Skip to content

Commit

Permalink
ENDOC-819 link fixes & misc
Browse files Browse the repository at this point in the history
  • Loading branch information
jyunmitch committed Dec 6, 2024
1 parent c585c94 commit 4222c30
Show file tree
Hide file tree
Showing 6 changed files with 54 additions and 56 deletions.
8 changes: 4 additions & 4 deletions vuepress/docs/next/docs/consume/identity-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Keycloak authorizes microservices using clients and roles. Authorizations are st

Below are the steps to grant a user one or more roles for a specific client. This controls permissions when configuring the microservice. Note, when a microservice is installed in Entando, a corresponding client (and set of roles) is created within its plugin definition.

1. [Login to Keycloak](#logging-into-your-keycloak-instance)
1. [Log in to Keycloak](#logging-into-your-keycloak-instance)
>For non-external Keycloak instances, it is [the base URL of your running Entando application](../getting-started/README.md#configure-access-to-your-cluster) followed by `/auth/`, e.g. http://YOUR-HOST-NAME/auth. In a standard Entando installation, the base URL can be verified with `kubectl get ingress/default-sso-in-namespace-ingress`.
2. Select `Users` from the left menu
3. Use the search box to find the appropriate user, e.g. "admin"
Expand All @@ -60,12 +60,12 @@ See [KeycloakAuthorizationManager.java](https://github.com/entando/entando-keycl

## Social Login

Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/18.0/server_admin/index.html#social-identity-providers) documents how to enable and configure social logins in your Entando Applications.
Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#_identity_broker) documents how to enable and configure social logins in your Entando Applications.

## One Time Passwords

Keycloak enables One Time Password (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/18.0/server_admin/index.html#one-time-password-otp-policies) to configure and enable it.
Keycloak enables One Time Password (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#one-time-password-otp-policies) to configure and enable it.

## Themes, Look and Feel

Developers can customize the look and feel of the login page, as well as the identity management system that comes with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/18.0/server_development/#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
Developers can customize the look and feel of the login page, as well as the identity management system that comes with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/21.0.2/server_development/index.html#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
43 changes: 21 additions & 22 deletions vuepress/docs/next/tutorials/curate/private-git-repo.md
Original file line number Diff line number Diff line change
@@ -1,42 +1,46 @@
---
sidebarDebth: 2
---


# Install Bundles from a Private Git Repository

## Overview
The standard deployment of Entando assumes that bundles are checked out from public Git or Docker repositories. Public repositories do not require user authentication, but a private key is required if a customer chooses to limit repository access to specific Git or Docker accounts. This tutorial describes how to allow Entando to access a private Git repository.
The standard deployment of Entando assumes that bundles are checked out from a public Git or Docker repository. Public repositories do not require user authentication, but a private key is required if repository access is limited to specific user accounts. This tutorial describes how to grant access to a private Git repository from Entando.

For more background information please consult
For more background information please consult:
1. [Entando custom resource reference](../../docs/reference/custom-resources.md)
2. [Local Hub overview](../../docs/compose/local-hub-overview.md)

## Using SSH keys with Git
Entando supports connecting to Git repositories with SSH keys. While SSH Git URLs are accepted, HTTPS git URLs are not. For the private key to work correctly, the SSH syntax of `[email protected]:THE-REPO-OWNER-NAME/THE-REPO-NAME.git` must be used (the HTTPS syntax of `https://github.com/THE-REPO-OWNER-NAME/THE-REPO-NAME.git` is not permitted).
Entando supports connecting to Git repositories with SSH keys. While SSH Git URLs are accepted, HTTPS Git URLs are not. For the private key to work correctly, the SSH syntax of `[email protected]:THE-REPO-OWNER-NAME/THE-REPO-NAME.git` must be used (the HTTPS syntax of `https://github.com/THE-REPO-OWNER-NAME/THE-REPO-NAME.git` is not permitted).

