Red Hat Single Sign-On for OpenShift Red Hat Single Sign-On 7.6 For Use with Red Hat Single Sign-On 7.6 Red Hat Customer Content Services

Commands:
oc login -u system:admin
oc login -u kubeadmin -p password https://openshift.example.com:6443
for resource in sso76-image-stream.json passthrough/ocp-3.x/sso76-ocp3-https.json passthrough/ocp-3.x/sso76-ocp3-postgresql.json passthrough/ocp-3.x/sso76-ocp3-postgresql-persistent.json reencrypt/ocp-3.x/sso76-ocp3-x509-https.json reencrypt/ocp-3.x/sso76-ocp3-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
for resource in sso76-image-stream.json passthrough/ocp-4.x/sso76-ocp4-https.json passthrough/ocp-4.x/sso76-ocp4-postgresql.json passthrough/ocp-4.x/sso76-ocp4-postgresql-persistent.json reencrypt/ocp-4.x/sso76-ocp4-x509-https.json reencrypt/ocp-4.x/sso76-ocp4-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
oc -n openshift import-image rh-sso-7/sso76-openshift-rhel8:7.6 --from=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8:7.6 --confirm
oc new-project sso-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
oc get templates -n openshift -o name | grep -o 'sso76.\+' | sort sso76-ocp3-https sso76-ocp3-postgresql sso76-ocp3-postgresql-persistent sso76-ocp3-x509-https sso76-ocp3-x509-postgresql-persistent sso76-ocp4-https sso76-ocp4-postgresql sso76-ocp4-postgresql-persistent sso76-ocp4-x509-https sso76-ocp4-x509-postgresql-persistent
oc new-app --template=sso76-ocp4-x509-https --> Deploying template "openshift/sso76-ocp4-x509-https" to project sso-app-demo Red Hat Single Sign-On 7.6 (Ephemeral) --------- An example Red Hat Single Sign-On 7 application. For more information about using this template, see <link xlink:href="https://github.com/jboss-openshift/application-templates">https://github.com/jboss-openshift/application-templates</link>. A new Red Hat Single Sign-On service has been created in your project. The admin username/password for accessing the master realm using the Red Hat Single Sign-On console is IACfQO8v/nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc. The HTTPS keystore used for serving secure content, the JGroups keystore used for securing JGroups communications, and server truststore used for securing Red Hat Single Sign-On requests were automatically created using OpenShift's service serving x509 certificate secrets. * With parameters: * Application Name=sso * JGroups Cluster Password=jg0Rssom0gmHBnooDF3Ww7V4Mu5RymmB # generated * Datasource Minimum Pool Size= * Datasource Maximum Pool Size= * Datasource Transaction Isolation= * ImageStream Namespace=openshift * Red Hat Single Sign-On Administrator Username=IACfQO8v # generated * Red Hat Single Sign-On Administrator Password=nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc # generated * Red Hat Single Sign-On Realm= * Red Hat Single Sign-On Service Username= * Red Hat Single Sign-On Service Password= * Container Memory Limit=1Gi --> Creating resources service "sso" created service "secure-sso" created service "sso-ping" created route "sso" created route "secure-sso" created deploymentconfig "sso" created --> Success Run 'oc status' to view your app.
oc get routes NAME HOST/PORT sso sso-sso-app-demo.openshift.example.com
https://sso-sso-app-demo.openshift.example.com/auth/admin
oc new-project sso-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
openssl req -new -newkey rsa:4096 -x509 -keyout xpaas.key -out xpaas.crt -days 365 -subj "/CN=xpaas-sso-demo.ca"
keytool -genkeypair -keyalg RSA -keysize 2048 -dname "CN=secure-sso-sso-app-demo.openshift.example.com" -alias jboss -keystore keystore.jks
keytool -certreq -keyalg rsa -alias jboss -keystore keystore.jks -file sso.csr
openssl x509 -req -extfile <(printf "subjectAltName=DNS:secure-sso-sso-app-demo.openshift.example.com") -CA xpaas.crt -CAkey xpaas.key -in sso.csr -out sso.crt -days 365 -CAcreateserial
keytool -import -file xpaas.crt -alias xpaas.ca -keystore keystore.jks
keytool -import -file sso.crt -alias jboss -keystore keystore.jks
keytool -genseckey -alias secret-key -storetype JCEKS -keystore jgroups.jceks
keytool -import -file xpaas.crt -alias xpaas.ca -keystore truststore.jks
