Add support for RHSSO and OpenId Connect #283

mpguerra · 2017-03-07T15:51:43Z

This PR integrates Red Hat Single Sign-On with APIcast to verify the identity of an End-User and issue JWT tokens for use by 3scale applications (clients in Red Hat Single Sign-On) wishing to access the End-User resources.

JWTs will be issued by Red Hat Single Sign-On and verified by APIcast based on the public key for the Red Hat Single Sign-On realm configured. Rate limiting and usage on 3scale will be done based on the client_id (aud value encoded in JWT.)

TODO

add a CHANGELOG entry
write description of this PR
document RHSSO_ENDPOINT variable
let @3scale/productization know about new dependency (https://github.com/3scale/apicast/pull/283/files#r104702400)

mikz · 2017-03-07T15:55:59Z

apicast/apicast-0.1-0.rockspec

@@ -4,7 +4,8 @@ version = '0.1-0'
 dependencies = {
  'lua-resty-http == 0.09-0',
  'inspect == 3.1.0-1',
-  'router == 2.1-0'
+  'router == 2.1-0',
+  'lua-resty-jwt == 0.1.9-0'


We need to give heads up to @rnc and @3scale/productization about this.

Ack. Creating jira for it

mikz · 2017-03-07T15:57:20Z

apicast/src/oauth.lua

+function _M.new()
+  local keycloak = env.get('RHSSO_ENDPOINT')
+  if keycloak then
+    oauth = require 'oauth.keycloak'


This is using module local variable. Why?

not sure if this is the correct way to do it, but I wanted to only require the correct oauth module, i.e require keycloak if we're using keycloak and apicast_oauth if we're using the built in functionality

but why ? this means the require would be called on every request instead of once on boot

mikz · 2017-03-07T15:58:40Z

apicast/src/oauth/keycloak.lua

+
+  local config = { endpoint = endpoint}
+  if _M.configured then
+    _M.configuration = config


We will have to revamp this to use the new configuration store and not using module level objects.

mikz · 2017-03-07T16:00:05Z

apicast/src/oauth/keycloak.lua

+  local formatted_key = "-----BEGIN PUBLIC KEY-----\n"
+  local key_len = len(key)
+  for i=1,key_len,64 do
+    formatted_key = formatted_key..string.sub(key, i, i+63).."\n"


What is this trying to do? Also it totally should be a function.

In RH SSO the public key is just a string 392 chars long. lua-resty-jwt library expects the key formatted as:

-----BEGIN PUBLIC KEY----- <64 chars> <64 chars> etc. -----END PUBLIC KEY-----

(sorry, I don't know how this format is called :) )

So, this function does just that.

So this would be great comment for the new extracted function :)

Where is that documented BTW ?

Because it uses AES from https://github.com/openresty/lua-resty-string and it does not mention anything.

Could that be what OpenSSL requires?

Not sure, I discovered by trial and error :)
Could dig a bit deeper to understand why it's this way.

mikz · 2017-03-07T16:07:21Z

apicast/src/oauth/keycloak.lua

+  local headers = {
+    ['Content-Type'] = 'application/json;charset=UTF-8'
+  }
+  local body = '{"error":"'..message..'"}"'


cjson.encode

mikz · 2017-03-07T16:15:00Z

apicast/src/oauth/keycloak.lua

+end
+
+function _M.authorize_check_params(params)
+  local response_type = params['response_type']


no need for string access, params.response_type is just fine

mikz · 2017-03-07T16:43:04Z

apicast/src/oauth/keycloak.lua

+end
+
+function _M.token_check_params(params)
+  local grant_type = params['grant_type']


the same as above, no need for string access

mikz · 2017-03-07T16:43:49Z

apicast/src/oauth/keycloak.lua

+function _M.parse_and_verify_token(jwt_token, public_key)
+  local jwt_obj = jwt:verify(public_key, jwt_token)
+  if not jwt_obj.verified then
+    ngx.log(ngx.INFO, "[jwt] failed verification for token: "..jwt_token)


don't concatenate strings, just use them as parameters: ngx.log(ngx.INFO, '..... ', jwt_token)

Also it looks like this should fail if the jwt is not verified?

mikz · 2017-03-07T16:48:23Z

apicast/src/proxy.lua

@@ -361,6 +362,15 @@ function _M:access(service)

  local credentials, err = service:extract_credentials()

+  if keycloak then


Only when the method is oauth, right? Otherwise this would be happening for user_key too.

Also this might belong to the service:extract_credentials method somehow. Not sure how yet though.

