Skip to content

Commit 3d3f3e3

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #92606 from EricPonvelle/OSDOCS-10513_EntraID-KeyCloak
Updated the docs to cover KeyCloak as an OIDC provider
2 parents 0654f6b + 094b04c commit 3d3f3e3

File tree

3 files changed

+163
-45
lines changed

3 files changed

+163
-45
lines changed

‎modules/rosa-hcp-sts-creating-a-cluster-external-auth-provider-cli.adoc

Lines changed: 3 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,9 @@ The following table shows the possible CLI flags you can use when creating your
4848

4949
.Procedure
5050

51-
* To use the interactive command interface, run the following commands:
51+
* To use the interactive command-line interface, run the following command:
5252
+
53+
.Example input
5354
[source,terminal]
5455
----
5556
$ rosa create external-auth-provider -c <cluster_name>
@@ -96,47 +97,5 @@ rosa create external-auth-provider --cluster=<cluster_id> \
9697
+
9798
[source,terminal]
9899
----
99-
I: Successfully created an external authentication provider for cluster '<cluster_id>'
100-
----
101-
102-
.Verification
103-
104-
* To verify your external authentication provider, run one of the following options:
105-
106-
** List the external authentication configuration on a specified cluster with the following command:
107-
+
108-
[source,terminal]
109-
----
110-
$ rosa list external-auth-provider -c <cluster_name>
111-
----
112-
+
113-
.Example output
114-
+
115-
The following example shows a configured Microsoft Entra ID external authentication provider:
116-
+
117-
[source,terminal]
118-
----
119-
NAME ISSUER URL
120-
m-entra-id https://login.microsoftonline.com/<group_id>/v2.0
121-
----
122-
123-
** Display the external authentication configuration on a specified cluster by using the following command:
124-
+
125-
[source,terminal]
126-
----
127-
$ rosa describe external-auth-provider \
128-
-c <cluster_name> --name <name_of_external_authentication>
129-
----
130-
+
131-
.Example output
132-
+
133-
[source,terminal]
134-
----
135-
ID: ms-entra-id
136-
Cluster ID: <cluster_id>
137-
Issuer audiences:
138-
- <audience_id>
139-
Issuer Url: https://login.microsoftonline.com/<group_id>/v2.0
140-
Claim mappings group: groups
141-
Claim mappings username: email
100+
I: Successfully created an external authentication provider for cluster 'ext-auth-test'
142101
----