oc create secret generic sso-app-secret --from-file=keystore.jks --from-file=jgroups.jceks --from-file=truststore.jks
oc secrets link default sso-app-secret
keytool -v -list -keystore keystore.jks | grep Alias Enter keystore password: mykeystorepass Alias name: xpaas.ca Alias name: jboss
keytool -v -list -keystore jgroups.jceks -storetype jceks | grep Alias Enter keystore password: password Alias name: secret-key
oc new-app --template=sso76-ocp4-https -p HTTPS_SECRET="sso-app-secret" -p HTTPS_KEYSTORE="keystore.jks" -p HTTPS_NAME="jboss" -p HTTPS_PASSWORD="mykeystorepass" -p JGROUPS_ENCRYPT_SECRET="sso-app-secret" -p JGROUPS_ENCRYPT_KEYSTORE="jgroups.jceks" -p JGROUPS_ENCRYPT_NAME="secret-key" -p JGROUPS_ENCRYPT_PASSWORD="password" -p SSO_ADMIN_USERNAME="admin" -p SSO_ADMIN_PASSWORD="redhat" -p SSO_REALM="demorealm" -p SSO_TRUSTSTORE="truststore.jks" -p SSO_TRUSTSTORE_PASSWORD="mykeystorepass" -p SSO_TRUSTSTORE_SECRET="sso-app-secret" --> Deploying template "openshift/sso76-ocp4-https" to project sso-app-demo Red Hat Single Sign-On 7.6.11 (Ephemeral with passthrough TLS) --------- An example Red Hat Single Sign-On 7 application. For more information about using this template, see https://github.com/jboss-openshift/application-templates. A new Red Hat Single Sign-On service has been created in your project. The admin username/password for accessing the master realm via the Red Hat Single Sign-On console is admin/redhat. Please be sure to create the following secrets: "sso-app-secret" containing the keystore.jks file used for serving secure content; "sso-app-secret" containing the jgroups.jceks file used for securing JGroups communications; "sso-app-secret" containing the truststore.jks file used for securing Red Hat Single Sign-On requests. * With parameters: * Application Name=sso * Custom http Route Hostname= * Custom https Route Hostname= * Server Keystore Secret Name=sso-app-secret * Server Keystore Filename=keystore.jks * Server Keystore Type= * Server Certificate Name=jboss * Server Keystore Password=mykeystorepass * Datasource Minimum Pool Size= * Datasource Maximum Pool Size= * Datasource Transaction Isolation= * JGroups Secret Name=sso-app-secret * JGroups Keystore Filename=jgroups.jceks * JGroups Certificate Name=secret-key * JGroups Keystore Password=password * JGroups Cluster Password=yeSppLfp # generated * ImageStream Namespace=openshift * Red Hat Single Sign-On Administrator Username=admin * Red Hat Single Sign-On Administrator Password=redhat * Red Hat Single Sign-On Realm=demorealm * Red Hat Single Sign-On Service Username= * Red Hat Single Sign-On Service Password= * Red Hat Single Sign-On Trust Store=truststore.jks * Red Hat Single Sign-On Trust Store Password=mykeystorepass * Red Hat Single Sign-On Trust Store Secret=sso-app-secret * Container Memory Limit=1Gi --> Creating resources service "sso" created service "secure-sso" created service "sso-ping" created route "sso" created route "secure-sso" created deploymentconfig "sso" created --> Success Run 'oc status' to view your app.
oc new-app --template=sso76-ocp4-x509-https -p SSO_HOSTNAME="rh-sso-server.openshift.example.com"
oc get routes NAME HOST/PORT sso sso-sso-app-demo.openshift.example.com
oc patch route/sso --type=json -p '[{"op": "replace", "path": "/spec/host", "value": "rh-sso-server.openshift.example.com"}]'
route "sso" patched
kind: Service apiVersion: v1 spec: clusterIP: None ipFamilyPolicy: SingleStack ports: - name: ping port: 8888 publishNotReadyAddresses: true selector: deploymentConfig: sso metadata: name: sso-ping annotations: description: "The JGroups ping port for clustering."
host -t SRV "USD{OPENSHIFT_DNS_PING_SERVICE_NAME}" sso-ping.dual-stack-demo.svc.cluster.local has SRV record 0 50 8888 10-128-0-239.sso-ping.dual-stack-demo.svc.cluster.local. sso-ping.dual-stack-demo.svc.cluster.local has SRV record 0 50 8888 fd01-0-0-1--b8.sso-ping.dual-stack-demo.svc.cluster.local.
kind: Service apiVersion: v1 spec: clusterIP: None ipFamilyPolicy: PreferDualStack ports: - name: ping port: 8888 publishNotReadyAddresses: true selector: deploymentConfig: sso metadata: name: sso-ping annotations: description: "The JGroups ping port for clustering."
