Keycloak Authorization Services based authz prototype #24

mstruk · 2020-01-10T15:57:42Z

Signed-off-by: Marko Strukelj [email protected]

This PR introduces authorization support that works hand-in-hand with OAuth2 authentication.

There is an example that allows a step-by-step walkthrough. See README-authz.md

The configuration is explained in JavaDoc of KeycloakRBACAuthorizer class

What's still missing are automated tests in the testsuite.

tombentley

This is a big piece of work, so this is just an initial pass, I'll look again next week.

Thanks!

oauth-common/src/main/java/io/strimzi/kafka/oauth/common/HttpException.java

oauth-common/src/main/java/io/strimzi/kafka/oauth/common/JSONUtil.java

...oak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/JwtKafkaPrincipal.java

...uthorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/KeycloakRBACAuthorizer.java

oauth-keycloak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/UserSpec.java

tombentley

Proof read the README.

examples/README-authz.md

examples/docker/kafka-oauth-strimzi/compose-authz.yml

examples/docker/kafka-oauth-strimzi/kafka/oauth.sh

examples/docker/kafka-oauth-strimzi/kafka/jwt.sh

examples/docker/kafka-oauth-strimzi/kafka/oauth.sh

ppatierno

I did a first quick pass leaving a few comments.

examples/README-authz.md

ppatierno · 2020-01-14T07:03:47Z

examples/README-authz.md

+In this case the access token represents the specific user, rather than the client application.
+
+Before continuing, there is one setting we need to check.
+Due to [a little bug in Keycloak](https://issues.redhat.com/browse/KEYCLOAK-12640) the realm is at this point misconfigured, and we have to fix the configuration manually.


I think we should track this bug maybe with an issue here, in order to remember to remove this section when the Keycloak bug will be fixed and the workaround not needed anymore.

@ppatierno What is the standard practice for tracking external issues 'here'? Creating a new Issue and linking to external one in its description, then just leaving it open and occasionally checking it?

@mstruk yes, it's the only way I know :-/

examples/README-authz.md

...horizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/JwtKafkaPrincipalBuilder.java

mstruk · 2020-01-21T16:28:45Z

examples/docker/kafka-oauth-strimzi/kafka/oauth.sh

+usage() {
+  echo "Usage: $0 [USERNAME] [PASSWORD] [ARGUMENTS] ..."
+  echo
+  echo "$0 is a tool for obtaining an access token or a refresh token for the user or the client."


It would maybe make sense to include oauth.sh, and jwt.sh in kafka image?

Yes, it would. IIRC we include the jar using the 3rd party jars mechanism, but we don't really have similar mechanism for including tools or scripts.

examples/README-authz.md

tombentley · 2020-01-24T08:37:12Z

examples/docker/kafka-oauth-strimzi/kafka/oauth.sh

+usage() {
+  echo "Usage: $0 [USERNAME] [PASSWORD] [ARGUMENTS] ..."
+  echo
+  echo "$0 is a tool for obtaining an access token or a refresh token for the user or the client."


Yes, it would. IIRC we include the jar using the 3rd party jars mechanism, but we don't really have similar mechanism for including tools or scripts.

examples/docker/kafka-oauth-strimzi/kafka/oauth.sh

...oak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/JwtKafkaPrincipal.java

...uthorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/KeycloakRBACAuthorizer.java

oauth-keycloak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/UserSpec.java

mstruk · 2020-01-26T23:37:52Z

I have some more fixes coming, for issues identified while testing with mutual TLS listeners and Kafka 2.4 ...

examples/README-authz.md

scholzj · 2020-01-27T16:29:04Z

oauth-keycloak-authorizer/etc/authorization-scopes.json

@@ -0,0 +1,37 @@
+{


Could you please explain why do we need this file here? How is it used and how is it packaged?

Currently all the documentation is in examples/docker/README-authz.md which is a walkthrough example. This file is mentioned there. I can add a paragraph that explains how to import it into empty Authorization Services configuration.

scholzj · 2020-01-27T16:30:26Z

...-keycloak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/AuthzConfig.java

+
+public class AuthzConfig extends Config {
+
+    public static final String STRIMZI_AUTHZ_CLIENT_ID = "strimzi.authz.client.id";


I wonder if we should use authorization intead of authz. Lot of people does not know / use this as shortcut and might be confused.

mstruk · 2020-01-27T18:36:02Z

It looks like the tests could use a longer timeout to give enough time to pull down images from docker hub.

Signed-off-by: Marko Strukelj <[email protected]>

…urce for completeness Signed-off-by: Marko Strukelj <[email protected]>

Signed-off-by: Marko Strukelj <[email protected]>

…not enabled Signed-off-by: Marko Strukelj <[email protected]>

…eners Signed-off-by: Marko Strukelj <[email protected]>

Signed-off-by: Marko Strukelj <[email protected]>

mstruk requested review from scholzj, ppatierno and tombentley January 10, 2020 15:58

tombentley reviewed Jan 10, 2020

View reviewed changes

tombentley reviewed Jan 13, 2020

View reviewed changes

ppatierno reviewed Jan 14, 2020

View reviewed changes

mstruk added this to the 0.3.0 milestone Jan 17, 2020

This was referenced Jan 20, 2020

Integrate OAuth Authorization into Strimzi strimzi/strimzi-kafka-operator#2428

Closed

Added Keycloak Authorization configuration strimzi/strimzi-kafka-operator#2432

Merged

mstruk force-pushed the authz branch from 3ff6f10 to 33da601 Compare January 21, 2020 16:15

