Keycloak - Revision history

K95ma: fix

2025-09-16T01:20:31Z

fix

← Older revision		Revision as of 20:20, 15 September 2025
Line 1:		Line 1:
	We are using [https://www.keycloak.org/ Keycloak] for web SSO (Single Sign-On). Clients may use Keycloak for authenticating users via SAML or OIDC (OpenID Connect).		We are using [https://www.keycloak.org/ Keycloak] for web SSO (Single Sign-On). Clients may use Keycloak for authenticating users via SAML or OIDC (OpenID Connect).

	* Admin login: https://keycloak.csclub.uwaterloo.ca~~/auth~~/admin		* Admin login: https://keycloak.csclub.uwaterloo.ca/admin
	* Regular user login: https://keycloak.csclub.uwaterloo.ca~~/auth~~/realms/csc/account		* Regular user login: https://keycloak.csclub.uwaterloo.ca/realms/csc/account
	* OIDC Auto Discovery URL: https://keycloak.csclub.uwaterloo.ca~~/auth~~/realms/csc/.well-known/openid-configuration		* OIDC Auto Discovery URL: https://keycloak.csclub.uwaterloo.ca/realms/csc/.well-known/openid-configuration

	== Prerequisites ==		== Prerequisites ==

K95ma: /* Testing */ fix

2025-09-16T01:05:24Z

Testing: fix

← Older revision		Revision as of 20:05, 15 September 2025
Line 249:		Line 249:

	== Testing ==		== Testing ==
	Here's a test OIDC application which you can use to verify that everything is working: https://www.keycloak.org/app/#url=https://keycloak.csclub.uwaterloo.ca/~~auth~~&realm=csc&client=test		Here's a test OIDC application which you can use to verify that everything is working: https://www.keycloak.org/app/#url=https://keycloak.csclub.uwaterloo.ca/&realm=csc&client=test

Merenber at 00:14, 31 December 2021

2021-12-31T00:14:36Z

← Older revision		Revision as of 19:14, 30 December 2021
Line 247:		Line 247:

	Keycloak's SP certificate (which can be viewed from Realm Settings -> Keys -> Providers -> rsa-generated) will expire in <b>December 2031</b>; before then, make sure you upload a new keypair (just choose 'rsa-generated' from the 'Add keystore' dropdown), then restart the saml-passthrough service on caffeine.		Keycloak's SP certificate (which can be viewed from Realm Settings -> Keys -> Providers -> rsa-generated) will expire in <b>December 2031</b>; before then, make sure you upload a new keypair (just choose 'rsa-generated' from the 'Add keystore' dropdown), then restart the saml-passthrough service on caffeine.

			== Testing ==
			Here's a test OIDC application which you can use to verify that everything is working: https://www.keycloak.org/app/#url=https://keycloak.csclub.uwaterloo.ca/auth&realm=csc&client=test

Merenber: /* User Federation */

2021-12-30T23:59:31Z

User Federation

← Older revision		Revision as of 18:59, 30 December 2021
Line 201:		Line 201:
	* Connection URL: ldaps://ldap1.csclub.uwaterloo.ca ldaps://ldap2.csclub.uwaterloo.ca		* Connection URL: ldaps://ldap1.csclub.uwaterloo.ca ldaps://ldap2.csclub.uwaterloo.ca
	* Users DN: ou=People,dc=csclub,dc=uwaterloo,dc=ca		* Users DN: ou=People,dc=csclub,dc=uwaterloo,dc=ca
			* Custom User LDAP Filter: (objectClass=member)
	* Search Scope: One Level		* Search Scope: One Level
	* Bind Type: none		* Bind Type: none

	Under Sync Settings, enable ~~Periodic~~ Full Sync. Set the ~~Full~~ Sync Period to something reasonable (should be at least once a day).		Under Sync Settings, enable Changed Users Full Sync. Set the Changed Users Sync Period to something reasonable (should be at least once a day).

	Click on Mappers, click 'email', and set the LDAP Attribute to 'mailLocalAddress'. Also set the LDAP Attribute for 'First Name' to 'givenName'.		Click on Mappers, click 'email', and set the LDAP Attribute to 'mailLocalAddress'. Also set the LDAP Attribute for 'First Name' to 'givenName'.

Merenber: /* SAML Passthrough */

2021-12-29T16:42:55Z

SAML Passthrough

← Older revision		Revision as of 11:42, 29 December 2021
Line 239:		Line 239:
	* Validating X509 certificates: download the content of https://csclub.uwaterloo.ca/keycloak/saml/metadata and copy and paste the value inside the <code><X509Certificate></code> tag.		* Validating X509 certificates: download the content of https://csclub.uwaterloo.ca/keycloak/saml/metadata and copy and paste the value inside the <code><X509Certificate></code> tag.

