Here are the steps I have gone through to get the sample keycloak nodejs app running on OpenShift:
# Make sure the mobile-related services are installed on the cluster.
# Use the Service catalog to provision the Identity management service into a namespace. Wait for the IDM service to be ready.
# Deploy the example app image to the same namespace (it is available here: https://cloud.docker.com/repository/docker/weilee/keycloak-example). Wait for it to be up and running.
# Next, we need to protect the example app with the IDM service:
## In the OpenShift UI, go to the namespace -> Overview -> Provisioned Services -> Identity Management -> Create Binding
## In the "Creating binding wizard", set the client id to be the name of the keycloak app deployed in step 3, and set the client type to be "Public". Finish the wizard and wait for the binding to be created.
## When it is done, login to the IDM service, and you should see there is a new realm created with the name of the openshift namespace.
## Update the realm config in IDM:
### Select the newly created realm, choose "Clients" -> client id
### In the "Settings" tab, add a new valid redirect url. It should be in the format of "http://<url of the keycloak example app>/*". e.g. "http://keycloak-example-myproject.192.168.64.22.nip.io/*"
### In the "Roles" tab, add a new role called "admin"
### Click on the "Users" option on the menu on the left hand side, and add a new user to the realm. Do not assign any other roles yet to the user
## When it is done, back to the openshift UI, go to Resources -> Secrets, and find the secret that is created by the binding step. It should be something like "keycloak- \ <client id \ >-public". Click on the secret, and click on "Add to application".
## In the pop up, select the deployment config of the example app in step 3 as the target application, and add the secret as a "volume". Enter a mount path for the secret (e.g./tmp/keycloak/). Save the config and it should trigger the keycloak example app to be deployed again.
## Go to "Application" -> Deploys -> keycloak example app, and choose the environment tab. Add the following environment variables: KEYCLOAK_CONFIG=/tmp/keycloak/config, NODE_TLS_REJECT_UNAUTHORIZED=0. Redeploy the app. Now the IDM config is mounted to the app, and the example app is protected by the IDM service.
# Open a new tab, go to "http://<keycloak example app url>/graphql", you should be redirected to a login page of the IDM service. Login with the newly created user in setup 4.4, and you should see the graphql playground. However, you will see an error. Open a new tab and enter "http://<keycloak example app url>/token", you will get a new token back. Go back to the graphql playground, and select "HTTP HEADERS" view and paste the token value. In the query view, add "{ hello }" and try execute it. You will get a error complaining that the user do not have the right permission.
# Go to IDM, select the user created in setup 4.4, and assign the "admin" role to the user (it should be the client role, not a realm-level role).
# Open a new tab and go to "http://<keycloak example app url>/logout" to logout the current session. Then repeat step 5 and this time you should get a valid response back.
|
|
