Introduction

Identity providers such as Keycloak can be connected to yuuvis® API for authentication using Connect/OAuth2 via the authentication-service.

Keycloak is the recommended identity provider for yuuvis® Momentum and is consistently used for testing. In principle, any identity provider supporting OAuth2 can be used in the same way.

As standard, the installation is done by means of a Helm chart. Two demonstration tenants are created and configured automatically. Further tenants for productive use have to be added and configured manually.
>> /wiki/spaces/YMY/pages/320049969

The manual installation and configuration of Keycloak for yuuvis® Momentum API are broadly described here.

After installation, Keycloak provides two administrative services, one for system administrators and one for users.

• Admin Console
  In order to create and administrate realms and user accounts, Keycloak provides the Admin Console. Roles can be defined and assigned in the Admin Console as well. An administrator login is required.
  >> https://www.keycloak.org/docs/latest/server_admin/#admin-console
• User Account Service
  Any user has access to the User Account Service provided by Keycloak. Users can change their credentials and other personal data.
  >> https://www.keycloak.org/docs/latest/server_admin/#_account-service

Keycloak Installation

To install Keycloak manually, follow these steps:

• Download version 11.0.2 at https://www.keycloak.org/archive/downloads-11.0.2.html and extract it to a local directory.
• Modify the standalone.xml configuration file in the \standalone\configuration\ directory:
  Add the following entry to the <interfaces> section:
  • <interface name="any">
  <any-address/>
</interface>
  • In the <socket-binding-group> section, for the <default-interface> attribute, enter the following value: any
  • If port 8080 is not available, change the port via the following line in the <socket-binding-group> section:
    <socket-binding name="http" port="${jboss.http.port:8080}"/>
• Start Keycloak via the \keycloak\bin\standalone.bat file.
  Note: The file must be run as an administrator.
• Call the Keycloak Admin Console: http://localhost:8080/
• Start by creating an administrator account.

Note: For productive use, it is recommended to connect Keycloak to a different relational database management system (RDBMS) instead of the embedded standard H2. Suggestions for compatible RDBMS are provided by Keycloak: https://www.keycloak.org/docs/latest/server_installation/index.html#database

Keycloak: Tenant and User

You require a tenant and a user.

Note: Users in Keycloak must also be entered in the yuuvis® user administration.

To create tenants and users, follow these steps:

• Call the Keycloak Admin Console: http://localhost:8080/auth/admin

• Create a new tenant in the navigation area via Master > Add realm.

• Create and save a user for the tenant via Users > Add user.

• Enter a password in the Credentials tab on the user page, set the Temporary option to Off, and save with Set Password.

Keycloak: Connecting to yuuvis® API

To establish a connection, create a client following these steps:

• Call the Keycloak Admin Console: http://localhost:8080/auth/admin

• Select the tenant and create the new client via Clients > Create.

• Enter a name in the Client ID field, and enter and save the yuuvis® authentication-service URL in the Root URL field.

• Configure the following in the Settings tab of the client page:

  • Access Type > confidential

  • Authorization Enabled > ON

  • Valid Redirect URIs > Schema: http://<authentication-service>/*
All yuuvis® API hosts must be specified according to this schema.

• Save the configuration by clicking Save.

• Set the required user roles for the yuuvis® API components as simple strings via Roles > Add Roles.
  Afterwards, the roles can be activated for the users via Role Mappings > Assigned Roles.

In case of a yuuvis® Momentum system with multiple tenants, the authentication-service has to be registered as a Keycloak client in each corresponding realm.

Connecting yuuvis® authentication-service to SSL-secured Keycloak

• Export certificate with Firefox:
  
  • Call the encrypted welcome page of Keycloak in Firefox: https://localhost:8443/auth/
  • Open the Protection Settings via the shield icon to the left of the address bar.
  • Display the certificate via Security > View Certificates.
  • Export the certificate as localhost.pem via the tab Authorities in the certificate manager.
• Alternatively, export certificate with Chrome:
  
  • Call the encrypted welcome page of Keycloak in Chrome: https://localhost:8443/auth/
  • Open the Settings via the three dots icon to the right of the address bar.
  • Display the certificate via Privacy and security > Security > Manage certificates.
  • Export the certificate in Base-64 format as localhost.pem.

• Import the certificate in the Java Trust Store with the following batch call:

  ...\service-manager\jdk\bin\keytool ^     -import ^     -trustcacerts ^     -keystore ...\service-manager\jdk\jre\lib\security\cacerts ^     -storepass changeit ^     -noprompt ^     -alias localhost ^     -file ...\path\to\localhost.pem

  
  

• Restart the yuuvis® authentication-service.

Embedding the Login Page into an iframe

The Keycloak login page can be embedded as an iframe into a second web page if this web page is published on the same host as Keycloak. If the secondary web page is published on a different host, it has to be legitimized in every Keycloak tenant that will use this web page for the login process:

• Call the Keycloak Admin Console: http://localhost:8080/auth/admin/
• Select the tenant and and add the host name of the web page via Realm Settings > Security Defenses > Content-Security-Policy > frame-ancestors.
  Multiple host names are seperated by blank spaces.

Summary

This article explained how to install and configure Keycloak as an identity provider and access management system for yuuvis® Momentum in a manual procedure.