	That X509 certificate will expire in January 2032; <b>before then, make sure you do the following~~</b>~~:		That X509 certificate will expire in <b>January 2032</b>; before then, make sure you do the following:

	* create a new keypair in /srv/saml-passthrough on caffeine		* create a new keypair in /srv/saml-passthrough on caffeine

Merenber: /* SAML Passthrough */

2021-12-29T16:42:25Z

SAML Passthrough

← Older revision		Revision as of 11:42, 29 December 2021
Line 245:		Line 245:
	* update the 'Validating X509 certificates' field in Keycloak		* update the 'Validating X509 certificates' field in Keycloak

	Keycloak's SP certificate (which can be viewed from Realm Settings -> Keys -> Providers -> rsa-generated) will ~~also~~ expire ~~around the~~ ~~same~~ ~~time~~; before then, make sure you upload a new keypair (just choose 'rsa-generated' from the 'Add keystore' dropdown), then restart the saml-passthrough service on caffeine.		Keycloak's SP certificate (which can be viewed from Realm Settings -> Keys -> Providers -> rsa-generated) will expire in <b>December 2031</b>; before then, make sure you upload a new keypair (just choose 'rsa-generated' from the 'Add keystore' dropdown), then restart the saml-passthrough service on caffeine.

Merenber: /* SAML Passthrough */

2021-12-29T16:13:30Z

SAML Passthrough

← Older revision		Revision as of 11:13, 29 December 2021
Line 216:		Line 216:

	==== SAML Passthrough ====		==== SAML Passthrough ====
	I created a monstrosity called [[https://git.csclub.uwaterloo.ca/merenber/saml-passthrough saml-passthrough]]. The idea is to protect a SAML IdP <i>behind another SAML IdP</i> (ADFS). So basically SAML-inside-SAML.		I created a monstrosity called [https://git.csclub.uwaterloo.ca/merenber/saml-passthrough saml-passthrough]. The idea is to protect a SAML IdP <i>behind another SAML IdP</i> (ADFS). So basically SAML-inside-SAML.

	The reason why we need this is because we can't change the AssertionConsumerService endpoint URL which we originally submitted to IST (if we really wanted to, we could submit another form, but that requires assistance from a faculty member, and it's just a big PiTA). This also allows us to <i>multiplex</i> ADFS information to multiple Keycloak realms, if necessary.		The reason why we need this is because we can't change the AssertionConsumerService endpoint URL which we originally submitted to IST (if we really wanted to, we could submit another form, but that requires assistance from a faculty member, and it's just a big PiTA). This also allows us to <i>multiplex</i> ADFS information to multiple Keycloak realms, if necessary.
Line 244:		Line 244:
	* restart the saml-passthrough service		* restart the saml-passthrough service
	* update the 'Validating X509 certificates' field in Keycloak		* update the 'Validating X509 certificates' field in Keycloak

			Keycloak's SP certificate (which can be viewed from Realm Settings -> Keys -> Providers -> rsa-generated) will also expire around the same time; before then, make sure you upload a new keypair (just choose 'rsa-generated' from the 'Add keystore' dropdown), then restart the saml-passthrough service on caffeine.

Merenber at 16:09, 29 December 2021

2021-12-29T16:09:56Z

@@ Line 81: / Line 81: @@
 Now apply the main manifest:
 <pre>
-kubectl apply -f https://git.csclub.uwaterloo.ca/cloud/manifests/src/branch/master/keycloak.yaml
+kubectl apply -f https://git.csclub.uwaterloo.ca/cloud/manifests/raw/branch/master/keycloak.yaml
 </pre>
@@ Line 144: / Line 144: @@
 Click on 'Authentication' from the panel on the left-hand side.
 Click on the 'Flows' tab and select the 'Browser' flow from the dropdown. Create a copy called 'CSC Browser' and make it look like this:
 <pre>
@@ Line 202: / Line 203: @@
 * Search Scope: One Level
 * Bind Type: none

Merenber at 15:47, 29 December 2021

2021-12-29T15:47:23Z

@@ Line 141: / Line 141: @@
 * Enable StartTLS.
-== Authentication Settings ==
+=== Authentication Settings ===
 Click on 'Authentication' from the panel on the left-hand side.
@@ Line 178: / Line 178: @@
 </pre>
 Note that the last step needs to be 'Allow Access'.

Merenber at 14:17, 29 December 2021

2021-12-29T14:17:35Z

← Older revision		Revision as of 09:17, 29 December 2021
Line 141:		Line 141:
	* Enable StartTLS.		* Enable StartTLS.

	## Authentication Settings		== Authentication Settings ==
	Click on 'Authentication' from the panel on the left-hand side.		Click on 'Authentication' from the panel on the left-hand side.