Keycloak integration

Juraci Paixão Kröhling jpkroehling at redhat.com
Tue Dec 23 11:51:27 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

There was a discussion on IRC today about the multi tenancy for
rhq-metrics. Some thoughts were collected, some questions asked and I
got some answers, but it would be interesting to review those :)

Keycloak can take care of the authentication and authorization parts
of a request when used together with JAAS. Note that, in Keycloak
terms, a tenant is a realm. A realm contains roles (like
"metrics-rw"), users (like "jdoe") and applications (like "agent").
Realms are created based on a template, upon user registration. Right
now, each user is a realm, but Keycloak is ready to support multiple
users per realm.

The flow of a request is something like this:

- - Request comes in
- - Keycloak intercepts it and tries to determine to which tenant the
request belongs to
- - Keycloak then authenticates the user against the realm (ie: user
jdoe at "acme" realm).
- - If the authentication is successful, it creates a Subject identity
(JAAS)
- - JAAS then determines if the user is in a role that allow access to a
resource/method. So, a class/method can be annotated with
@RolesAllowed("metrics-rw") and JAAS will make sure that the user has
this role before the method is executed
- - At this point, the application method is executed, and a JAAS
Subject identity is available. It's the application's responsibility
to use the subject's information (including the realm/tenant name)
when dealing with data (ie: returning only data from "acme" to users
belonging to "acme").

Questions has been raised regarding the step where Keycloak resolves
the tenant for the request: this part is delegated to the application
(rhq-metrics), so, it can be anything that makes sense for the
project. Right now, the PR checks a specific HTTP header, but it can
be changed to match part of the URL (/tenants/{tenant}/metrics/data).
The idea is that when the request reaches the business code, Keycloak
has already authenticated the request (ie: this user exists, has
provided valid credentials and belongs to the tenant that it claims to
belong to) and the contained has authorized the access (ie: the user
has a role that allows this method to be executed).

There are also URLs that won't contain tenant information: those would
then fall back to a "super-realm", meant to be used only by the super
admins (ie: those who can manage the tenants).

If the assumptions above are correct, I'll then proceed with changing
the "resolved" to get the realm from the URL.

- - Juca.


On 12/22/2014 11:09 AM, Juraci Paixão Kröhling wrote:
> All,
> 
> Any feedback on this PR? Is there a plan on if/when it would be
> merged?
> 
> - Juca.
> 
> On 12/18/2014 04:25 PM, Juraci Paixão Kröhling wrote:
>> All,
> 
>> The JavaScript is now converted to TypeScript and an additional 
>> readme file was added, with details about the Keycloak setup.
> 
>> This means that this PR is now ready to be merged, once it
>> passes the reviews. I'd appreciate any comments you might have,
>> specially on the TypeScript code (as those are my very first on
>> this language).
> 
>> - Juca.
> 
>> On 12/17/2014 12:06 PM, Juraci Paixão Kröhling wrote:
>>> All,
> 
>>> So, I sent a PR with the proposed changes:
> 
>>> https://github.com/rhq-project/rhq-metrics/pull/92
> 
>>> I believe it's stable and good enough to start a review.
> 
>>> Missing things:
> 
>>> - Convert JavaScript to TypeScript (I'm having some troubles 
>>> with one of them) - Change the readme and/or add a new file
>>> with instructions regarding Keycloak.
> 
>>> - Juca. _______________________________________________ 
>>> rhq-devel mailing list rhq-devel at lists.fedorahosted.org 
>>> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 
>> _______________________________________________ rhq-devel
>> mailing list rhq-devel at lists.fedorahosted.org 
>> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 
> _______________________________________________ rhq-devel mailing
> list rhq-devel at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJUmVc/AAoJECKM1e+fkPrXbfQH+gOXPqTztIxx64LGVJ2jDc8C
NIjbbiv2d9TLoGYRirfTfS7plVqEqTFcU70WocFc/c29E5yKSu21oH4uAlw6Z6U0
zDLnhPyDkWjncoaFoZRF9p7RqzdnxuXNuLMyUkP3NAqv9ZnreATDsgggNH0zjSNN
BWkVBdyrCn8dBl+D+ncbY3h/1sMvsdy6mU8nadMr45rEaesV4N2SVDpDmhL9gCaI
juZUbZCwQOtEo1Na7JccHBdyhx+ltVPpy2gksD6YbCF0efl9S+C0cNTGr3xPZ5f6
XrXNgEkm7PADvDQ8l+K8v+tmNwg4CmB5Dkafa2d+AF3r1aN6SF8p0uCBnqNgNDI=
=ojQM
-----END PGP SIGNATURE-----


More information about the rhq-devel mailing list