I think it was there in a previous iteration and we moved it because extract_credentials is just reading the credentials from the request, not parsing/validating them.

I think you suggested moving to apicast.lua at the time, but I couldn't see where, so I put in proxy.lua instead

Yep. Here it is well isolated. It can wait here for a while until we figure out better place.

But still it should be executed only when the auth method is oauth.

mikz · 2017-03-07T16:50:06Z

rockspec

@@ -5,7 +5,8 @@ dependencies = {
  'luacheck >= 0',
  'busted  >= 0',
  'lua-cjson >= 0',
-  'ldoc >= 0'
+  'ldoc >= 0', 
+  'lua-resty-jwt >= 0'


I think this is not necessary as development dependency because it is already a runtime dependency in the other rock spec.

mikz · 2017-03-07T16:50:29Z

examples/rh-sso/client-registrations/webhook_handler.lua

@@ -0,0 +1,105 @@
+local redis_pool = require 'client-registrations/redis_pool'
+local lom = require 'lxp.lom'
+local xpath = require 'luaxpath'


The example misses a rock spec defining what versions of what libraries are expected.

mikz · 2017-03-07T16:50:55Z

examples/rh-sso/client-registrations/webhook_handler.lua

@@ -0,0 +1,105 @@
+local redis_pool = require 'client-registrations/redis_pool'


I'd argue it is not necessary to have redis pool because it does not really do anything.

mikz · 2017-03-07T16:53:05Z

examples/rh-sso/client-registrations/webhook_handler.lua

+
+local _M = {}
+
+local initial_access_token = "CHANGE_ME_INITIAL_ACCESS_TOKEN"


IMHO our examples should not suggest editing them but rather provide means to inject the correct value like through environment variable.

The problem is that we'd need to declare the env var in conf/nginx.conf, no?

Yep. For some reason I thought this is standalone configuration.

APIcast should support customisation for adding more env variables. Open an issue?

I don't want to make the client registrations code part of APIcast as I don't think it belongs in the API Gateway.

However, customers want to see a solution that synchronises clients in 3scale and RHSSO without needing additional work/infrastructure on their side

Adding this as an example is my compromise, but I don't want to add this into the main APIcast nginx.conf as an env variable.

Happy to work with other suggestions, e.g @mikz suggestion for APIcast supporting custom env variables

Opened an issue: #284 :)

There is a PR now: #292

Would be good to verify it fits your needs. I'd say the automatic forwarding should be the way.

mikz · 2017-03-07T16:54:32Z

examples/rh-sso/rh-sso.conf

+      set $client_id null;
+      set $access_token null;
+      set $registration_url null;
+      access_by_lua "require('client-registrations/webhook_handler').handle()";


Shouldn't be content_by_lua more meaningful ? This is not access policy.

Also by using content_by_lua_block you can embed it inside and have just one file.

mayorova · 2017-03-07T17:33:07Z

examples/rh-sso/client-registrations/redis_pool.lua

+-- Redis connection parameters
+local _M = {
+  host      = os.getenv("REDIS_HOST") or '127.0.0.1',
+  port      = 6379,


We can use REDIS_PORT here

Actually this is something that should be abstracted in APIcast itself.

There is no reason to duplicate this code.

Yes. Then it can be reused in threescale_utils, and also in apicast-xc

mikz · 2017-03-07T18:00:09Z

examples/rh-sso/client-registrations/webhook_handler.lua

+
+local function update_client(client_details)
+  local client_id = client_details.client_id
+  ngx.var.access_token = get_access_token(client_id)


So if this is using apicast, it can use the http-ng client and not proxy_pass.

This example will not work on openshift because it does hardcode 8.8.8.8 as DNS.

APIcast has foundations for HTTP client, DNS resolving and others.

mikz · 2017-03-07T18:03:47Z

examples/rh-sso/client-registrations/webhook_handler.lua

@@ -0,0 +1,105 @@
+local redis_pool = require 'client-registrations/redis_pool'
+local lom = require 'lxp.lom'


I'd consider https://github.com/Phrogz/SLAXML which is pure Lua with no c dependency.

Both are kind of not maintained, so it does not matter much (most active around 2014).

Nice! I didn't see it before

the only issue I would have with slaxml is that it doesn't seem to be available from luarocks so I guess you'd have to clone the project instead

It has rockspec so maybe it just has to be pushed (Phrogz/SLAXML#9 (comment)).