policy add-role-to-user view system:serviceaccount:myproject:default -n myproject
policy add-role-to-user view system:serviceaccount:myproject:sso-service-account -n myproject
FROM rh-sso-7/sso76-openshift-rhel8:latest COPY sso-extensions.cli /opt/eap/extensions/ COPY mariadb-java-client-2.5.4.jar /opt/eap/extensions/jdbc-driver.jar
batch set DB_DRIVER_NAME= mariadb set DB_USERNAME= username set DB_PASSWORD= password set DB_DRIVER= org.mariadb.jdbc.Driver set DB_XA_DRIVER= org.mariadb.jdbc.MariaDbDataSource set DB_JDBC_URL= jdbc:mariadb://jdbc-host/keycloak set DB_EAP_MODULE= org.mariadb set FILE=/opt/eap/extensions/jdbc-driver.jar module add --name=USDDB_EAP_MODULE --resources=USDFILE --dependencies=javax.api,javax.resource.api /subsystem=datasources/jdbc-driver=USDDB_DRIVER_NAME:add( driver-name=USDDB_DRIVER_NAME, driver-module-name=USDDB_EAP_MODULE, driver-class-name=USDDB_DRIVER, driver-xa-datasource-class-name=USDDB_XA_DRIVER ) /subsystem=datasources/data-source=KeycloakDS:remove() /subsystem=datasources/data-source=KeycloakDS:add( jndi-name=java:jboss/datasources/KeycloakDS, enabled=true, use-java-context=true, connection-url=USDDB_JDBC_URL, driver-name=USDDB_DRIVER_NAME, user-name=USDDB_USERNAME, password=USDDB_PASSWORD ) run-batch
podman build -t docker-registry-default/project/name:tag .
oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso76-openshift-rhel8-image-with-custom-jdbc-driver:latest"}]' "sso" patched
oc get dc -o name deploymentconfig/sso deploymentconfig/sso-postgresql
oc set env dc/sso -e SSO_ADMIN_USERNAME="" -e SSO_ADMIN_PASSWORD=""
oc get pods NAME READY STATUS RESTARTS AGE sso-12-pt93n 1/1 Running 0 1m sso-postgresql-6-d97pf 1/1 Running 0 2m
oc rsh sso-12-pt93n sh-4.2USD
sh-4.2USD cd /opt/eap/bin/ sh-4.2USD ./add-user-keycloak.sh -r master -u sso_admin -p sso_password Added 'sso_admin' to '/opt/eap/standalone/configuration/keycloak-add-user.json', restart server to load user
sh-4.2USD ./jboss-cli.sh --connect ':reload' { "outcome" => "success", "result" => undefined }
JAVA_OPTS_APPEND="-Dkeycloak.profile=preview"
oc get dc -o name deploymentconfig/sso deploymentconfig/sso-postgresql oc scale --replicas=0 dc sso deploymentconfig "sso" scaled
oc env dc/sso -e "JAVA_OPTS_APPEND=-Dkeycloak.profile=preview"
oc scale --replicas=1 dc sso deploymentconfig "sso" scaled
<login-config> <auth-method>KEYCLOAK</auth-method> </login-config>
"parameters": [ { "displayName": "RH-SSO Vault Secret directory", "description": "Path to the RH-SSO Vault directory.", "name": "SSO_VAULT_DIR", "value": "", "required": false } ] env: [ { "name": "SSO_VAULT_DIR", "value": "USD{SSO_VAULT_DIR}" } ]
oc create secret generic rhsso-vault-secrets --from-literal=master_smtp-password=mySMTPPsswd
oc set volume dc/sso --add --mount-path=USD{SSO_VAULT_DIR} --secret-name=rhsso-vault-secrets
oc adm policy add-role-to-user view < user-name > -n < project-name >
oc rsh <POSTGRE-SQL-POD> pg_dump -C <DATABASE> rhsso_db.bak
oc scale dc/sso --replicas=0
oc edit dc/sso-postgresql
- imageChangeParams: automatic: true containerNames: - sso-postgresql from: kind: ImageStreamTag name: postgresql:13-el8 namespace: openshift
oc rsh dc/sso-postgresql /bin/bash -c "psql --version" psql (PostgreSQL) 13.5
oc set env dc/sso-postgresql POSTGRESQL_UPGRADE-
for resource in sso76-image-stream.json passthrough/ocp-3.x/sso76-ocp3-https.json passthrough/ocp-3.x/sso76-ocp3-postgresql.json passthrough/ocp-3.x/sso76-ocp3-postgresql-persistent.json reencrypt/ocp-3.x/sso76-ocp3-x509-https.json reencrypt/ocp-3.x/sso76-ocp3-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
