alexandredevely
commented
9 months ago Hello Chintu,
abcdesktop auth works fine with the famous keycloak service. Rules are only supported by Ldap service, in this current release. You ask for a new feature, Add keycloak tag, and match the auth tag to rule. This is a relay good feature, and I like your great idea. I have to check how keycloack tag can be read from the auth provider classes.
Good point, thank you for your comment I add your request as 'New feature or Request'
Alexandre
chintus777
Hello Alexandre,
I was trying to implement external Auth method using keycloak . Keycloak has various benefits over Openldap as it provides support for MFA and has an interactive UI . I have deployed keycloak and integrated it with abcdesktop. Following are the keycloak yamls -
apiVersion: apps/v1 kind: Deployment metadata: name: keycloak namespace: vdi spec: replicas: 1 selector: matchLabels: app: keycloak template: metadata: labels: app: keycloak spec: containers:
apiVersion: v1 kind: Service metadata: name: keycloak namespace: vdi spec: selector: app: keycloak ports:
protocol: TCP port: 80 targetPort: 8080
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: keycloak-ingress namespace: vdi annotations: cert-manager.io/cluster-issuer: letsencrypt-prod kubernetes.io/ingress.class: "nginx" spec: tls:
Following is the addition in od.config-
authmanagers: { 'external': { 'providers': { 'keycloak': { 'displayname': 'Keycloak', 'enabled': True, 'basic_auth': True, 'userinfo_auth': True, 'scope' : [ 'openid','email','profile' ], 'client_id': 'demo', 'client_secret': 'W', 'redirect_uri_prefix' : 'https://loginvdi.co/API/auth/oauth', 'redirect_uri_querystring': 'manager=external&provider=keycloak', 'authorization_base_url': 'https://keycloak2.co/auth/realms/test/protocol/openid-connect/auth', 'token_url': 'https://keycloak2.co/auth/realms/test/protocol/openid-connect/token', 'userinfo_url': 'https://keycloak2.co/auth/realms/test/protocol/openid-connect/userinfo', 'policies': { 'acl' : { 'permit': [ 'all' ] }, }
This is the page which appears after clicking "connect with keycloak" on login page -
After this it asks for OTP-
The login is successful and apps are visible as well
Authentication is working fine with 2FA as well , Apps are also visible inside abcdesktop. The main issue which I am facing is on defining rules for getting labels which I can apply for app restrcition to users . Like in openldap- we define rule such as -
'rule-sample': { 'conditions': [ { 'memberOf': 'cn=ship_crew,ou=people,dc=planetexpress,dc=com', 'expected' : True } ], 'expected' : True, 'label': 'shipcrewgrp' }
How should I define rule for keycloak , Like LDAP we can create groups in keyclaok as well. I think implementation for 2FA is really crucial for this project as it enhances the security. Please tell me how should I proceed . Waiting eagerly for your reply.
Thanks and Regards Chintu