Chapter 2. Configuring Red Hat Single Sign-On for OpenShift 2.1. Using the Red Hat Single Sign-On for OpenShift Image Streams and application templates Red Hat JBoss Middleware for OpenShift images are pulled on demand from the secured Red Hat Registry: registry.redhat.io , which requires authentication. To retrieve content, you will need to log into the registry using the Red Hat account. To consume container images from registry.redhat.io in shared environments such as OpenShift, it is recommended for an administrator to use a Registry Service Account, also referred to as authentication tokens, in place of an individual person's Red Hat Customer Portal credentials. Procedure To create a Registry Service Account, navigate to the Registry Service Account Management Application , and log in if necessary. From the Registry Service Accounts page, click Create Service Account . Provide a name for the Service Account, for example registry.redhat.io-sa . It will be prepended with a fixed, random string. Enter a description for the Service Account, for example Service account to consume container images from registry.redhat.io. . Click Create . After the Service Account was created, click the registry.redhat.io-sa link in the Account name column of the table presented on the Registry Service Accounts page. Finally, click the OpenShift Secret tab, and perform all steps listed on that page. See the Red Hat Container Registry Authentication article for more information. Procedure Ensure that you are logged in as a cluster administrator or a user with project administrator access to the global openshift project: Choose a command based on your version of OpenShift Container Platform. If you are running an OpenShift Container Platform v3 based cluster instance on (some) of your master host(s), perform the following: USD oc login -u system:admin If you are running an OpenShift Container Platform v4 based cluster instance, log in to the CLI as the kubeadmin user: USD oc login -u kubeadmin -p password https://openshift.example.com:6443 Run the following commands to update the core set of Red Hat Single Sign-On 7.6.11 resources for OpenShift in the openshift project. If you are using an OpenShift 3.x cluster, use these commands: USD for resource in sso76-image-stream.json \ passthrough/ocp-3.x/sso76-ocp3-https.json \ passthrough/ocp-3.x/sso76-ocp3-postgresql.json \ passthrough/ocp-3.x/sso76-ocp3-postgresql-persistent.json \ reencrypt/ocp-3.x/sso76-ocp3-x509-https.json \ reencrypt/ocp-3.x/sso76-ocp3-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done If you are using an OpenShift 4.x cluster, use these commands: USD for resource in sso76-image-stream.json \ passthrough/ocp-4.x/sso76-ocp4-https.json \ passthrough/ocp-4.x/sso76-ocp4-postgresql.json \ passthrough/ocp-4.x/sso76-ocp4-postgresql-persistent.json \ reencrypt/ocp-4.x/sso76-ocp4-x509-https.json \ reencrypt/ocp-4.x/sso76-ocp4-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done Run the following command to install the Red Hat Single Sign-On 7.6.11 OpenShift image streams in the openshift project: USD oc -n openshift import-image rh-sso-7/sso76-openshift-rhel8:7.6 --from=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8:7.6 --confirm 2.2. Deploying the Red Hat Single Sign-On Image 2.2.1. Preparing for the deployment Procedure Log in to the OpenShift CLI with a user that holds the cluster:admin role. Create a new project: USD oc new-project sso-app-demo Add the view role to the default service account. This enables the service account to view all the resources in the sso-app-demo namespace, which is necessary for managing the cluster. USD oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default 2.2.2. Deploying the Red Hat Single Sign-On Image using the application template You can deploy the template using one of these interfaces: OpenShift CLI OpenShift 3.x web console OpenShift 4.x web console 2.2.2.1. Deploying the Template using OpenShift CLI Prerequisites Perform the steps described in Using the Red Hat Single Sign-On for OpenShift Image Streams and application templates . Procedure List the available Red Hat Single Sign-On application templates: USD oc get templates -n openshift -o name | grep -o 'sso76.\+' | sort sso76-ocp3-https sso76-ocp3-postgresql sso76-ocp3-postgresql-persistent sso76-ocp3-x509-https sso76-ocp3-x509-postgresql-persistent sso76-ocp4-https sso76-ocp4-postgresql sso76-ocp4-postgresql-persistent sso76-ocp4-x509-https sso76-ocp4-x509-postgresql-persistent Deploy the selected one: USD oc new-app --template=sso76-ocp4-x509-https --> Deploying template "openshift/sso76-ocp4-x509-https" to project sso-app-demo Red Hat Single Sign-On 7.6 (Ephemeral) --------- An example Red Hat Single Sign-On 7 application. For more information about using this template, see <link xlink:href="https://github.com/jboss-openshift/application-templates">https://github.com/jboss-openshift/application-templates</link>. A new Red Hat Single Sign-On service has been created in your project. The admin username/password for accessing the master realm using the Red Hat Single Sign-On console is IACfQO8v/nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc. The HTTPS keystore used for serving secure content, the JGroups keystore used for securing JGroups communications, and server truststore used for securing Red Hat Single Sign-On requests were automatically created using OpenShift's service serving x509 certificate secrets. * With parameters: * Application Name=sso * JGroups Cluster Password=jg0Rssom0gmHBnooDF3Ww7V4Mu5RymmB # generated * Datasource Minimum Pool Size= * Datasource Maximum Pool Size= * Datasource Transaction Isolation= * ImageStream Namespace=openshift * Red Hat Single Sign-On Administrator Username=IACfQO8v # generated * Red Hat Single Sign-On Administrator Password=nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc # generated * Red Hat Single Sign-On Realm= * Red Hat Single Sign-On Service Username= * Red Hat Single Sign-On Service Password= * Container Memory Limit=1Gi --> Creating resources ... service "sso" created service "secure-sso" created service "sso-ping" created route "sso" created route "secure-sso" created deploymentconfig "sso" created --> Success Run 'oc status' to view your app. 2.2.2.2. Deploying the Template using the OpenShift 3.x Web Console Prerequisites Perform the steps described in Using the Red Hat Single Sign-On for OpenShift Image Streams and application templates . Procedure Log in to the OpenShift web console and select the sso-app-demo project space. Click Add to Project , then Browse Catalog to list the default image streams and templates. Use the Filter by Keyword search bar to limit the list to those that match sso . You may need to click Middleware , then Integration to show the desired application template. Select an Red Hat Single Sign-On application template. This example uses Red Hat Single Sign-On 7.6 (Ephemeral) . Click in the Information step. From the Add to Project drop-down menu, select the sso-app-demo project space. Then click . Select Do not bind at this time radio button in the Binding step. Click Create to continue. In the Results step, click the Continue to the project overview link to verify the status of the deployment. 2.2.2.3. Deploying the Template using the OpenShift 4.x Web Console Prerequisites Perform the steps described in Using the Red Hat Single Sign-On for OpenShift Image Streams and application templates . Procedure Log in to the OpenShift web console and select the sso-app-demo project space. On the left sidebar, click the Administrator tab and then click </> Developer . Click From Catalog . Search for sso . Choose a template such as Red Hat Single Sign-On 7.6 on OpenJDK (Ephemeral) . Click Instantiate Template . Adjust the template parameters if necessary and click Create . Verify the Red Hat Single Sign-On for OpenShift image was deployed. 2.3. Accessing the Administrator Console of the Red Hat Single Sign-On Pod Procedure After the template is deployed, identify the available routes. USD oc get routes NAME HOST/PORT sso sso-sso-app-demo.openshift.example.com Access the Red Hat Single Sign-On Admin Console. https://sso-sso-app-demo.openshift.example.com/auth/admin Provide the login credentials for the administrator account .

Commands:
oc login -u system:admin
oc login -u kubeadmin -p password https://openshift.example.com:6443
for resource in sso76-image-stream.json passthrough/ocp-3.x/sso76-ocp3-https.json passthrough/ocp-3.x/sso76-ocp3-postgresql.json passthrough/ocp-3.x/sso76-ocp3-postgresql-persistent.json reencrypt/ocp-3.x/sso76-ocp3-x509-https.json reencrypt/ocp-3.x/sso76-ocp3-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
for resource in sso76-image-stream.json passthrough/ocp-4.x/sso76-ocp4-https.json passthrough/ocp-4.x/sso76-ocp4-postgresql.json passthrough/ocp-4.x/sso76-ocp4-postgresql-persistent.json reencrypt/ocp-4.x/sso76-ocp4-x509-https.json reencrypt/ocp-4.x/sso76-ocp4-x509-postgresql-persistent.json do oc replace -n openshift --force -f https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso76-dev/templates/USD{resource} done
oc -n openshift import-image rh-sso-7/sso76-openshift-rhel8:7.6 --from=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8:7.6 --confirm
oc new-project sso-app-demo
oc policy add-role-to-user view system:serviceaccount:USD(oc project -q):default
oc get templates -n openshift -o name | grep -o 'sso76.\+' | sort sso76-ocp3-https sso76-ocp3-postgresql sso76-ocp3-postgresql-persistent sso76-ocp3-x509-https sso76-ocp3-x509-postgresql-persistent sso76-ocp4-https sso76-ocp4-postgresql sso76-ocp4-postgresql-persistent sso76-ocp4-x509-https sso76-ocp4-x509-postgresql-persistent
oc new-app --template=sso76-ocp4-x509-https --> Deploying template "openshift/sso76-ocp4-x509-https" to project sso-app-demo Red Hat Single Sign-On 7.6 (Ephemeral) --------- An example Red Hat Single Sign-On 7 application. For more information about using this template, see <link xlink:href="https://github.com/jboss-openshift/application-templates">https://github.com/jboss-openshift/application-templates</link>. A new Red Hat Single Sign-On service has been created in your project. The admin username/password for accessing the master realm using the Red Hat Single Sign-On console is IACfQO8v/nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc. The HTTPS keystore used for serving secure content, the JGroups keystore used for securing JGroups communications, and server truststore used for securing Red Hat Single Sign-On requests were automatically created using OpenShift's service serving x509 certificate secrets. * With parameters: * Application Name=sso * JGroups Cluster Password=jg0Rssom0gmHBnooDF3Ww7V4Mu5RymmB # generated * Datasource Minimum Pool Size= * Datasource Maximum Pool Size= * Datasource Transaction Isolation= * ImageStream Namespace=openshift * Red Hat Single Sign-On Administrator Username=IACfQO8v # generated * Red Hat Single Sign-On Administrator Password=nR7llVSVb4Dye3TNRbXoXhRpAKTmiCRc # generated * Red Hat Single Sign-On Realm= * Red Hat Single Sign-On Service Username= * Red Hat Single Sign-On Service Password= * Container Memory Limit=1Gi --> Creating resources service "sso" created service "secure-sso" created service "sso-ping" created route "sso" created route "secure-sso" created deploymentconfig "sso" created --> Success Run 'oc status' to view your app.
oc get routes NAME HOST/PORT sso sso-sso-app-demo.openshift.example.com
https://sso-sso-app-demo.openshift.example.com/auth/admin