Using the SSH method a developer can generate a public/private keypair, then register the public key with the Git server while securely storing the private key locally. An operation requiring authentication will trigger the Git command line utility to perform a search and compare between the local private key and the public key provided by the server. If the two keys are identical, the operation is allowed to complete.
Using the SSH method, a developer can generate a public/private key pair, then register the public key with the Git server while securely storing the private key locally. An operation requiring authentication will trigger the Git command line utility to perform a search and compare between the private and public keys. If the two keys match, the operation is allowed to complete.

Entando allows a Kubernetes Secret containing a Git SSH private key to be mounted in the container hosting the Entando Component Manager service. This container is deployed with the EntandoApp and can be configured from the EntandoApp Custom Resource. To prepare a Secret, first generate the keypair locally using a Docker image, then create the Secret from the directory where the keypair was generated.
Entando allows a Kubernetes Secret containing a Git SSH private key to be mounted in the container hosting the Entando Component Manager service. This container is deployed with the EntandoApp and can be configured from the EntandoApp Custom Resource. To prepare a Secret, first generate the key pair locally using a Docker image, then create the Secret from the directory where the key pair was generated.

## Tutorial
Below is the recommended flow on Linux.

1. Navigate to a local folder where you intend to create the Secret
1. Navigate to a local folder where you intend to create the Secret.

2. Generate the SSH keypair from the known SSH client Docker image
2. Generate the SSH key pair from the known SSH client Docker image.