Will change in a later iteration (when it's in luarocks)

mikz · 2017-03-08T07:24:28Z

examples/rh-sso/README.md

+
+## Red Hat Single Sign-On Configuration for APIcast
+
+1. [Create a new realm](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.0/html/getting_started_guide/create_a_realm_and_user#create-realm) (different from Master)


I'd say it makes sense to export the RHSSO configuration and add it to the example.

From there it wouldn't be that hard to just have docker compose to start keycloak and have full working example with no external dependencies.

@mayorova are you able to do this for my realm? I believe the command should be something like: bin/standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=pili-realm.json -Dkeycloak.migration.realmName=pili -Dkeycloak.migration.usersExportStrategy=SKIP

According to this article

Looking at the configuration exported, there's a lot of "confidential" data in there, I'll look into extracting relevant parts and adding a Dockerfile for a later iteration though.

You can export one realm from the UI. We also have example private keys stored in this repo.
And it is fine because it is meant to be example. For real use case you configure it from scratch.

But having working example is important, because it can be verified that it works.

mikz · 2017-03-08T07:26:22Z

examples/rh-sso/README.md

+- The following lua libraries should be installed using luarocks: 
+    - luaexpat: `sudo luarocks install luaexpat --tree=/usr/local/openresty/luajit`
+    - luaxpath: `sudo luarocks install luaxpath --tree=/usr/local/openresty/luajit`
+    - cjson: `sudo luarocks install lua-cjson --tree=/usr/local/openresty/luajit`


Not needed. Cjson is part of OpenResty.

mikz · 2017-03-08T07:27:33Z

examples/rh-sso/README.md

+    - luaxpath: `sudo luarocks install luaxpath --tree=/usr/local/openresty/luajit`
+    - cjson: `sudo luarocks install lua-cjson --tree=/usr/local/openresty/luajit`
+- And a symbolic link created: so openresty can find them
+    `ln -s /usr/local/openresty/luajit/lib64/lua/5.1/* /usr/local/openresty/luajit/lib/lua/5.1/` 


This should not be necessary. Just Installing them to the correct directory should be fine.

This specific one is for luaxpath & luaexpat, for some reason OpenResty doesn't find them on RHEL. How to install them to a specific directory?
Anyway, if we switch to the purely Lua lib for XML, then it shouldn't be necessary.

When openresty can't find them it will print nice error with all the load paths where they can be.
So it should be installed to one of them that make the most sense.

mikz · 2017-03-08T07:27:58Z

examples/rh-sso/README.md

+- And a symbolic link created: so openresty can find them
+    `ln -s /usr/local/openresty/luajit/lib64/lua/5.1/* /usr/local/openresty/luajit/lib/lua/5.1/` 
+
+Otherwise, please follow the instructions on the 3scale support site based on your chosen deployment method.


link to the 3scale support site?

mikz · 2017-03-08T07:28:31Z

examples/rh-sso/README.md

+
+### APIcast Set up
+
+APIcast v2 should be installed as usual with the following additional dependencies:


I'd not call it v2 because it is v3 already.

v3 is not yet a GA release, is it? We have quite a few mentions of v2 on the support site. If it's GA (supported version), then we need to change it too.

Writing stuff that changes to documentation does not make sense. It gets out of date and will be confusing. We can just write APIcast.

mikz · 2017-03-08T07:29:11Z

examples/rh-sso/README.md

+
+Otherwise, please follow the instructions on the 3scale support site based on your chosen deployment method.
+
+When it comes to running APIcast v2, we will use the same approach as in the Custom Configuration example to add an additional server block to handle the client registration in RH SSO. In this case, clients will be created in 3scale first and imported into RH SSO, e.g the way to do this is in docker would be by mounting a volume inside `sites.d` folder in the container.


A link to the Custom Configuration example?

mikz · 2017-03-08T07:31:45Z

examples/rh-sso/README.md

+### 3scale Configuration
+
+#### Webhooks
+In order to register applications created in 3scale as clients in RH SSO, you need to enable and configure [webhooks](https://support.3scale.net/docs/api-bizops/webhooks) on 3scale.