for resource in sso76-image-stream.json passthrough/ocp-4.x/sso76-ocp4-https.json passthrough/ocp-4.x/sso76-ocp4-postgresql.json passthrough/ocp-4.x/sso76-ocp4-postgresql-persistent.json reencrypt/ocp-4.x/sso76-ocp4-x509-https.json reencrypt/ocp-4.x/sso76-ocp4-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
oc -n openshift import-image rh-sso-7/sso76-openshift-rhel8:7.6 --from=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8:7.6 --confirm
oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso76-openshift-rhel8:7.6"}]' "sso" patched
oc rollout latest dc/sso
oc scale --replicas=1 dc/sso
oc get dc -o name --selector=application=sso deploymentconfig/sso deploymentconfig/sso-postgresql
oc scale --replicas=0 dc/sso deploymentconfig "sso" scaled
oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso76-openshift-rhel8:7.6"}]' "sso" patched
oc rollout latest dc/sso deploymentconfig "sso" rolled out
oc scale --replicas=1 dc/sso deploymentconfig "sso" scaled
oc get pods --selector=application=sso NAME READY STATUS RESTARTS AGE sso-4-vg21r 1/1 Running 0 1h sso-postgresql-1-t871r 1/1 Running 0 2h
oc logs sso-4-vg21r | grep 'Updating' 11:23:45,160 INFO [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider] (ServerService Thread Pool -- 58) Updating database. Using changelog META-INF/jpa-changelog-master.xml
cat job-to-migrate-db-to-sso76.yaml.orig apiVersion: batch/v1 kind: Job metadata: name: job-to-migrate-db-to-sso76 spec: autoSelector: true parallelism: 0 completions: 1 template: metadata: name: job-to-migrate-db-to-sso76 spec: containers: - env: - name: DB_SERVICE_PREFIX_MAPPING value: <<DB_SERVICE_PREFIX_MAPPING_VALUE>> - name: <<PREFIX>>_JNDI value: <<PREFIX_JNDI_VALUE>> - name: <<PREFIX>>_USERNAME value: <<PREFIX_USERNAME_VALUE>> - name: <<PREFIX>>_PASSWORD value: <<PREFIX_PASSWORD_VALUE>> - name: <<PREFIX>>_DATABASE value: <<PREFIX_DATABASE_VALUE>> - name: TX_DATABASE_PREFIX_MAPPING value: <<TX_DATABASE_PREFIX_MAPPING_VALUE>> - name: <<SERVICE_HOST>> value: <<SERVICE_HOST_VALUE>> - name: <<SERVICE_PORT>> value: <<SERVICE_PORT_VALUE>> image: <<SSO_IMAGE_VALUE>> imagePullPolicy: Always name: job-to-migrate-db-to-sso76 # Keep the pod running after the SQL migration # file was generated, so we can retrieve it command: - "/bin/bash" - "-c" - "/opt/eap/bin/openshift-launch.sh || sleep 600" restartPolicy: Never
cp job-to-migrate-db-to-sso76.yaml.orig job-to-migrate-db-to-sso76.yaml
cat mirror_sso_dc_db_vars.sh #!/bin/bash IMPORTANT: # If the name of the SSO deployment config differs from 'sso' or if the file name of the YAML definition of the migration job is different, update the following two variables SSO_DC_NAME="sso" JOB_MIGRATION_YAML="job-to-migrate-db-to-sso76.yaml" Get existing variables of the USDSSO_DC_NAME deployment config in an array declare -a SSO_DC_VARS=( USD(oc set env dc/USD{SSO_DC_NAME} --list | sed '/^#/d') ) Get the PREFIX used in the names of environment variables PREFIX=USD( grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]+' <<< "USD{SSO_DC_VARS[@]}" ) PREFIX=USD{PREFIX##*=} Substitute: * <<PREFIX>> with actual USDPREFIX value and * <<PREFIX with "<<USDPREFIX" value The order in which these replacements are made is important! sed -i "s#<<PREFIX>>#USD{PREFIX}#g" USD{JOB_MIGRATION_YAML} sed -i "s#<<PREFIX#<<USD{PREFIX}#g" USD{JOB_MIGRATION_YAML} Construct the array of environment variables specific to the datasource declare -a DB_VARS=(JNDI USERNAME PASSWORD DATABASE) Prepend USDPREFIX to each item of the datasource array DB_VARS=( "USD{DB_VARS[@]/#/USD{PREFIX}_}" ) Add DB_SERVICE_PREFIX_MAPPING and TX_DATABASE_PREFIX_MAPPING variables to datasource array DB_VARS=( "USD{DB_VARS[@]}" DB_SERVICE_PREFIX_MAPPING TX_DATABASE_PREFIX_MAPPING ) Construct the SERVICE from DB_SERVICE_PREFIX_MAPPING SERVICE=USD( grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]' <<< "USD{SSO_DC_VARS[@]}" ) SERVICE=USD{SERVICE#*=} SERVICE=USD{SERVICE%=*} SERVICE=USD{SERVICE^^} SERVICE=USD{SERVICE//-/_} If