mstruk commented Jan 21, 2020

View reviewed changes

mstruk force-pushed the authz branch from 33da601 to 427fee9 Compare January 21, 2020 19:47

scholzj reviewed Jan 22, 2020

View reviewed changes

examples/README-authz.md Show resolved Hide resolved

examples/README-authz.md Outdated Show resolved Hide resolved

examples/README-authz.md Outdated Show resolved Hide resolved

mstruk force-pushed the authz branch from 427fee9 to 4532af7 Compare January 23, 2020 08:47

tombentley reviewed Jan 24, 2020

View reviewed changes

ppatierno changed the title ~~[WIP] Keycloak Authorization Services based authz prototype~~ Keycloak Authorization Services based authz prototype Jan 24, 2020

tombentley approved these changes Jan 27, 2020

View reviewed changes

examples/README-authz.md Outdated Show resolved Hide resolved

ppatierno approved these changes Jan 27, 2020

View reviewed changes

scholzj reviewed Jan 27, 2020

View reviewed changes

scholzj approved these changes Jan 28, 2020

View reviewed changes

mstruk added 8 commits January 28, 2020 19:59

Keycloak Authz Services based authz prototype

8666411

Signed-off-by: Marko Strukelj <[email protected]>

Address spotbugs issues

162a6e5

Signed-off-by: Marko Strukelj <[email protected]>

Address PR comments

d8389bc

Signed-off-by: Marko Strukelj <[email protected]>

Added initial authz test to testsuite

19e5e3a

Signed-off-by: Marko Strukelj <[email protected]>

Fix SpotBugs failure on Java 11

d4a10de

Signed-off-by: Marko Strukelj <[email protected]>

Add missing resource and action scope

398cfc7

Signed-off-by: Marko Strukelj <[email protected]>

A more comprehensive test

8747f0c

Signed-off-by: Marko Strukelj <[email protected]>

Fix JSONUtil.asListOfString() to convert non-textual values to text

19af5e6

Signed-off-by: Marko Strukelj <[email protected]>

mstruk added 12 commits January 28, 2020 20:02

Fixes to examples/README-authz.md

5cc84f4

Signed-off-by: Marko Strukelj <[email protected]>

Rebase on master + improve README-authz.md + add DelegationToken reso…

b92bf1e

…urce for completeness Signed-off-by: Marko Strukelj <[email protected]>

Fix equals() method

cdb0602

Signed-off-by: Marko Strukelj <[email protected]>

Fix UserSpec.of() method

de52b5b

Signed-off-by: Marko Strukelj <[email protected]>

Throw exception for ACL methods if delegation to simple kafka ACL is …

10eaf1a

…not enabled Signed-off-by: Marko Strukelj <[email protected]>

Fix issues identified when testing with Kafka 2.4 and mutual TLS list…

490c3cc

…eners Signed-off-by: Marko Strukelj <[email protected]>

Improve handling of non-oauth users and delegation to simple ACL

cbd6349

Signed-off-by: Marko Strukelj <[email protected]>

Upgrade examples to Kafka 2.4.0 + oauthz example improvements

6950cc9

Signed-off-by: Marko Strukelj <[email protected]>

Suggestions and comments from @tombentley

5472835

Signed-off-by: Marko Strukelj <[email protected]>

Suggestions and comments from @tombentley

2631d44

Signed-off-by: Marko Strukelj <[email protected]>

Change strimzi.authz.* to strimzi.authorization.*

7348ae6

Signed-off-by: Marko Strukelj <[email protected]>

Document authorization-scopes.json

aadfe3d

Signed-off-by: Marko Strukelj <[email protected]>

mstruk force-pushed the authz branch from aedefa6 to aadfe3d Compare January 28, 2020 19:19

scholzj merged commit 8d4def3 into strimzi:master Jan 28, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keycloak Authorization Services based authz prototype #24

Keycloak Authorization Services based authz prototype #24

mstruk commented Jan 10, 2020

tombentley left a comment

tombentley left a comment

ppatierno left a comment

ppatierno Jan 14, 2020

mstruk Jan 16, 2020

mstruk Jan 22, 2020

ppatierno Jan 27, 2020

mstruk Jan 21, 2020

tombentley Jan 24, 2020

tombentley Jan 24, 2020

mstruk commented Jan 26, 2020

scholzj Jan 27, 2020

mstruk Jan 27, 2020

mstruk Jan 27, 2020

scholzj Jan 27, 2020

mstruk Jan 27, 2020

mstruk commented Jan 27, 2020


		public class AuthzConfig extends Config {

		public static final String STRIMZI_AUTHZ_CLIENT_ID = "strimzi.authz.client.id";

Keycloak Authorization Services based authz prototype #24

Keycloak Authorization Services based authz prototype #24

Conversation

mstruk commented Jan 10, 2020

tombentley left a comment

Choose a reason for hiding this comment

tombentley left a comment

Choose a reason for hiding this comment

ppatierno left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mstruk commented Jan 26, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mstruk commented Jan 27, 2020