I'd extend the link to webhooks on 3scale or configure webhooks to be more descriptive.

mikz · 2017-03-09T11:07:03Z

apicast/src/proxy.lua

+      local app_id = jwt.payload.aud
+      credentials.app_id = app_id
+    else
+      return error_authorization_failed(service)


There is no test covering this change.

octobot · 2017-03-10T16:28:54Z

	1 Warning
⚠️	Big PR

Proselint found issues

doc/parameters.md

Line	Message	Severity

examples/rh-sso/README.md

Line	Message	Severity

Spell Checker found issues

doc/parameters.md

Line	Typo
3	APIcast v2 has a number of parameters co
3	ariables) that can modify the behavior of the gateway. The following
5	e that when deploying APIcast v2 with OpenShift, some of thee
15	Default: stderr
17	or more information. The file pathcan be either absolute, or relati
21	nfo
21	warn
37	Default: "apicast"
68	Values: a number > 60**
69	Default: 0
71	r. The value should be set to 0 or more than 60. For example,
71	ould be set to 0 or more than 60. For example, if `APICAST_CON
71	ONFIGURATION_CACHE` is set to 120, the gateway will reload the
71	eload the configuration every 2 minutes (120 seconds).
71	onfiguration every 2 minutes (120 seconds).
75	Default: "127.0.0.1"
77	ning Redis instance for OAuth 2.0 flow. `REDIS_HOST` parameter
81	Default: 6379
83	ning Redis instance for OAuth 2.0 flow. `REDIS_PORT` parameter
89	ning Redis instance for OAuth 2.0 flow. `REDIS_URL` parameter c
89	e used to set the full URI as DSN format like: `redis://PASSWOR
93	pty, the DNS resolver will be autodiscovered.
140	Setting it to particual version will make it not auto
144	ance for 3scale Applications (a.k.a. clients in Red Hat Single Sig

examples/rh-sso/README.md

Line	Typo
1	th Red Hat Single Sign-On and OpenID Connect for API Authenticatio
8	- Red Hat SSO instance - [Installation](htt
26	n-On e.g you can use the same webhook mechanism, but hosted outside
39	- The following lua libraries should be installed
39	ies should be installed using luarocks:
47	deal with client registration webhooks, this is all included in `web
47	t Single Sign-On based on the webhooks sent by 3scale. You can read
55	will need to create the client_registrations directory first) and call API
62	#### Webhooks
63	need to enable and [configure webhooks](https://support.3scale.net/d
65	1. Enter the APIcast url followed by the `/webhooks` p
66	2. Turn Webhooks "ON."
67	3. Select the following Webhooks under Settings:
74	Once the webhooks are configured, you will want
78	or Red Hat Single Sign-On and OpenID Connect
81	then need to add the redirect url for your client. We're going
83	he background, 3scale sends a webhook to APIcast, which in turn mak
94	th Red Hat Single Sign-On and OpenID Connect support as follows, e
102	Authorization", select "OAuth 2.0"

Spell Checker found issues

doc/parameters.md

Line	Typo
3	APIcast v2 has a number of parameters co
3	ariables) that can modify the behavior of the gateway. The following
5	e that when deploying APIcast v2 with OpenShift, some of thee
15	Default: stderr
17	or more information. The file pathcan be either absolute, or relati
21	nfo
21	warn
37	Default: "apicast"
68	Values: a number > 60**
69	Default: 0
71	r. The value should be set to 0 or more than 60. For example,
71	ould be set to 0 or more than 60. For example, if `APICAST_CON
71	ONFIGURATION_CACHE` is set to 120, the gateway will reload the
71	eload the configuration every 2 minutes (120 seconds).
71	onfiguration every 2 minutes (120 seconds).
75	Default: "127.0.0.1"
77	ning Redis instance for OAuth 2.0 flow. `REDIS_HOST` parameter
81	Default: 6379
83	ning Redis instance for OAuth 2.0 flow. `REDIS_PORT` parameter
89	ning Redis instance for OAuth 2.0 flow. `REDIS_URL` parameter c
89	e used to set the full URI as DSN format like: `redis://PASSWOR
93	pty, the DNS resolver will be autodiscovered.
140	Setting it to particual version will make it not auto
144	ance for 3scale Applications (a.k.a. clients in Red Hat Single Sig

examples/rh-sso/README.md

Line	Typo
1	th Red Hat Single Sign-On and OpenID Connect for API Authenticatio
8	- Red Hat SSO instance - [Installation](htt
26	n-On e.g you can use the same webhook mechanism, but hosted outside
39	- The following lua libraries should be installed
39	ies should be installed using luarocks:
47	deal with client registration webhooks, this is all included in `web
47	t Single Sign-On based on the webhooks sent by 3scale. You can read
55	will need to create the client_registrations directory first) and call API
62	#### Webhooks
63	need to enable and [configure webhooks](https://support.3scale.net/d
65	1. Enter the APIcast url followed by the `/webhooks` p
66	2. Turn Webhooks "ON."
67	3. Select the following Webhooks under Settings:
74	Once the webhooks are configured, you will want
78	or Red Hat Single Sign-On and OpenID Connect
81	then need to add the redirect url for your client. We're going
83	he background, 3scale sends a webhook to APIcast, which in turn mak
94	th Red Hat Single Sign-On and OpenID Connect support as follows, e
102	Authorization", select "OAuth 2.0"

