Direct OIDC mapping akhq with keycloak

[Mercyfan]

apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.akhq.existingSecrets }}
  annotations:
    avp.kubernetes.io/path: {{ .Values.akhqCustomValues.path | quote }}
type: Opaque
stringData:
  application-secrets.yml: |
    akhq:
      endpoints:
        env:
          enabled: true
          sensitive: false
        server:
          access-log:
            enabled: true
            name: org.akhq.log.access
      connections:
        {{ .Release.Name }}-dbp-kafka-cluster:
          properties:
            bootstrap.servers: "{{ .Release.Name }}-kafka-headless:9092"
          schema-registry:
            url: "http://{{ .Release.Name }}-cp-schema-registry:8081"
            type: "confluent"
          connect:
            - name: "cp-kafka-connect"
              url: "http://{{ .Release.Name }}-cp-kafka-connect:8083"
    micronaut:
      security:
        enabled: true
        token:
          jwt:
            signatures:
              secret:
                generator:
                  secret: {{ .Values.akhqCustomValues.jwtSecretVaultKey }}
        oauth2:
          enabled: true
          clients:
            keycloak:
              client-id: "dbp-akhq"
              client-secret: {{ .Values.akhqCustomValues.keycloakClientSecretVaultKey }}
              openid:
                issuer: ""
      endpoints:
        env:
          enabled: true
          sensitive: false
 values        
  akhq:
  enabled: true
  networkPolicy:
    enabled: false
  security:
    oidc:
      enabled: true
      providers:
        keycloak:
          label: "Login with Keycloak"
          username-claim: preferred_username
          groups-field: "resource_access.dbp-akhq.roles"
          default-group: null  # Не назначаем роль по умолчанию
          groups:
            - name: "akhq-admin"
              groups:
                - "admin"
            - name: "akhq-reader"
              groups:
                - "read_only"

            i got this error
            Internal Server Error: Cannot invoke "java.util.Map.values()" because the return value of "org.akhq.security.rule.AKHQSecurityRule.decompressGroups(io.micronaut.security.authentication.Authentication)" is null

[Mercyfan]

I'm trying to integreat keycloack auth to akhq 0.25.1, can someone help?

[petkovp]

Please see my config:

  secrets:
      micronaut:
        security:
          enabled: true
          oauth2:
            enabled: true
            clients:
              keycloak:
                client-id: "myclient"
                client-secret: "test-secret"
                openid:
                  issuer: KEYCLOAK ISSUER URL
      akhq:
        security:
          default-group: no-roles
          
          oidc:
            enabled: true
            providers:
              keycloak:
                label: "Login with KeyCloak"
                username-field: email
                groups-field: groups
                default-group: no-roles
                   groups:
                      - name: "akhq-admin"
                      groups:
                      - "admin"
                      - name: "akhq-reader"
                      groups:
                      - "read_only"

[Mercyfan]

Thank you, im rewrite my cinf and its started work

micronaut:
security:
enabled: true
token:
jwt:
signatures:
secret:
generator:
secret: token
oauth2:
enabled: true
clients:
keycloak:
client-id: "clientId"
client-secret: "secret"
openid:
issuer: "url"
endpoints:
logout:
get-allowed: true
env:
enabled: true
sensitive: false
akhq:
connections:
docker-kafka-server:
properties:
bootstrap.servers: "kafka:9092"
schema-registry:
url: "http://schema-registry:8085"
connect:
- name: "connect"
url: "http://connect:8083"
security:
default-group: no-roles
oidc:
enabled: true
providers:
keycloak:
label: "Login with Keycloak"
username-field: "preferred_username"
groups-field: "roles"
redirect-uri: "http://localhost:8080/oauth/callback/keycloak"
well-known-url: "url.well-known/openid-configuration"
groups:
- name: admin
groups:
- admin
- name: reader
groups:
- reader
server:
access-log:
enabled: true
name: org.akhq.log.access