|
| 1 | +# OIDC Proxy sample |
| 2 | + |
| 3 | +This sample demonstrates how to configure an authentication/authorization layer that fronts any arbitrary Code Engine application. In principal, this pattern is pretty generic. To demonstrate it, we chose to implement it with OIDC, an authentication framework that is built on top of the OAuth 2.0 protocol. |
| 4 | + |
| 5 | +The following diagram depicts the components that are involved: |
| 6 | + |
| 7 | + |
| 8 | +**Note:** The origin app is not exposed to the public or private network and can only be accessed through the authentication proxy that does an auth check towards an oidc app that got installed into the same project. |
| 9 | + |
| 10 | + |
| 11 | +## Setting up an OIDC SSO configuration |
| 12 | + |
| 13 | +### Github.com OIDC SSO |
| 14 | + |
| 15 | +* Create Github OIDC app through https://github.com/settings/developers |
| 16 | + ``` |
| 17 | + name: jupyter |
| 18 | + homepage: https://jupyter-auth.<CE_SUBDOMAIN>.<REGION>.codeengine.appdomain.cloud |
| 19 | + callback URL: https://jupyter-auth.<CE_SUBDOMAIN>.<REGION>.codeengine.appdomain.cloud/auth/callback |
| 20 | + ``` |
| 21 | +* Store the client id and the secret in local file called `oidc.properties` |
| 22 | + ``` |
| 23 | + OIDC_CLIENT_ID=<CLIENT_ID> |
| 24 | + OIDC_CLIENT_SECRET=<CLIENT_SECRET> |
| 25 | + ``` |
| 26 | +* Generate a random cookie secret that is used to encrypt the auth cookie value and add it to the `oidc.properties` file |
| 27 | + ``` |
| 28 | + COOKIE_SIGNING_ENCRYPTION_KEY=$(openssl rand -base64 32) |
| 29 | + ``` |
| 30 | +* From your OIDC provider obtain the following values and add ithem to the `oidc.properties` file |
| 31 | + ``` |
| 32 | + OIDC_PROVIDER_AUTHORIZATION_ENDPOINT=https://github.com/login/oauth/authorize |
| 33 | + OIDC_PROVIDER_TOKEN_ENDPOINT=https://github.com/login/oauth/access_token |
| 34 | + OIDC_PROVIDER_USERINFO_ENDPOINT=https://api.github.com/user |
| 35 | + ``` |
| 36 | +* To add authorization checks one can either check for a specific user property |
| 37 | + ``` |
| 38 | + AUTHZ_USER_PROPERTY=login |
| 39 | + AUTHZ_ALLOWED_USERS=<<comma-separated-list-of-github-users> |
| 40 | + ``` |
| 41 | +
|
| 42 | +### IBMers-only: w3Id OIDC SSO |
| 43 | +
|
| 44 | +* Create w3Id OIDC configuration through https://ies-provisioner.prod.identity-services.intranet.ibm.com/tools/sso/home |
| 45 | + ``` |
| 46 | + name: jupyter |
| 47 | + homepage: https://jupyter-auth.<CE_SUBDOMAIN>.<REGION>.codeengine.appdomain.cloud |
| 48 | + callback URL: https://jupyter-auth.<CE_SUBDOMAIN>.<REGION>.codeengine.appdomain.cloud/auth/callback |
| 49 | + ``` |
| 50 | +* Store the client id and the secret in local file called `oidc.properties` |
| 51 | + ``` |
| 52 | + OIDC_CLIENT_ID=<CLIENT_ID> |
| 53 | + OIDC_CLIENT_SECRET=<CLIENT_SECRET> |
| 54 | + ``` |
| 55 | +* Generate a random cookie secret that is used to encrypt the auth cookie value and add it to the `oidc.properties` file |
| 56 | + ``` |
| 57 | + COOKIE_SIGNING_ENCRYPTION_KEY=$(openssl rand -base64 32) |
| 58 | + ``` |
| 59 | +* From your OIDC provider obtain the following values and add ithem to the `oidc.properties` file |
| 60 | + ``` |
| 61 | + OIDC_PROVIDER_AUTHORIZATION_ENDPOINT= |
| 62 | + OIDC_PROVIDER_TOKEN_ENDPOINT= |
| 63 | + OIDC_PROVIDER_USERINFO_ENDPOINT= |
| 64 | + ``` |
| 65 | +* To add authorization checks one can either check for a specific user property, for a group property match |
| 66 | + ``` |
| 67 | + AUTHZ_USER_PROPERTY=preferred_username |
| 68 | + AUTHZ_ALLOWED_USERS=<comma-separated-list-of-usernames> |
| 69 | + ``` |
| 70 | +* Or for a group property match |
| 71 | + ``` |
| 72 | + AUTHZ_USER_PROPERTY=blueGroups |
| 73 | + AUTHZ_ALLOWED_USERS=<comma-separated-list-of-groups> |
| 74 | + ``` |
| 75 | +
|
| 76 | +## Installing the sample |
| 77 | +
|
| 78 | +* Install the Code Engine projects and all required components |
| 79 | + ``` |
| 80 | + ./run |
| 81 | + ``` |
| 82 | +
|
| 83 | +* Tear down the example: |
| 84 | + ``` |
| 85 | + ./run clean |
| 86 | + ``` |
| 87 | +
|
| 88 | +* Install the example and make sure it does not get deleted right-away |
| 89 | + ``` |
| 90 | + CLEANUP_ON_SUCCESS=false ./run |
| 91 | + ``` |
| 92 | +
|
| 93 | +* Following environment variables can be used to tweak the run script |
| 94 | +
|
| 95 | +| Name | Description | Default value | |
| 96 | +|:----|:---|:---| |
| 97 | +| REGION | Region of the Code Engine project | `eu-es` | |
| 98 | +| NAME_PREFIX | Naming prefix used for all components (e.g. resource group, Code Engine project, apps) | `oidc-sample` | |
| 99 | +| CLEANUP_ON_SUCCESS | Determines whether the setup should be deleted, right after its successful creation | `true` | |
| 100 | +| CLEANUP_ON_ERROR | Determines whether the setup should be deleted, if the setup procedure failed | `true` | |
0 commit comments