the deployment config contains <<SERVICE>>_SERVICE_HOST and <<SERVICE>>_SERVICE_PORT variables, add them to the datasource array. Their values also need to be propagated into yaml definition of the migration job. HOST_PATTERN="USD{SERVICE}_SERVICE_HOST=[^ ]" PORT_PATTERN="USD{SERVICE}_SERVICE_PORT=[^ ]" if grep -Pq "USD{HOST_PATTERN}" <<< "USD{SSO_DC_VARS[@]}" && grep -Pq "USD{PORT_PATTERN}" <<< "USD{SSO_DC_VARS[@]}" then DB_VARS=( "USD{DB_VARS[@]}" "USD{SERVICE}_SERVICE_HOST" "USD{SERVICE}_SERVICE_PORT" ) If they are not defined, delete their placeholder rows in yaml definition file (since if not defined they are not expanded which make the yaml definition invalid). else for KEY in "HOST" "PORT" do sed -i "/SERVICE_USD{KEY}/d" USD{JOB_MIGRATION_YAML} done fi Substitute: * <<SERVICE_HOST>> with USD{SERVICE}_SERVICE_HOST and * <<SERVICE_HOST_VALUE>> with <<USD{SERVICE}_SERVICE_HOST_VALUE>> The order in which replacements are made is important! Do this for both "HOST" and "PORT" for KEY in "HOST" "PORT" do PATTERN_1="<<SERVICE_USD{KEY}>>" REPL_1="USD{SERVICE}_SERVICE_USD{KEY}" sed -i "s#USD{PATTERN_1}#USD{REPL_1}#g" USD{JOB_MIGRATION_YAML} PATTERN_2="<<SERVICE_USD{KEY}_VALUE>>" REPL_2="<<USD{SERVICE}_SERVICE_USD{KEY}_VALUE>>" sed -i "s#USD{PATTERN_2}#USD{REPL_2}#g" USD{JOB_MIGRATION_YAML} done Propagate the values of the datasource array items into yaml definition of the migration job for VAR in "USD{SSO_DC_VARS[@]}" do IFS=USD'=' read KEY VALUE <<< USDVAR if grep -q USDKEY <<< USD{DB_VARS[@]} then KEY+="_VALUE" # Enwrap integer port value with double quotes if [[ USD{KEY} =~ USD{SERVICE}_SERVICE_PORT_VALUE ]] then sed -i "s#<<USD{KEY}>>#\"USD{VALUE}\"#g" USD{JOB_MIGRATION_YAML} # Character values do not need quotes else sed -i "s#<<USD{KEY}>>#USD{VALUE}#g" USD{JOB_MIGRATION_YAML} fi # Verify that the value has been successfully propagated. if grep -q '(JNDI|USERNAME|PASSWORD|DATABASE)' <<< "USD{KEY}" && grep -q "<<PREFIXUSD{KEY#USD{PREFIX}}" USD{JOB_MIGRATION_YAML} || grep -q "<<USD{KEY}>>" USD{JOB_MIGRATION_YAML} then echo "Failed to update value of USD{KEY%_VALUE}! Aborting." exit 1 else printf '%-60s%-40s\n' "Successfully updated USD{KEY%_VALUE} to:" "USDVALUE" fi fi done
chmod +x ./mirror_sso_dc_db_vars.sh ./mirror_sso_dc_db_vars.sh Successfully updated DB_SERVICE_PREFIX_MAPPING to: sso-postgresql=DB Successfully updated DB_JNDI to: java:jboss/datasources/KeycloakDS Successfully updated DB_USERNAME to: userxOp Successfully updated DB_PASSWORD to: tsWNhQHK Successfully updated DB_DATABASE to: root Successfully updated TX_DATABASE_PREFIX_MAPPING to: sso-postgresql=DB
oc get is -n openshift | grep sso76 | cut -d ' ' -f1 sso76-openshift-rhel8
oc new-build sso76-openshift-rhel8:7.6~https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 --context-dir=sso-manual-db-migration --name=sso76-db-migration-image --> Found image bf45ac2 (7 days old) in image stream "openshift/sso76-openshift-rhel8" under tag "7.6" for "sso76-openshift-rhel8:7.6" Red Hat SSO 7.6.11 --------------- Platform for running Red Hat SSO Tags: sso, sso7, keycloak * A source build using source code from https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 will be created * The resulting image will be pushed to image stream "sso76-db-migration-image:latest" * Use 'start-build' to trigger a new build --> Creating resources with label build=sso76-db-migration-image imagestream "sso76-db-migration-image" created buildconfig "sso76-db-migration-image" created --> Success Build configuration "sso76-db-migration-image" created and build triggered. Run 'oc logs -f bc/sso76-db-migration-image' to stream the build progress.
