Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move API OpenID-Connect support to Apache configuration #282

Merged
merged 4 commits into from
May 8, 2020
Merged

Move API OpenID-Connect support to Apache configuration #282

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6ee6386
Move API OpenID-Connect support to Apache configuration
jvlcek May 6, 2020
770cb2d
replace oidc_oauth_client_id/_secret oidc_client_id/_secret
jvlcek May 6, 2020
eaae0ff
Change oauth20 to oidc in name and use client_secret_basic
jvlcek May 8, 2020
b104ceb
Change oidc_oauth_introspection_endpoint oidc_introspection_endpoint
jvlcek May 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 27 additions & 6 deletions TEMPLATE/etc/httpd/conf.d/manageiq-external-auth-openidc.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,36 @@ LoadModule auth_openidc_module modules/mod_auth_openidc.so
ServerName https://<%= miq_appliance %>
LogLevel warn

OIDCProviderMetadataURL <%= oidc_provider_metadata_url %>
OIDCCLientID <%= oidc_client_id %>
OIDCClientSecret <%= oidc_client_secret %>
OIDCRedirectURI https://<%= miq_appliance %>/oidc_login/redirect_uri
OIDCCryptoPassphrase sp-cookie
OIDCOAuthRemoteUserClaim username
OIDCProviderMetadataURL <%= oidc_provider_metadata_url %>
OIDCCLientID <%= oidc_client_id %>
OIDCClientSecret <%= oidc_client_secret %>
OIDCRedirectURI https://<%= miq_appliance %>/oidc_login/redirect_uri
OIDCCryptoPassphrase sp-cookie
OIDCOAuthRemoteUserClaim username
OIDCOAuthClientID <%= oidc_client_id %>
OIDCOAuthClientSecret <%= oidc_client_secret %>
OIDCOAuthIntrospectionEndpoint <%= oidc_introspection_endpoint %>
OIDCOAuthIntrospectionEndpointAuth client_secret_basic
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice !! 👍 common denominator between Keycloak and IAM.


<Location /oidc_login>
AuthType openid-connect
Require valid-user
</Location>

<LocationMatch ^/api(?!\/(v[\d\.]+\/)?product_info$)>
SetEnvIf Authorization '^Basic +YWRtaW46' let_admin_in
SetEnvIf X-Auth-Token '^.+$' let_api_token_in
SetEnvIf X-MIQ-Token '^.+$' let_sys_token_in
SetEnvIf X-CSRF-Token '^.+$' let_csrf_token_in

AuthType oauth20
AuthName "External Authentication (oidc) for API"

Require valid-user
Order Allow,Deny
Allow from env=let_admin_in
Allow from env=let_api_token_in
Allow from env=let_sys_token_in
Allow from env=let_csrf_token_in
Satisfy Any
</LocationMatch>