1. Run the Docker container in interactive mode and mount the default user SSH directory to a local directory
1. Run the Docker container in interactive mode and mount the default user SSH directory to a local directory:

```
docker run -it -v $PWD/entando_ssh:/root/.ssh kroniak/ssh-client /bin/bash
```
2. Generate the keypair from the shell of the resulting container
2. Generate the key pair from the shell of the resulting container:
```
ssh-keygen
```
Select all of the default options, e.g. no passphrase, etc.
3. Attempt to add the fingerprint to the known_hosts file by connecting to your Git server and responding "yes" to the prompt
3. Attempt to add the fingerprint to the known_hosts file by connecting to your Git server and responding "yes" to the prompt:
```
ssh [email protected]
Expand All @@ -46,35 +50,30 @@ Below is the recommended flow on Linux.
4. Run `exit`
3. Create the Secret.
You are now back in the local operating system's shell and can navigate to the directory that was mounted using Docker.
To give yourself access to this folder and create a Secret with the content
3. Create the Secret. Back in the local operating system's shell, navigate to the directory that was mounted using Docker. Then give yourself access to this folder and create the Secret:
1. Change the folder permissions
1. Change the folder permissions:
```
sudo chmod ag+r entando_ssh -R
```
2. Create a Secret from the directory
2. Create a Secret from the directory:
```
kubectl create secret generic my-git-secret --from-file=entando_ssh -n <<your-namespace>>
```
3. Confirm that the Secret exists and has at least two keys: known_hosts, and id_rsa. Without these two keys Entando cannot log into Git.
3. Confirm that the Secret exists and has at least two keys: `known_hosts` and `id_rsa`. Without these two keys, Entando cannot log into Git.
```
kubectl get secret my-git-secret -n <<your-namespace>> -o yaml
```
4. Link the resulting private key to the account of a user who has access to the applicable Git repositories. Ideally
this should be a dedicated service account user with restricted read only access. For GitHub
4. Link the resulting private key to the account of a user who has access to the applicable Git repositories. Ideally,
this should be a dedicated service account with restricted read only access. For GitHub
accounts, you can follow the [official GitHub instructions.](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/adding-a-new-ssh-key-to-your-github-account)
When prompted, provide the public key that was generated in the entando_ssh directory
```entando_ssh/id_rsa.pub```
When prompted, provide the public key that was generated in the `entando_ssh/id_rsa.pub` directory.
5. Modify the EntandoApp resource you are deploying to configure the Secret using the `spec.ecrGitSshSecretName` property.
```
Expand Down
2 changes: 1 addition & 1 deletion vuepress/docs/v7.0/tutorials/curate/ecr-private-images.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ The first step demonstrates how to create a Secret for Docker Hub but please see
**1. Create the secret**
Supply the following parameters:
* the name of the new Secret, e.g. `my-docker-secret`.
* the URL to your registry server. For Docker Hub this is currently <https://index.docker.io/v1/>
* the URL to your registry server. For Docker Hub this is currently `https://index.docker.io/v1/`
* your Docker Hub username, password, and email.
* the Entando namespace, e.g. `entando` for a quickstart environment.

Expand Down
6 changes: 3 additions & 3 deletions vuepress/docs/v7.2/docs/consume/identity-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,12 +56,12 @@ See [KeycloakAuthorizationManager.java](https://github.com/entando/entando-keycl

## Social Login

Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/18.0/server_admin/index.html#social-identity-providers) documents how to enable and configure social logins in your Entando Applications.
Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#_identity_broker) documents how to enable and configure social logins in your Entando Applications.

## One Time Passwords

Keycloak enables One Time Passwords (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/18.0/server_admin/index.html#one-time-password-otp-policies) to configure and enable OTP in your application.
Keycloak enables One Time Passwords (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#one-time-password-otp-policies) to configure and enable OTP in your application.

## Themes, Look and Feel

Developers can customize the look and feel of the login page, as well as the identity management system that ships with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/18.0/server_development/#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
Developers can customize the look and feel of the login page, as well as the identity management system that ships with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/21.0.2/server_development/index.html#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
8 changes: 4 additions & 4 deletions vuepress/docs/v7.3/docs/consume/identity-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Keycloak authorizes microservices using clients and roles. Authorizations are st

Below are the steps to grant a user one or more roles for a specific client. This controls permissions when configuring the microservice. Note, when a microservice is installed in Entando, a corresponding client (and set of roles) is created within its plugin definition.

1. [Login to Keycloak](#logging-into-your-keycloak-instance)
1. [Log in to Keycloak](#logging-into-your-keycloak-instance)
>For non-external Keycloak instances, it is [the base URL of your running Entando application](../getting-started/README.md#configure-access-to-your-cluster) followed by `/auth/`, e.g. http://YOUR-HOST-NAME/auth. In a standard Entando installation, the base URL can be verified with `kubectl get ingress/default-sso-in-namespace-ingress`.
2. Select `Users` from the left menu
3. Use the search box to find the appropriate user, e.g. "admin"
Expand All @@ -60,12 +60,12 @@ See [KeycloakAuthorizationManager.java](https://github.com/entando/entando-keycl

## Social Login

Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/18.0/server_admin/index.html#social-identity-providers) documents how to enable and configure social logins in your Entando Applications.
Keycloak allows Entando to provide social login as an out-of-the-box capability. [Keycloak Social Identity Providers](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#_identity_broker) documents how to enable and configure social logins in your Entando Applications.

## One Time Passwords

Keycloak enables One Time Password (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/18.0/server_admin/index.html#one-time-password-otp-policies) to configure and enable it.
Keycloak enables One Time Password (OTP) login to Entando Applications. See [Keycloak OTP Policies](https://www.keycloak.org/docs/21.0.2/server_admin/index.html#one-time-password-otp-policies) to configure and enable it.

## Themes, Look and Feel

Developers can customize the look and feel of the login page, as well as the identity management system that comes with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/18.0/server_development/#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
Developers can customize the look and feel of the login page, as well as the identity management system that comes with Entando. The [Keycloak Theme Documentation](https://www.keycloak.org/docs/21.0.2/server_development/index.html#_themes) provides instructions for creating your own theme. Alternatively, you can modify the [Entando Theme](https://github.com/entando/entando-keycloak/tree/master/themes/entando).
Loading

0 comments on commit 4222c30

Please sign in to comment.