Guideline for manual installation and configuration of keycloak as an identity provider for yuuvis® Momentum.

Table of Contents

Introduction

Identity providers such as Keycloak can be connected to yuuvis® API for authentication using Connect/OAuth2 via the authentication-service.

Keycloak is the recommended identity provider for yuuvis® Momentum and is consistently used for testing. In principle, any identity provider supporting OAuth2 can be used in the same way.

As standard, the installation is done by means of a Helm chart. Two demonstration tenants are created and configured automatically. Further tenants for productive use have to be added and configured manually.
>> Using Helm to Install the Microservice Infrastructure

The manual installation and configuration of Keycloak for yuuvis® Momentum API are broadly described here.

After installation, Keycloak provides two administrative services, one for system administrators and one for users.

Admin Console
In order to create and administrate realms and user accounts, Keycloak provides the Admin Console. Roles can be defined and assigned in the Admin Console as well. An administrator login is required.
>> https://www.keycloak.org/docs/latest/server_admin/#admin-console
User Account Service
Any user has access to the User Account Service provided by Keycloak. Users can change their credentials and other personal data.
>> https://www.keycloak.org/docs/latest/server_admin/#_account-service

Keycloak Installation

To install Keycloak manually, follow these steps:

Download version 11.0.2 at https://www.keycloak.org/archive/downloads-11.0.2.html and extract it to a local directory.
Modify the standalone.xml configuration file in the \standalone\configuration\ directory:
Add the following entry to the <interfaces> section:
- <interface name="any"> <any-address/> </interface>
- In the <socket-binding-group> section, for the <default-interface> attribute, enter the following value: any
- If port 8080 is not available, change the port via the following line in the <socket-binding-group> section:
  <socket-binding name="http" port="${jboss.http.port:8080}"/>
Start Keycloak via the \keycloak\bin\standalone.bat file.
Note: The file must be run as an administrator.
Call the Keycloak Admin Console: http://localhost:8080/
Start by creating an administrator account.

Note: For productive use, it is recommended to connect Keycloak to a different relational database management system (RDBMS) instead of the embedded standard H2. Suggestions for compatible RDBMS are provided by Keycloak: https://www.keycloak.org/docs/latest/server_installation/index.html#database.

Keycloak: Tenant and User

You require a tenant and a user.

Note: Users in Keycloak must also be entered in the yuuvis® user administration.

To create tenants and users, follow these steps:

Call the Keycloak Admin Console: http://localhost:8080/auth/admin
Create a new tenant in the navigation area via Master > Add realm.
Create and save a user for the tenant via Users > Add user.
Enter a password in the Credentials tab on the user page, set the Temporary option to Off, and save with Set Password.

Keycloak: Connecting to yuuvis® API

To establish a connection, create a client following these steps:

Call the Keycloak Admin Console: http://localhost:8080/auth/admin
Select the tenant and create the new client via Clients > Create.
Enter a name in the Client ID field, and enter and save the yuuvis® authentication-service URL in the Root URL field.
Configure the following in the Settings tab of the client page:
- Access Type > confidential
- Authorization Enabled > ON
- Valid Redirect URIs > Schema: http://<authentication-service>/*All yuuvis® API hosts must be specified according to this schema.
Save the configuration by clicking Save.
Set the required user roles for the yuuvis® API components as simple strings via Roles > Add Roles.
Afterwards, the roles can be activated for the users via Role Mappings > Assigned Roles.

In case of a yuuvis® Momentum system with multiple tenants, the authentication-service has to be registered as a Keycloak client in each corresponding realm.

Connecting yuuvis® authentication-service to SSL-secured Keycloak

Export certificate with Firefox:
- Call the encrypted welcome page of Keycloak in Firefox: https://localhost:8443/auth/
- Open the Protection Settings via the shield icon to the left of the address bar.
- Display the certificate via Security > View Certificates.
- Export the certificate as localhost.pem via the tab Authorities in the certificate manager.
Alternatively, export certificate with Chrome:
- Call the encrypted welcome page of Keycloak in Chrome: https://localhost:8443/auth/
- Open the Settings via the three dots icon to the right of the address bar.
- Display the certificate via Privacy and security > Security > Manage certificates.
- Export the certificate in Base-64 format as localhost.pem.

Import the certificate in the Java Trust Store with the following batch call:

...\service-manager\jdk\bin\keytool ^
    -import ^
    -trustcacerts ^
    -keystore ...\service-manager\jdk\jre\lib\security\cacerts ^
    -storepass changeit ^
    -noprompt ^
    -alias localhost ^
    -file ...\path\to\localhost.pem

Restart the yuuvis® authentication-service.

Embedding the Login Page into an iframe

The Keycloak login page can be embedded as an iframe into a second web page if this web page is published on the same host as Keycloak. If the secondary web page is published on a different host, it has to be legitimized in every Keycloak tenant that will use this web page for the login process:

Call the Keycloak Admin Console: http://localhost:8080/auth/admin/
Select the tenant and and add the host name of the web page via Realm Settings > Security Defenses > Content-Security-Policy > frame-ancestors.
Multiple host names are seperated by blank spaces.

Summary

This article explained how to install and configure Keycloak as an identity provider and access management system for yuuvis® Momentum in a manual procedure.

Read on

Login to the Core API

This tutorial will give you a brief overview of the most important login procedures for the yuuvis® API system and how to use them in a Java Client application Keep reading

Authentication against the Core API

This article details the authentication methods compatible with the yuuvis® Core API and how to choose the correct one for your use case. Keep reading

Access Authorization and Permissions

A yuuvis® Momentum user has to be authorized to the functionality of the system by assigning roles. For the individual roles, permissions can be set to allow actions on objects restricted by defined conditions where appropriate and the usage of specific endpoints can be controlled. Keep reading

Browser not supported