Generated by 🚫 Danger

mayorova · 2017-03-16T10:46:11Z

apicast/src/proxy.lua

+  ngx.var.backend_host = backend.host or server or ngx.var.backend_host
+end
+
+local function debug_headers(service, usage, credentials)


The name is a bit confusing, as it suggests that it only has to do with the 3scale debug headers, while there are some lines which are an important part of the functionality.

Agreed. It should be split/renamed.

mikz · 2017-03-16T12:34:18Z

apicast/src/oauth/keycloak.lua

+  local jwt_obj, err = parse_and_verify_token(self, credentials.access_token)
+
+    if err then
+      ngx.log(ngx.INFO, err)


this could be improved to say something meaningful like: 'failed to parse and verify JWT: err'

mikz · 2017-03-16T12:34:47Z

apicast/src/oauth/keycloak.lua

@@ -164,9 +169,6 @@ function _M:transform_credentials(credentials)
      -- @field app_id Client id
      -- @table credentials_oauth


This documentation is useless now.

mikz · 2017-03-16T12:36:33Z

apicast/src/configuration_loader.lua

@@ -105,6 +107,12 @@ function boot.init(configuration)
    ngx.log(ngx.EMERG, 'cache is off, cannot store configuration, exiting')
    os.exit(0)
  end
+
+  local keycloak_config = _M.init(nil, "keycloak")


This is pretty poor interface and should be improved. Passing nil is just weird.

mikz · 2017-03-16T12:44:15Z

apicast/src/oauth.lua

-  local r = router:new()
+function _M.new(configuration)
+  if configuration.keycloak then
+    ngx.log(ngx.INFO, "keycloak configured")


this is going to print this message on every request, not really necessary no ?

…d-connect

mikz · 2017-03-16T12:54:25Z

examples/rh-sso/main.d/env.conf

@@ -0,0 +1 @@
+env RHSS0_INITIAL_TOKEN;


isn't this O 0 ?

mayorova · 2017-03-16T13:15:53Z

apicast/src/oauth/keycloak.lua

+
+  if not jwt_obj.verified then
+    ngx.log(ngx.INFO, "[jwt] failed verification for token, reason: ", jwt_obj.reason)
+    return jwt_obj, "JWT not verified"


I'd change it to:

return jwt_obj, "JWT not verified: "..jwt_obj.reason

just not to lose the reason, in case we want to use it in proxy later.

reason is not lost and passed in jwt_obj

every string concatenation has a cost and it is better to avoid it, error messages should be pretty much the same strings over and over again

mayorova · 2017-03-16T13:16:38Z

apicast/src/oauth/keycloak.lua

+  local jwt_obj, err = parse_and_verify_token(self, credentials.access_token)
+
+    if err then
+      ngx.log(ngx.INFO, err)


I think this log statement is a bit redundant, as we already print the error inside parse_and_verify_token.

mayorova · 2017-03-16T13:21:43Z

We are using the complete JWT in the cached_key, this might not be optimal, as it can be huge (and the shared dict is limited in size), and we really just need the extracted app_id.

mikz · 2017-03-16T13:29:15Z

@mayorova Agree that would be good, but I'm not comfortable making more changes without test coverage. IMO that can wait for CR1 and be done with proper test coverage (like full integration test with keycloak).

mpguerra · 2017-03-16T13:29:36Z

Regarding the JWT in the cached key, we need to think about the trade off of verifying the jwt each time (to extract the client_id) versus once only, not sure what's best, for now I decided to just keep the jwt in the cache

mpguerra · 2017-03-16T13:32:18Z

Thinking about it some more, the JWT will expire at some point so we should take that into consideration... I guess this would be fixed if we verify the JWT each time

mikz · 2017-03-16T13:33:34Z

True. It is quite trivial to extract the TTL from the token and add the cache key with expiry.

We should add it to some list of known issues and fix it in the next release.

