User credentials OAuth with Keycloak

Follow along with an OIDC OAuth example that uses Keycloak as an identity provider.

Before you begin

1. Complete the demo setup to install Gloo Mesh, Istio, Bookinfo, httpbin, and Keycloak in your cluster.

2. Create the Gloo Mesh resources for this policy in the management and workload clusters.

   The following files are examples only for testing purposes. Your actual setup might vary. You can use the files as a reference for creating your own tests.

   • Management cluster
   • Workload cluster 1

   1. Download the following Gloo Mesh resources:

      • KubernetesCluster for cluster 1
      • KubernetesCluster for cluster 2
      • Workspace

   2. Apply the files to your management cluster.

      kubectl apply -f kubernetes-cluster_gloo-mesh_cluster-1.yaml --context ${MGMT_CONTEXT}
      kubectl apply -f kubernetes-cluster_gloo-mesh_cluster-2.yaml --context ${MGMT_CONTEXT}
      kubectl apply -f workspace_gloo-mesh_anything.yaml --context ${MGMT_CONTEXT}
      

   1. Download the following Gloo Mesh resources:

      • Virtual gateway
      • Workspace settings

   2. Apply the files to your workload cluster.

      kubectl apply -f virtual-gateway_bookinfo_north-south-gw.yaml --context ${REMOTE_CONTEXT1}
      kubectl apply -f workspace-settings_bookinfo_anything.yaml --context ${REMOTE_CONTEXT1}
      

Configure an OAuth policy

Create the external auth policy that uses Keycloak as an identity provider.

1. Create a Kubernetes secret with the Keycloak OIDC secret. For more information, see Step 5: Install Keycloak of the demo setup.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: oauth
     namespace: httpbin
   type: extauth.solo.io/oauth
   data:
     client-secret: $(echo -n ${KEYCLOAK_SECRET} | base64)
   EOF
   

2. Create an external auth server to use for your policy.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: admin.gloo.solo.io/v2
   kind: ExtAuthServer
   metadata:
     name: ext-auth-server
     namespace: httpbin
   spec:
     destinationServer:
       ref:
         cluster: cluster-1
         name: ext-auth-service
         namespace: gloo-mesh
       port:
         name: grpc
   EOF
   

3. Create a route table for the httpbin app and external auth policy. Note that the route table selects the virtual gateway that you created before you began, and routes to the httpbin service.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: networking.gloo.solo.io/v2
   kind: RouteTable
   metadata:
     name: httpbin
     namespace: httpbin
     labels:
       expose: "true"
   spec:
     hosts:
       - '*'
     virtualGateways:
       - name: north-south-gw
         namespace: bookinfo
         cluster: cluster-1
     workloadSelectors: []
     http:
       - name: httpbin
         labels:
           oauth: "true"
         matchers:
         - uri:
             exact: /get
         - uri:
             prefix: /callback
         forwardTo:
           destinations:
           - ref:
               name: httpbin
               namespace: httpbin
             port:
               number: 8000
   EOF
   

4. Create an external auth policy that uses Keycloak for OIDC.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: security.policy.gloo.solo.io/v2
   kind: ExtAuthPolicy
   metadata:
     name: httpbin
     namespace: httpbin
   spec:
     applyToRoutes:
     - route:
         labels:
           oauth: "true"
     config:
       server:
         name: ext-auth-server
         namespace: httpbin
         cluster: cluster-1
       glooAuth:
         configs:
         - oauth2:
             oidcAuthorizationCode:
               appUrl: https://${INGRESS_GW_HTTPS}
               callbackPath: /callback
               clientId: ${KEYCLOAK_CLIENT}
               clientSecretRef:
                 name: oauth
                 namespace: httpbin
               issuerUrl: "${KEYCLOAK_URL}/realms/master/"
               scopes:
               - email
               session:
                 failOnFetchFailure: true
                 redis:
                   cookieName: keycloak-session
                   options:
                     host: redis:6379
               headers:
                 idTokenHeader: jwt
   EOF
   

Review the following table to understand this configuration. For more information, see the API reference.

Verify the OAuth policy

1. In your web browser, open the path to your application. You are redirected to the authentication page from the Keycloak identity provider.
2. Enter the user credentials from Keycloak, such as the following values from the demo setup.
   • Username: user1
   • Password: password

You are authenticated and returned back to the httpbin home page.