‎modules/rosa-hcp-sts-example-external-auth-provider.adoc

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="rosa-hcp-sts-example-external-auth-provider_{context}"]
6+
= Example external authentication providers
7+
:source-highlighter: pygments
8+
:pygments-style: emacs
9+
:icons: font
10+
11+
You can use one of the following examples of external authentication provider configurations to set up your own configuration.
12+
13+
.Example Microsoft Entra ID configuration
14+
15+
You can use Microsoft Entra ID as an external provider. You must have already configured a Microsoft Entra ID server before using it as an external provider. See the link:https://learn.microsoft.com/en-us/entra/identity/?culture=en-us&country=us[Microsoft Entra ID documentation] for more information.
16+
17+
The following example shows a configured Microsoft Entra ID external authentication provider:
18+
19+
.Procedure
20+
. Create an external authentication provider that uses Microsoft Entra ID by running the following command:
21+
+
22+
[NOTE]
23+
====
24+
You must set your own environment variables with values specific to your Microsoft Entra ID server.
25+
====
26+
+
27+
.Example input
28+
[source,terminal]
29+
----
30+
$ rosa create external-auth-provider -c $CLUSTER_NAME \
31+
--claim-mapping-groups-claim groups \
32+
--claim-mapping-username-claim <authorized_user_name> \
33+
--console-client-id $CONSOLE_CLIENT_ID \
34+
--console-client-secret $CONSOLE_CLIENT_SECRET_VALUE \
35+
--issuer-audiences "$AUDIENCE_1" \
36+
--issuer-ca-file ca-bundle.crt --issuer-url $ISSUER_URL \
37+
--name m-entra-id
38+
----
39+
+
40+
.Example output
41+
[source,terminal]
42+
----
43+
I: Successfully created an external authentication provider for cluster 'ext-auth-test'. It can take a few minutes for the creation of an external authentication provider to become fully effective.
44+
----
45+
46+
. List the external authentication provider for your cluster to see the issuer URL or use the `rosa describe` command to see all details related to this external authentication provider by running one of the following commands:
47+
+
48+
.. List the external authentication configuration on a specified cluster by running the following command:
49+
+
50+
.Example input
51+
[source,terminal]
52+
----
53+
$ rosa list external-auth-provider -c <cluster_name> \ <1>
54+
----
55+
<1> Provide the name of the cluster with the external authentication provider you want to view.
56+
+
57+
.Example output
58+
[source,terminal]
59+
----
60+
NAME ISSUER URL
61+
m-entra-id https://login.microsoftonline.com/<group_id>/v2.0
62+
----
63+
+
64+
.. Display the external authentication configuration on a specified cluster by running the following command:
65+
+
66+
.Example input
67+
[source,terminal]
68+
----
69+
$ rosa describe external-auth-provider \
70+
-c <cluster_name> --name <name_of_external_authentication> \ <1> <2>
71+
----
72+
<1> Provide the name of the cluster that has the external authentication provider you want to see detailed.
73+
<2> Provide the name of the authentication provider you want to see detailed.
74+
+
75+
.Example output
76+
+
77+
[source,terminal]
78+
----
79+
ID: ms-entra-id
80+
Cluster ID: <cluster_id>
81+
Issuer audiences:
82+
- <audience_id>
83+
Issuer Url: https://login.microsoftonline.com/<group_id>/v2.0
84+
Claim mappings group: groups
85+
Claim mappings username: email
86+
----
87+
88+
.Example Keycloak configuration
89+
90+
You can use Keycloak as an external provider. You must have already configured a Keycloak server before using it as an external provider. See the link:https://www.keycloak.org/server/configuration[Keycloak documentation] for more information.
91+
92+
.Procedure
93+
. Create an external authentication provider that uses Keycloak by running the following command:
94+
+
95+
[NOTE]
96+
====
97+
You must set your own environment variables with values specific to your Keycloak server.
98+
====
99+
+
100+
.Example input
101+
[source,terminal]
102+
----
103+
$ rosa create external-auth-provider -c $CLUSTER_NAME \
104+
--claim-mapping-groups-claim groups \
105+
--claim-mapping-username-claim <authorized_user_name> \
106+
--console-client-id $CONSOLE_CLIENT_ID \
107+
--console-client-secret $CONSOLE_CLIENT_SECRET_VALUE \
108+
--issuer-audiences "$AUDIENCE_1,$AUDIENCE_2" \
109+
--issuer-ca-file ca-bundle.crt --issuer-url $ISSUER_URL --name keycloak
110+
----
111+
+
112+
.Example output
113+
[source,terminal]
114+
----
115+
I: Successfully created an external authentication provider for cluster 'ext-auth-test'. It can take a few minutes for the creation of an external authentication provider to become fully effective.
116+
----
117+
118+
. List the external authentication provider for your cluster to see the issuer URL or use the `rosa describe` command to see all details related to this external authentication provider by running one of the following commands:
119+
.. List the external authentication configuration on a specified cluster by running the following command:
120+
+
121+
.Example input
122+
[source,terminal]
123+
----
124+
$ rosa list external-auth-provider -c <cluster_name>
125+
----
126+
+
127+
.Example output
128+
[source,terminal]
129+
----
130+
NAME ISSUER URL
131+
keycloak https://keycloak-keycloak.apps.<keycloak_id>.openshift.org/realms/master
132+
----
133+
+
134+
.. Display the external authentication configuration on a specified cluster by running the following command:
135+
+
136+
.Example input
137+
[source,terminal]
138+
----
139+
$ rosa describe external-auth-provider \
140+
-c <cluster_name> --name <name_of_external_authentication>
141+
----
142+
+
143+
.Example output
144+
+
145+
[source,terminal]
146+
----
147+
ID: keycloak
148+
Cluster ID: <cluster_id>
149+
Issuer audiences:
150+
- <audience_id_1>
151+
- <audience_id_2>
152+
Issuer Url: https://keycloak-keycloak.apps.<keycloak_id>.openshift.org/realms/master
153+
Claim mappings group: groups
154+
Claim mappings username: <authorized_user_name>
155+
Console client id: console-test
156+
----

‎rosa_hcp/rosa-hcp-sts-creating-a-cluster-ext-auth.adoc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,13 @@ endif::openshift-rosa-hcp[]
4747
include::modules/rosa-hcp-sts-creating-a-cluster-external-auth-cluster-cli.adoc[leveloffset=+1]
4848
//Step 2 Create/list/delete external_provider to HCP cluster that external_auth_config is not enable
4949
include::modules/rosa-hcp-sts-creating-a-cluster-external-auth-provider-cli.adoc[leveloffset=+1]
50+
include::modules/rosa-hcp-sts-example-external-auth-provider.adoc[leveloffset=+2]
5051

5152
[role="_additional-resources"]
5253
.Additional resources
53-
* For more information about configuring Entra ID for your IDP, see link:https://learn.microsoft.com/en-us/entra/fundamentals/whatis[What is Microsoft Entra ID?] in the Azure documentation or the xref:../cloud_experts_tutorials/cloud-experts-entra-id-idp.adoc#cloud-experts-entra-id-idp[Configuring Microsoft Entra ID (formerly Azure Active Directory) as an identity provider] tutorial section of the documentation.
54+
* link:https://learn.microsoft.com/en-us/entra/fundamentals/whatis[What is Microsoft Entra ID?] (Microsoft documentation)
55+
* xref:../cloud_experts_tutorials/cloud-experts-entra-id-idp.adoc#cloud-experts-entra-id-idp[Configuring Microsoft Entra ID (formerly Azure Active Directory) as an identity provider]
56+
* link:https://www.keycloak.org/guides[Keycloak documentaton]
5457
ifndef::openshift-rosa-hcp[]
5558
//* For information about the similar `idps` tool in the ROSA CLI, see xref:#../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-create-idp_rosa-managing-objects-cli[`create idp`].
5659
//* For more information about options in the ROSA CLI, see xref:#../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-create-external-auth-provider_rosa-managing-objects-cli[`create external-auth-provider`], xref:../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-list-external-auth-provider_rosa-managing-objects-cli[`list external-auth-provider`], and xref:../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-delete-external-auth-provider_rosa-managing-objects-cli[`delete external-auth-provider`].

0 commit comments

Comments
 (0)