Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add oidc config parameters #1201

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+47 −0
Open

Add oidc config parameters #1201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3670331
Add oidc config parameters
Jan 9, 2025
e4c1320
Fix optional params to be undef
Jan 9, 2025
974293d
Do not follow keycloak config by default
Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,28 @@
#
# $keycloak_realm:: The realm as passed to keycloak-httpd-client-install
#
# === OIDC parameters:
#
# $authorize_login_delegation:: Authorize login delegation with REMOTE_USER HTTP header (true/false)
#
# $authorize_login_delegation_auth_source_user_autocreate:: Name of the external auth source where unknown externally authentication
# users (see authorize_login_delegation) should be created. Empty means no autocreation.
#
# $login_delegation_logout_url:: Redirect your users to this url on logout (authorize_login_delegation should also be enabled)
#
# $oidc_jwks_url:: OpenID Connect JSON Web Key Set(JWKS) URL.
# Typically https://keycloak.example.com/auth/realms/<realm name>/protocol/openid-connect/certs when using
# Keycloak as an OpenID provider
#
# $oidc_audience:: Name of the OpenID Connect Audience that is being used for Authentication. In case of Keycloak this is the Client ID.
# ['oidc_app_name']
#
# $oidc_issuer:: The iss (issuer) claim identifies the principal that issued the JWT, which exists at a
# `/.well-known/openid-configuration` in case of most of the OpenID providers.
#
# $oidc_algorithm:: The algorithm used to encode the JWT in the OpenID provider.
#
#
class foreman (
Stdlib::HTTPUrl $foreman_url = $foreman::params::foreman_url,
Boolean $unattended = true,
Expand Down Expand Up @@ -307,6 +329,13 @@
Boolean $register_in_foreman = true,
Optional[Stdlib::Absolutepath] $provisioning_ct_location = undef,
Optional[Stdlib::Absolutepath] $provisioning_fcct_location = undef,
Boolean $authorize_login_delegation = false,
String[1] $authorize_login_delegation_auth_source_user_autocreate = 'External',
Optional[String[1]] $login_delegation_logout_url = undef,
Optional[String[1]] $oidc_jwks_url = undef,
Array[String[1]] $oidc_audience = [],
Optional[String[1]] $oidc_issuer = undef,
String[1] $oidc_algorithm = 'RS256',
) inherits foreman::params {
assert_type(Array[Stdlib::IP::Address], $trusted_proxies)

Expand Down
7 changes: 7 additions & 0 deletions spec/classes/foreman_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,13 @@
keycloak_realm: 'myrealm',
provisioning_ct_location: '/usr/bin/myct',
provisioning_fcct_location: '/usr/bin/myfcct',
authorize_login_delegation: true,
authorize_login_delegation_auth_source_user_autocreate: 'External',
login_delegation_logout_url: 'https://foreman.top.com/users/extlogout',
oidc_jwks_url: 'https://keycloak.top.com/realms/myrealm/protocol/openid-connect/certs',
oidc_audience: ['cloack-app'],
oidc_issuer: 'https://keycloak.top.com/realms/myrealm',
oidc_algorithm: 'RS256',
}
end

Expand Down
11 changes: 11 additions & 0 deletions templates/settings.yaml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,17 @@
:oauth_consumer_key: <%= scope.lookupvar("foreman::oauth_consumer_key") %>
:oauth_consumer_secret: <%= scope.lookupvar("foreman::oauth_consumer_secret") %>

<% if scope.lookupvar('foreman::authorize_login_delegation') -%>
# The following values are used for oidc authentication
:authorize_login_delegation: <%= scope.lookupvar("foreman::authorize_login_delegation") %>
:authorize_login_delegation_auth_source_user_autocreate: <%= scope.lookupvar("foreman::authorize_login_delegation_auth_source_user_autocreate") %>
:login_delegation_logout_url: <%= scope.lookupvar("foreman::login_delegation_logout_url") %>
:oidc_jwks_url: <%= scope.lookupvar("foreman::oidc_jwks_url") %>
:oidc_audience: <%= scope.lookupvar("foreman::oidc_audience") %>
:oidc_issuer: <%= scope.lookupvar("foreman::oidc_issuer") %>
:oidc_algorithm: <%= scope.lookupvar("foreman::oidc_algorithm") %>

<% end -%>
Comment on lines +13 to +23
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer to have this as a separate fragment. Possibly reuse the existing one: https://github.com/theforeman/puppet-foreman/blob/master/templates/settings-external-auth.yaml.erb

# Websockets
:websockets_encrypt: <%= scope.lookupvar("foreman::websockets_encrypt") %>
:websockets_ssl_key: <%= @websockets_ssl_key %>
Expand Down