oc logs -f bc/sso76-db-migration-image --follow Cloning "https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500" Push successful
PULL_REF=USD(oc get istag -n USD(oc project -q) --no-headers | grep sso76-db-migration-image | tr -s ' ' | cut -d ' ' -f 2)
sed -i "s#<<SSO_IMAGE_VALUE>>#USDPULL_REF#g" job-to-migrate-db-to-sso76.yaml
oc create -f job-to-migrate-db-to-sso76.yaml job "job-to-migrate-db-to-sso76" created
oc get dc -o name --selector=application=sso deploymentconfig/sso deploymentconfig/sso-postgresql
oc scale --replicas=0 dc/sso deploymentconfig "sso" scaled
oc get jobs NAME DESIRED SUCCESSFUL AGE job-to-migrate-db-to-sso76 1 0 3m
oc scale --replicas=1 job/job-to-migrate-db-to-sso76 job "job-to-migrate-db-to-sso76" scaled
oc get pods NAME READY STATUS RESTARTS AGE sso-postgresql-1-n5p16 1/1 Running 1 19h job-to-migrate-db-to-sso76-b87bb 1/1 Running 0 1m sso76-db-migration-image-1-build 0/1 Completed 0 27m
mkdir -p ./db-update oc rsync job-to-migrate-db-to-sso76-b87bb:/opt/eap/keycloak-database-update.sql ./db-update receiving incremental file list keycloak-database-update.sql sent 30 bytes received 29,726 bytes 59,512.00 bytes/sec total size is 29,621 speedup is 1.00
oc rsync --no-perms=true ./db-update/ sso-postgresql-1-n5p16:/tmp sending incremental file list sent 77 bytes received 11 bytes 176.00 bytes/sec total size is 26,333 speedup is 299.24
oc rsh sso-postgresql-1-n5p16 sh-4.2USD
sh-4.2USD alias psql="/opt/rh/rh-postgresql95/root/bin/psql" sh-4.2USD psql --version psql (PostgreSQL) 9.5.4 sh-4.2USD psql -U <PREFIX>_USERNAME -d <PREFIX>_DATABASE -W -f /tmp/keycloak-database-update.sql Password for user <PREFIX>_USERNAME: INSERT 0 1 INSERT 0 1
oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso76-openshift-rhel8:7.6"}]' "sso" patched
oc rollout latest dc/sso deploymentconfig "sso" rolled out
oc scale --replicas=1 dc/sso deploymentconfig "sso" scaled
oc get dc -o name deploymentconfig/sso deploymentconfig/sso-postgresql oc scale --replicas=0 dc sso deploymentconfig "sso" scaled
oc set env dc/sso -e "JAVA_OPTS_APPEND= -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=/tmp/demorealm-export.json"
oc scale --replicas=1 dc sso deploymentconfig "sso" scaled
oc get pods NAME READY STATUS RESTARTS AGE sso-4-ejr0k 1/1 Running 0 27m sso-postgresql-1-ozzl0 1/1 Running 0 4h oc logs sso-4-ejr0k | grep 'Export' 09:24:59,503 INFO [org.keycloak.exportimport.singlefile.SingleFileExportProvider] (ServerService Thread Pool -- 57) Exporting model into file /tmp/demorealm-export.json 09:24:59,998 INFO [org.keycloak.services] (ServerService Thread Pool -- 57) KC-SERVICES0035: Export finished successfully
oc get pods NAME READY STATUS RESTARTS AGE sso-4-ejr0k 1/1 Running 0 2m sso-postgresql-1-ozzl0 1/1 Running 0 4h oc rsync sso-4-ejr0k:/tmp/demorealm-export.json .
identityProviders: - challenge: true login: true name: htpasswd_auth provider: apiVersion: v1 file: /etc/origin/openshift-passwd kind: HTPasswdPasswordIdentityProvider
- name: rh_sso challenge: false login: true mappingMethod: add provider: apiVersion: v1 kind: OpenIDIdentityProvider clientID: openshift-demo clientSecret: 7b0384a2-b832-16c5-9d73-2957842e89h7 ca: xpaas.crt urls: authorize: https://secure-sso-sso-app-demo.openshift32.example.com/auth/realms/OpenShift/protocol/openid-connect/auth token: https://secure-sso-sso-app-demo.openshift32.example.com/auth/realms/OpenShift/protocol/openid-connect/token userInfo: https://secure-sso-sso-app-demo.openshift32.example.com/auth/realms/OpenShift/protocol/openid-connect/userinfo claims: id: - sub preferredUsername: - preferred_username name: - name email: - email
< curl -k https://secure-sso-sso-app-demo.openshift32.example.com/auth/realms/OpenShift/.well-known/openid-configuration | python -m json.tool >
systemctl restart atomic-openshift-master
oc adm policy add-role-to-user view testuser -n sso-app-demo
oc new-project eap-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
keytool -genkeypair -dname "CN=secure-eap-app-eap-app-demo.openshift.example.com" -alias https -storetype JKS -keystore eapkeystore.jks
keytool -genseckey -alias jgroups -storetype JCEKS -keystore eapjgroups.jceks
oc create secret generic eap-ssl-secret --from-file=eapkeystore.jks
oc create secret generic eap-jgroup-secret --from-file=eapjgroups.jceks
oc secrets link default eap-ssl-secret eap-jgroup-secret
git clone https://github.com/keycloak/keycloak-quickstarts.git
cd keycloak-quickstarts/service-jee-jaxrs/
