Add guides for common OIDC providers #3917

makkes · 2023-08-04T16:19:35Z

This is a first revision of this guide and likely subject to extension/improvement going forward but it'll definitely help setting up Weave GitOps as an OIDC client properly.

https://staging.docs.gitops.weave.works/oidc-guides/docs/next/guides/oidc/

lasomethingsomething · 2023-11-06T16:38:44Z

What's the status of this?

makkes · 2023-11-06T16:49:18Z

I really want to get this in but haven't found the time to move it to a reviewable state. Will see if I can get it there by end of this week.

lasomethingsomething · 2023-11-06T16:52:29Z

@makkes Got it, thanks much. PTAL at the other draft docs PRs on OIDC and see if you can bring them together into a structure that works. We can also do this together if you'd like.

makkes · 2023-11-14T14:12:05Z

@enekofb @bigkevmcd this is now finally ready for review.

enekofb

Nice one! Some small suggestions added.

🙏 please also share some background on how the suggested configurations were tested / validated.

website/docs/guides/oidc.mdx

enekofb · 2023-11-15T11:11:57Z

adding some more folks for visibility.

website/docs/guides/oidc.mdx

bigkevmcd · 2023-11-15T13:33:05Z

website/docs/guides/oidc.mdx

+       redirectURL: http://YOUR_WEAVE_GITOPS_DOMAIN/oauth2/callback
+       customScopes: openid
+       claimUsername: sub
+   ```


Maybe we want to talk about the groups on Azure?

And recommend that users use roles https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles ?

👍🏻 I will need to set this up one more time to see what specifically is necessary for getting the groups.

Tested this once more and added a step to configure group claims.

Did this get pushed?

customScopes: openid

The funny thing is you don't need to request any other scope if the groups claim is configured. The claim will be pushed nonetheless. 🤷🏻‍♂️ Microsoft doing Microsoft things.

makkes · 2023-11-16T13:09:05Z

🙏 please also share some background on how the suggested configurations were tested / validated.

I validated them all manually. The perfect setup would be for us to add e2e tests to the code base verifying proper OIDC functionality but that's completely out of scope of this PR. I'd be happy to start this afterwards, though.

makkes · 2023-11-16T17:31:23Z

@enekofb @bigkevmcd addressed all your comments. ptal

enekofb

🚀

enekofb · 2023-11-17T16:33:40Z

website/docs/enterprise/getting-started/install-enterprise.mdx

@@ -135,6 +135,8 @@ You may decide to give your engineering teams access to the WGE dashboard so the

 OIDC extends the OAuth2 authorization protocol by including an additional field (ID Token) that contains information (claims) about a user's identity. After a user successfully authenticates with the OIDC provider, Weave GitOps Enterprise uses this information to impersonate the user in any calls to the Kubernetes API. This allows cluster administrators to use RBAC rules to control access to the cluster and the dashboard.

+For more specific examples of how to setup OIDC with Weave GitOps, see [this guide](../../../guides/oidc/).


makkes · 2023-11-20T13:44:25Z

@bigkevmcd do you want to take another look at this? I'd love to merge this today or tomorrow so we can take care of #4113 next.

This is a first revision of this guide and likely subject to extension/improvement going forward but it'll definitely help setting up Weave GitOps as an OIDC client properly. Signed-off-by: Max Jonas Werner <[email protected]>

bigkevmcd · 2023-11-20T13:45:24Z

website/docs/guides/oidc.mdx

+## Google
+
+Google's identity provider does not support the groups scope which Weave GitOps requests by default. That's why in
+this example the `customScopes` field is set to only request the `openid` and `email` scopes.


bigkevmcd · 2023-11-20T13:48:24Z

website/docs/guides/oidc.mdx

+       redirectURL: http://YOUR_WEAVE_GITOPS_DOMAIN/oauth2/callback
+       customScopes: openid
+       claimUsername: sub
+   ```


Did this get pushed?

customScopes: openid

bigkevmcd · 2023-11-20T13:49:37Z

website/docs/guides/oidc.mdx

+1. Log in to the Keycloak admin console and [create a realm](https://www.keycloak.org/docs/latest/server_admin/#configuring-realms).
+1. [Create a client application](https://www.keycloak.org/docs/latest/authorization_services/index.html#_resource_server_create_client)
+   and choose "OpenID Connect" as the client type.
+1. Make sure to set the "Client Authenticator" on the "Credentials" tab to "Client Id and Secret" and generate a secret.


Do we need to say anything about scopes for the client?

Do we need to say anything about groups for this? (realm roles?!)

I basically stopped iterating on this part of the page as soon as #4113 arrived because that PR provides all the nitty-gritty details of using WeGO with Keycloak. So I suppose this part will be overridden soon, anyway.

Gotcha, maybe we can remove this?

And link to the other doc?

Yes, I will as soon as the other doc is merged.

bigkevmcd

I'm ok with these, I suspect we'll need to cover more use-cases.

