and and add the host name of the web page via Realm Settings > Security Defenses > Content-Security-Policy > frame-ancestors.
  Multiple host names are seperated by blank spaces.

...

Impersonation

In order to allow users with a specific role to log in as any other user, impersonation can be activated in Keycloak. Thus, users with this specific role can use their own password to log in to the account of any other user within their tenant. In Keycloak, the feature is realized via impersonation by means of token exchange.

Activating Token Exchange

Open the StatefulSet of Keycloak in your Kubernetes cluster for editing by running the command:

kubectl -n infrastructure edit statefulset keycloak

Extend the containers section as follows:

containers:
  - args:
    - -Dkeycloak.profile.feature.token_exchange=enabled
    - -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled

...

Configuring the User Account and Keycloak Clients

• Call the Keycloak Admin Console: http://localhost:8080/auth/admin
• Select the user you want to grant access to other user accounts and switch to the Role Mappings tab.
• Display the Client Roles for the realm-management client and assign its impersonation role to the user.
• In the same realm, select the client admin-cli and switch to the Permissions tab.
• Flip the Permissions Enabled switch to ON.
• In the appearing table, click token-exchange in the scope-name column.
• From the Create Policy selection list in the Apply Policy section, select Role.
• Name it impersonation-policy.
• From the Realm Roles selection list, select the administrative role that will enable users to impersonate other users within their tenant. Tick the Required checkbox.
• From the Clients selection list, select realm-management.
• From the Client Roles selection list, select impersonation. Tick the Required checkbox.
• Save the configuration for the policy.
• Save the configuration for the permission settings.

Testing Impersonation with cURL

The following commands use an administrative user root with the password changeme belonging to the tenant tenant1 with the impersonation authorization as configured before. This user requests access to the account of the user specified by the ID cc14e5d4-e8da-4108-92ad-c87066aed4c3.

Request a token for the administrative user with the impersonation authorization:

curl -k ^
  -d "client_id=admin-cli" ^
  -d "username=root" ^
  -d "password=changeme" ^
  -d "grant_type=password" ^
  "http://localhost:8080/auth/realms/tenant1/protocol/openid-connect/token"

...

Request a token for the account of the target user where the login is needed. The previously retrieved token of the administrative user is referenced as subject_token whereas the ID of the target user is specified as requested_subject.

curl -k ^
  -H "Content-Type: application/x-www-form-urlencoded" ^
  -d "client_id=admin-cli" ^
  -d "requested_subject=cc14e5d4-e8da-4108-92ad-c87066aed4c3" ^
  -d "subject_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJueEZ..." ^
  --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" ^
  "http://localhost:8080/auth/realms/tenant1/protocol/openid-connect/token"

The retrieved token can be used by the administrative user root for authentication in yuuvis® Momentum with the account of the target user.

The following command retrieves user-specific information on the user who will be logged in with the token specified in the authorization header. Check whether the token retrieved before identifies the desired target user. Thus, in this example, the command should retrieve a data set for the user with ID cc14e5d4-e8da-4108-92ad-c87066aed4c3.

curl -k ^
  --request GET ^
  --url "http://localhost:8080/auth/realms/tenant1/protocol/openid-connect/userinfo" ^
  --header "accept: application/json" ^
  --header "authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAi1dXVSZ3daQldhTTJZaXNlZElFXzg..."

Summary

This article explained how to install and configure Keycloak as an identity provider and access management system for yuuvis® Momentum in a manual procedure.

...