mvn clean package -DskipTests [INFO] Scanning for projects [INFO] [INFO] ------------------------------------------------------------------------ [INFO] Building Keycloak Quickstart: service-jee-jaxrs 3.1.0.Final [INFO] ------------------------------------------------------------------------ [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------ [INFO] Total time: 2.153 s [INFO] Finished at: 2017-06-26T12:06:12+02:00 [INFO] Final Memory: 25M/241M [INFO] ------------------------------------------------------------------------
service-jee-jaxrs]USD cd ../app-jee-jsp/
app-jee-jsp]USD sed -i /\<executions\>/s/^/\<\!--/ pom.xml
app-jee-jsp]USD sed -i '/\(<\/executions>\)/a\-->' pom.xml
app-jee-jsp]USD mvn clean package -DskipTests [INFO] Scanning for projects [INFO] [INFO] ------------------------------------------------------------------------ [INFO] Building Keycloak Quickstart: app-jee-jsp 3.1.0.Final [INFO] ------------------------------------------------------------------------ [INFO] Building war: /tmp/github/keycloak-quickstarts/app-jee-jsp/target/app-jsp.war [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------ [INFO] Total time: 3.018 s [INFO] Finished at: 2017-06-26T12:22:25+02:00 [INFO] Final Memory: 35M/310M [INFO] ------------------------------------------------------------------------
app-jee-jsp]USD ls config pom.xml README.md src target
app-jee-jsp]USD mkdir -p sso-eap7-bin-demo/deployments
app-jee-jsp]USD cp target/app-jsp.war sso-eap7-bin-demo/deployments/
app-jee-jsp]USD cp ../service-jee-jaxrs/target/service.war sso-eap7-bin-demo/deployments/
app-jee-jsp]USD tree sso-eap7-bin-demo/ sso-eap7-bin-demo/ |__ deployments |__ app-jsp.war |__ service.war 1 directory, 2 files
oc get is -n openshift | grep eap | cut -d ' ' -f 1 jboss-eap64-openshift jboss-eap71-openshift
oc new-build --binary=true --image-stream=jboss-eap71-openshift --name=eap-app --> Found image 31895a4 (3 months old) in image stream "openshift/jboss-eap71-openshift" under tag "latest" for "jboss-eap71-openshift" JBoss EAP 7.4 ------------- Platform for building and running Jakarta EE applications on JBoss EAP 7.4 Tags: builder, javaee, eap, eap7 * A source build using binary input will be created * The resulting image will be pushed to image stream "eap-app:latest" * A binary build was created, use 'start-build --from-dir' to trigger a new build --> Creating resources with label build=eap-app imagestream "eap-app" created buildconfig "eap-app" created --> Success
app-jee-jsp]USD oc start-build eap-app --from-dir=./sso-eap7-bin-demo/ --follow Uploading directory "sso-eap7-bin-demo" as binary input for the build build "eap-app-1" started Receiving source from STDIN as archive Copying all war artifacts from /home/jboss/source/. directory into /opt/eap/standalone/deployments for later deployment Copying all ear artifacts from /home/jboss/source/. directory into /opt/eap/standalone/deployments for later deployment Copying all rar artifacts from /home/jboss/source/. directory into /opt/eap/standalone/deployments for later deployment Copying all jar artifacts from /home/jboss/source/. directory into /opt/eap/standalone/deployments for later deployment Copying all war artifacts from /home/jboss/source/deployments directory into /opt/eap/standalone/deployments for later deployment '/home/jboss/source/deployments/app-jsp.war' -> '/opt/eap/standalone/deployments/app-jsp.war' '/home/jboss/source/deployments/service.war' -> '/opt/eap/standalone/deployments/service.war' Copying all ear artifacts from /home/jboss/source/deployments directory into /opt/eap/standalone/deployments for later deployment Copying all rar artifacts from /home/jboss/source/deployments directory into /opt/eap/standalone/deployments for later deployment Copying all jar artifacts from /home/jboss/source/deployments directory into /opt/eap/standalone/deployments for later deployment Pushing image 172.30.82.129:5000/eap-app-demo/eap-app:latest Pushed 6/7 layers, 86% complete Pushed 7/7 layers, 100% complete Push successful
oc new-app eap-app --> Found image 6b13d36 (2 minutes old) in image stream "eap-app-demo/eap-app" under tag "latest" for "eap-app" eap-app-demo/eap-app-1:aa2574d9 ------------------------------- Platform for building and running Jakarta EE applications on JBoss EAP 7.4 Tags: builder, javaee, eap, eap7 * This image will be deployed in deployment config "eap-app" * Ports 8080/tcp, 8443/tcp, 8778/tcp will be load balanced by service "eap-app" * Other containers can access this service through the hostname "eap-app" --> Creating resources deploymentconfig "eap-app" created service "eap-app" created --> Success Run 'oc status' to view your app.