It'd be unfortunate if we become the gate-keepers for every OIDC config.

foot

Great stuff thanks team!

makkes force-pushed the oidc-guides branch from d2ce15e to 155b133 Compare August 4, 2023 16:35

lasomethingsomething added the user-guide Improvements to docs at https://docs.gitops.weave.works/ label Aug 7, 2023

makkes force-pushed the oidc-guides branch from 155b133 to b7aba06 Compare August 10, 2023 14:09

makkes force-pushed the oidc-guides branch 3 times, most recently from 7d1ccbe to 1758064 Compare November 14, 2023 14:10

makkes marked this pull request as ready for review November 14, 2023 14:10

makkes added the documentation Improvements or additions to documentation label Nov 14, 2023

makkes requested review from bigkevmcd and enekofb November 14, 2023 14:10

makkes mentioned this pull request Nov 14, 2023

Docs: Keycloak OIDC Guide #4113

Merged

enekofb reviewed Nov 15, 2023

View reviewed changes

website/docs/guides/oidc.mdx Outdated Show resolved Hide resolved

website/docs/guides/oidc.mdx Outdated Show resolved Hide resolved

website/docs/guides/oidc.mdx Outdated Show resolved Hide resolved

website/docs/guides/oidc.mdx Show resolved Hide resolved

enekofb requested review from foot, yiannistri and waleedhammam November 15, 2023 11:11

bigkevmcd requested changes Nov 15, 2023

View reviewed changes

makkes force-pushed the oidc-guides branch from 1758064 to 942a023 Compare November 16, 2023 13:07

makkes force-pushed the oidc-guides branch from 942a023 to 9c7b8a1 Compare November 16, 2023 17:30

enekofb approved these changes Nov 17, 2023

View reviewed changes

Add guides for common OIDC providers

cf7cc2b

This is a first revision of this guide and likely subject to extension/improvement going forward but it'll definitely help setting up Weave GitOps as an OIDC client properly. Signed-off-by: Max Jonas Werner <[email protected]>

makkes force-pushed the oidc-guides branch from 9c7b8a1 to cf7cc2b Compare November 20, 2023 13:44

bigkevmcd requested changes Nov 20, 2023

View reviewed changes

bigkevmcd approved these changes Nov 20, 2023

View reviewed changes

foot approved these changes Nov 20, 2023

View reviewed changes

foot merged commit 6b0c193 into main Nov 20, 2023
60 checks passed

foot deleted the oidc-guides branch November 20, 2023 18:24

weave-gitops-bot mentioned this pull request Nov 22, 2023

Updates for 0.37.0 #4145

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add guides for common OIDC providers #3917

Add guides for common OIDC providers #3917

makkes commented Aug 4, 2023 •

edited

Loading

lasomethingsomething commented Nov 6, 2023

makkes commented Nov 6, 2023

lasomethingsomething commented Nov 6, 2023

makkes commented Nov 14, 2023

enekofb left a comment

enekofb commented Nov 15, 2023

bigkevmcd Nov 15, 2023

makkes Nov 16, 2023

makkes Nov 16, 2023

bigkevmcd Nov 20, 2023

makkes Nov 20, 2023

makkes commented Nov 16, 2023

makkes commented Nov 16, 2023 •

edited

Loading

enekofb left a comment

enekofb Nov 17, 2023

makkes commented Nov 20, 2023

bigkevmcd Nov 20, 2023

bigkevmcd Nov 20, 2023

bigkevmcd Nov 20, 2023

makkes Nov 20, 2023

bigkevmcd Nov 20, 2023

bigkevmcd Nov 20, 2023

makkes Nov 20, 2023

bigkevmcd left a comment

foot left a comment

		@@ -135,6 +135,8 @@ You may decide to give your engineering teams access to the WGE dashboard so the

		OIDC extends the OAuth2 authorization protocol by including an additional field (ID Token) that contains information (claims) about a user's identity. After a user successfully authenticates with the OIDC provider, Weave GitOps Enterprise uses this information to impersonate the user in any calls to the Kubernetes API. This allows cluster administrators to use RBAC rules to control access to the cluster and the dashboard.

		For more specific examples of how to setup OIDC with Weave GitOps, see [this guide](../../../guides/oidc/).

Add guides for common OIDC providers #3917

Add guides for common OIDC providers #3917

Conversation

makkes commented Aug 4, 2023 • edited Loading

lasomethingsomething commented Nov 6, 2023

makkes commented Nov 6, 2023

lasomethingsomething commented Nov 6, 2023

makkes commented Nov 14, 2023

enekofb left a comment

Choose a reason for hiding this comment

enekofb commented Nov 15, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

makkes commented Nov 16, 2023

makkes commented Nov 16, 2023 • edited Loading

enekofb left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

makkes commented Nov 20, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bigkevmcd left a comment

Choose a reason for hiding this comment

foot left a comment

Choose a reason for hiding this comment

makkes commented Aug 4, 2023 •

edited

Loading

makkes commented Nov 16, 2023 •

edited

Loading