…EADME

octobot assigned mpguerra Mar 7, 2017

mpguerra added the B-current label Mar 7, 2017

SidonieGaffori added the in progress label Mar 7, 2017

mikz reviewed Mar 7, 2017

View reviewed changes

mayorova reviewed Mar 7, 2017

View reviewed changes

mikz reviewed Mar 7, 2017

View reviewed changes

mikz reviewed Mar 8, 2017

View reviewed changes

mikz reviewed Mar 9, 2017

View reviewed changes

mpguerra force-pushed the openid-connect branch from 4bab9e5 to 6ef42f6 Compare March 10, 2017 15:14

mayorova reviewed Mar 16, 2017

View reviewed changes

Maria Pilar Guerra Arias and others added 3 commits March 16, 2017 11:52

Fix tests

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

GPG key ID: 4AEE18F83AFDEB23
Expired

Verified
Learn about vigilant mode

1b8eec2

Danger fixes

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

GPG key ID: 4AEE18F83AFDEB23
Expired

Verified
Learn about vigilant mode

e163dad

fix luacheck error

Verified

This commit was signed with the committer’s verified signature. The key has expired.

doubledup David Dunn

GPG key ID: 99F10972153A72B0
Expired

Verified
Learn about vigilant mode

2f7df3f

mikz reviewed Mar 16, 2017

View reviewed changes

Add RHSSO_ENDPOINT to parameters list

50260f0

mikz reviewed Mar 16, 2017

View reviewed changes

Merge branch 'openid-connect' of github.com:3scale/apicast into openi…

2e3bb26

…d-connect

mikz reviewed Mar 16, 2017

View reviewed changes

examples/rh-sso/main.d/env.conf Outdated

@@ -0,0 +1 @@

env RHSS0_INITIAL_TOKEN;

Copy link

Contributor

mikz Mar 16, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't this O 0 ?

mayorova reviewed Mar 16, 2017

View reviewed changes

mikz added 2 commits March 16, 2017 14:32

[proxy] reduce duplication in auth functions

d66fdd6

[keycloak] improve configuration loading

4c40fae

Maria Pilar Guerra Arias added 5 commits March 16, 2017 14:52

Remove noisy log entry

50d71b1

Update file locations to be more consistent with APIcast naming and R…

efe016b

…EADME

Remove redundant log entry

be86559

Update CHANGELOG with known issues

3a6a7b5

Update CHANGELOG with issue number

f3ffeab

mikz merged commit 1aa004d into master Mar 16, 2017

mikz removed B-current in progress labels Mar 16, 2017

mikz deleted the openid-connect branch March 16, 2017 16:06

mpguerra mentioned this pull request Mar 17, 2017

[OAuth] Take JWT expiry into account in authorizations response cache #309

Closed

		@@ -361,6 +362,15 @@ function _M:access(service)

		local credentials, err = service:extract_credentials()

		if keycloak then

		@@ -0,0 +1,105 @@
		local redis_pool = require 'client-registrations/redis_pool'


		local _M = {}

		local initial_access_token = "CHANGE_ME_INITIAL_ACCESS_TOKEN"

		@@ -0,0 +1,105 @@
		local redis_pool = require 'client-registrations/redis_pool'
		local lom = require 'lxp.lom'


		## Red Hat Single Sign-On Configuration for APIcast

		1. [Create a new realm](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.0/html/getting_started_guide/create_a_realm_and_user#create-realm) (different from Master)


		### APIcast Set up

		APIcast v2 should be installed as usual with the following additional dependencies:


		Otherwise, please follow the instructions on the 3scale support site based on your chosen deployment method.

		When it comes to running APIcast v2, we will use the same approach as in the Custom Configuration example to add an additional server block to handle the client registration in RH SSO. In this case, clients will be created in 3scale first and imported into RH SSO, e.g the way to do this is in docker would be by mounting a volume inside `sites.d` folder in the container.

		@@ -164,9 +169,6 @@ function _M:transform_credentials(credentials)
		-- @field app_id Client id
		-- @table credentials_oauth

Add support for RHSSO and OpenId Connect #283

Add support for RHSSO and OpenId Connect #283

Conversation

mpguerra commented Mar 7, 2017 • edited Loading

TODO

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikz Mar 7, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikz Mar 8, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

octobot commented Mar 10, 2017 • edited Loading

Proselint found issues

Spell Checker found issues

Spell Checker found issues

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mpguerra commented Mar 7, 2017 •

edited

Loading

mikz Mar 7, 2017 •

edited

Loading

mikz Mar 8, 2017 •

edited

Loading

octobot commented Mar 10, 2017 •

edited

Loading