oc get dc -o name deploymentconfig/eap-app
oc scale dc/eap-app --replicas=0 deploymentconfig "eap-app" scaled
oc set env dc/eap-app -e HOSTNAME_HTTP="eap-app-eap-app-demo.openshift.example.com" -e HOSTNAME_HTTPS="secure-eap-app-eap-app-demo.openshift.example.com" -e SSO_DISABLE_SSL_CERTIFICATE_VALIDATION="true" -e SSO_USERNAME="appuser" -e SSO_PASSWORD="apppassword" -e SSO_REALM="demo" -e SSO_URL="https://secure-sso-sso-app-demo.openshift.example.com/auth" -e SSO_PUBLIC_KEY="MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkdhXyKx97oIoO6HwnV/MiX2EHO55Sn+ydsPzbjJevI5F31UvUco9uA8dGl6oM8HrnaWWv+i8PvmlaRMhhl6Xs68vJTEc6d0soP+6A+aExw0coNRp2PDwvzsXVWPvPQg3+iytStxu3Icndx+gC0ZYnxoRqL7rY7zKcQBScGEr78Nw6vZDwfe6d/PQ6W4xVErNytX9KyLFVAE1VvhXALyqEM/EqYGLmpjw5bMGVKRXnhmVo9E88CkFDH8E+aPiApb/gFul1GJOv+G8ySLoR1c8Y3L29F7C81odkVBp2yMm3RVFIGSPTjHqjO/nOtqYIfY4Wyw9mRIoY5SyW7044dZXRwIDAQAB" -e SSO_SECRET="0bb8c399-2501-4fcd-a183-68ac5132868d" deploymentconfig "eap-app" updated
oc set env dc/eap-app -e HTTPS_KEYSTORE_DIR="/etc/eap-secret-volume" -e HTTPS_KEYSTORE="eapkeystore.jks" -e HTTPS_PASSWORD="password" -e JGROUPS_ENCRYPT_SECRET="eap-jgroup-secret" -e JGROUPS_ENCRYPT_KEYSTORE_DIR="/etc/jgroups-encrypt-secret-volume" -e JGROUPS_ENCRYPT_KEYSTORE="eapjgroups.jceks" -e JGROUPS_ENCRYPT_PASSWORD="password" deploymentconfig "eap-app" updated
oc volume dc/eap-app --add --name="eap-keystore-volume" --type=secret --secret-name="eap-ssl-secret" --mount-path="/etc/eap-secret-volume" deploymentconfig "eap-app" updated
oc volume dc/eap-app --add --name="eap-jgroups-keystore-volume" --type=secret --secret-name="eap-jgroup-secret" --mount-path="/etc/jgroups-encrypt-secret-volume" deploymentconfig "eap-app" updated
oc patch dc/eap-app --type=json -p '[{"op": "add", "path": "/spec/template/spec/serviceAccountName", "value": "default"}]' "eap-app" patched
oc scale dc/eap-app --replicas=1 deploymentconfig "eap-app" scaled
oc get svc -o name service/eap-app
oc get route No resources found.
oc expose svc/eap-app route "eap-app" exposed
oc get route NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD eap-app eap-app-eap-app-demo.openshift.example.com eap-app 8080-tcp None
oc new-project eap-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
keytool -genkeypair -alias https -storetype JKS -keystore eapkeystore.jks
keytool -genseckey -alias jgroups -storetype JCEKS -keystore eapjgroups.jceks
oc create secret generic eap-ssl-secret --from-file=eapkeystore.jks oc create secret generic eap-jgroup-secret --from-file=eapjgroups.jceks
oc secrets link default eap-ssl-secret eap-jgroup-secret
oc new-project eap-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
keytool -genkeypair -alias https -storetype JKS -keystore eapkeystore.jks
keytool -genseckey -alias jgroups -storetype JCEKS -keystore eapjgroups.jceks
oc create secret generic eap-ssl-secret --from-file=eapkeystore.jks oc create secret generic eap-jgroup-secret --from-file=eapjgroups.jceks
oc secrets link default eap-ssl-secret eap-jgroup-secret
<Keys> <Key signing="true"> <KeyStore file= "/etc/eap-secret-volume/keystore-saml.jks" password="password"> <PrivateKey alias="sso-saml-demo" password="password"/> <Certificate alias="sso-saml-demo"/> </KeyStore> </Key> </Keys>
<Keys> <Key signing="true"> <KeyStore file="/etc/eap-secret-volume/keystore-saml.jks" password="password"> <Certificate alias="saml-demo"/> </KeyStore> </Key> </Keys>
<login-config> <auth-method>KEYCLOAK-SAML</auth-method> </login-config>
oc get bc -o name buildconfig/sso
oc set env bc/sso -e MAVEN_MIRROR_URL="http://10.0.0.1:8080/repository/internal/" buildconfig "sso" updated
oc set env bc/sso --list buildconfigs sso MAVEN_MIRROR_URL=http://10.0.0.1:8080/repository/internal/