Chapter 6. Using Red Hat Single Sign-On Operator with automation hub Private automation hub uses Red Hat Single Sign-On for authentication. The Red Hat Single Sign-On Operator creates and manages resources. Use this Operator to create custom resources to automate Red Hat Single Sign-On administration in Openshift. When installing Ansible Automation Platform on Virtual Machines (VMs) the installer can automatically install and configure Red Hat Single Sign-On for use with private automation hub. When installing Ansible Automation Platform on Red Hat OpenShift Container Platform you must install Single Sign-On separately. This chapter describes the process to configure Red Hat Single Sign-On and integrate it with private automation hub when Ansible Automation Platform is installed on OpenShift Container Platform. Prerequisites You have access to Red Hat OpenShift Container Platform using an account with operator installation permissions. You have installed the catalog containing the Red Hat Ansible Automation Platform operators. You have installed the Red Hat Single Sign-On Operator. To install the Red Hat Single Sign-On Operator, follow the procedure in Installing Red Hat Single Sign-On using a custom resource in the Red Hat Single Sign-On documentation. 6.1. Creating a Keycloak instance When the Red Hat Single Sign-On Operator is installed you can create a Keycloak instance for use with Ansible Automation Platform. From here you provide an external Postgres or one will be created for you. Procedure Navigate to Operator Installed Operators . Select the rh-sso project. Select the Red Hat Single Sign-On Operator . On the Red Hat Single Sign-On Operator details page select Keycloak . Click Create instance . Click YAML view . The default Keycloak custom resource is as follows: apiVersion: keycloak.org/v1alpha1 kind: Keycloak metadata: name: example-keycloak labels: app: sso namespace: aap spec: externalAccess: enabled: true instances: 1 Click Create When deployment is complete, you can use this credential to login to the administrative console. You can find the credentials for the administrator in the credential-<custom-resource> (example keycloak) secret in the namespace. 6.2. Creating a Keycloak realm for Ansible Automation Platform Create a realm to manage a set of users, credentials, roles, and groups. A user belongs to and logs into a realm. Realms are isolated from one another and can only manage and authenticate the users that they control. Procedure Navigate to Operator Installed Operators . Select the Red Hat Single Sign-On Operator project. Select the Keycloak Realm tab and click Create Keycloak Realm . On the Keycloak Realm form, select YAML view . Edit the YAML file as follows: kind: KeycloakRealm apiVersion: keycloak.org/v1alpha1 metadata: name: ansible-automation-platform-keycloakrealm namespace: rh-sso labels: app: sso realm: ansible-automation-platform spec: realm: id: ansible-automation-platform realm: ansible-automation-platform enabled: true displayName: Ansible Automation Platform instanceSelector: matchLabels: app: sso Field Description metadata.name Set a unique value in metadata for the name of the configuration resource (CR). metadata.namespace Set a unique value in metadata for the name of the configuration resource (CR). metadata.labels.app Set labels to a unique value. This is used when creating the client CR. metadata.labels.realm Set labels to a unique value. This is used when creating the client CR. spec.realm.id Set the realm name and id. These must be the same. spec.realm.realm Set the realm name and id. These must be the same. spec.realm.displayname Set the name to display. Click Create and wait for the process to complete. 6.3. Creating a Keycloak client Keycloak clients authenticate hub users with Red Hat Single Sign-On. When a user authenticates the request goes through the Keycloak client. When Single Sign-On validates or issues the OAuth token, the client provides the response to automation hub and the user can log in. Procedure Navigate to Operator Installed Operators . Select the Red Hat Single Sign-On Operator project. Select the Keycloak Client tab and click Create Keycloak Client . On the Keycloak Realm form, select YAML view . Replace the default YAML file with the following: kind: KeycloakClient apiVersion: keycloak.org/v1alpha1 metadata: name: automation-hub-client-secret labels: app: sso realm: ansible-automation-platform namespace: rh-sso spec: realmSelector: matchLabels: app: sso realm: ansible-automation-platform client: name: Automation Hub clientId: automation-hub secret: <client-secret> 1 clientAuthenticatorType: client-secret description: Client for automation hub attributes: user.info.response.signature.alg: RS256 request.object.signature.alg: RS256 directAccessGrantsEnabled: true publicClient: true protocol: openid-connect standardFlowEnabled: true protocolMappers: - config: access.token.claim: "true" claim.name: "family_name" id.token.claim: "true" jsonType.label: String user.attribute: lastName userinfo.token.claim: "true" consentRequired: false name: family name protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: userinfo.token.claim: "true" user.attribute: email id.token.claim: "true" access.token.claim: "true" claim.name: email jsonType.label: String name: email protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: multivalued: "true" access.token.claim: "true" claim.name: "resource_access.USD{client_id}.roles" jsonType.label: String name: client roles protocol: openid-connect protocolMapper: oidc-usermodel-client-role-mapper consentRequired: false - config: userinfo.token.claim: "true" user.attribute: firstName id.token.claim: "true" access.token.claim: "true" claim.name: given_name jsonType.label: String name: given name protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: id.token.claim: "true" access.token.claim: "true" userinfo.token.claim: "true" name: full name protocol: openid-connect protocolMapper: oidc-full-name-mapper consentRequired: false - config: userinfo.token.claim: "true" user.attribute: username id.token.claim: "true" access.token.claim: "true" claim.name: preferred_username jsonType.label: String name: <username> protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: access.token.claim: "true" claim.name: "group" full.path: "true" id.token.claim: "true" userinfo.token.claim: "true" consentRequired: false name: group protocol: openid-connect protocolMapper: oidc-group-membership-mapper - config: multivalued: 'true' id.token.claim: 'true' access.token.claim: 'true' userinfo.token.claim: 'true' usermodel.clientRoleMapping.clientId: 'automation-hub' claim.name: client_roles jsonType.label: String name: client_roles protocolMapper: oidc-usermodel-client-role-mapper protocol: openid-connect - config: id.token.claim: "true" access.token.claim: "true" included.client.audience: 'automation-hub' protocol: openid-connect name: audience mapper protocolMapper: oidc-audience-mapper roles: - name: "hubadmin" description: "An administrator role for automation hub" 1 Replace this with a unique value. Click Create and wait for the process to complete. When automation hub is deployed, you must update the client with the "Valid Redirect URIs" and "Web Origins" as described in Updating the Red Hat Single Sign-On client Additionally, the client comes pre-configured with token mappers, however, if your authentication provider does not provide group data to Red Hat SSO, then the group mapping must be updated to reflect how that information is passed. This is commonly by user attribute. 6.4. Creating a Keycloak user This procedure creates a Keycloak user, with the hubadmin role, that can log in to automation hub with Super Administration privileges. Procedure Navigate to Operator Installed Operators . Select the Red Hat Single Sign-On Operator project. Select the Keycloak Realm tab and click Create Keycloak User . On the Keycloak User form, select YAML view . Replace the default YAML file with the following: apiVersion: keycloak.org/v1alpha1 kind: KeycloakUser metadata: name: hubadmin-user labels: app: sso realm: ansible-automation-platform namespace: rh-sso spec: realmSelector: matchLabels: app: sso realm: ansible-automation-platform user: username: hub_admin firstName: Hub lastName: Admin email: hub_admin@example.com enabled: true emailVerified: false credentials: - type: password value: <ch8ngeme> clientRoles: automation-hub: - hubadmin Click Create and wait for the process to complete. When a user is created, the Operator creates a Secret containing both the username and password using the following naming pattern: credential-<realm name>-<username>-<namespace> . In this example the credential is called credential-ansible-automation-platform-hub-admin-rh-sso . When a user is created the Operator does not update the user's password. Password changes are not reflected in the Secret. 6.5. Installing the Ansible Automation Platform Operator Procedure Navigate to Operator Operator Hub and search for the Ansible Automation Platform Operator. Select the Ansible Automation Platform Operator project. Click on the Operator tile. Click Install . Select a Project to install the Operator into. Red Hat recommends using the Operator recommended Namespace name. If you want to install the Operator into a project other than the recommended one, select Create Project from the drop down menu. Enter the Project name. Click Create . Click Install . When the Operator has been installed, click View Operator . 6.6. Creating a Red Hat Single Sign-On connection secret Procedure Navigate to https://<sso_host>/auth/realms/ansible-automation-platform . Copy the public_key value. In the OpenShift Web UI, navigate to Workloads Secrets . Select the ansible-automation-platform project. Click Create , and select From YAML . Edit the following YAML to create the secret apiVersion: v1 kind: Secret metadata: name: automation-hub-sso 1 namespace: ansible-automation-platform type: Opaque stringData: keycloak_host: "keycloak-rh-sso.apps-crc.testing" keycloak_port: "443" keycloak_protocol: "https" keycloak_realm: "ansible-automation-platform" keycloak_admin_role: "hubadmin" social_auth_keycloak_key: "automation-hub" social_auth_keycloak_secret: "client-secret" 2 social_auth_keycloak_public_key: >- 3 1 This name is used in the step when creating the automation hub instance. 2 If the secret was changed when creating the Keycloak client for automation hub be sure to change this value to match. 3 Enter the value of the public_key copied in Installing the Ansible Automation Platform Operator . Click Create and wait for the process to complete. 6.7. Installing automation hub using the Operator Use the following procedure to install automation hub using the operator. Procedure Navigate to Operator Installed Operators . Select the Ansible Automation Platform. Select the Automation hub tab and click Create Automation hub . Select YAML view . The YAML should be similar to: apiVersion: automationhub.ansible.com/v1beta1 kind: AutomationHub metadata: name: private-ah 1 namespace: ansible-automation-platform spec: sso_secret: automation-hub-sso 2 pulp_settings: verify_ssl: false route_tls_termination_mechanism: Edge ingress_type: Route loadbalancer_port: 80 file_storage_size: 100Gi image_pull_policy: IfNotPresent web: replicas: 1 file_storage_access_mode: ReadWriteMany content: log_level: INFO replicas: 2 postgres_storage_requirements: limits: storage: 50Gi requests: storage: 8Gi api: log_level: INFO replicas: 1 postgres_resource_requirements: limits: cpu: 1000m memory: 8Gi requests: cpu: 500m memory: 2Gi loadbalancer_protocol: http resource_manager: replicas: 1 worker: replicas: 2 1 Set metadata.name to the name to use for the instance. 2 Set spec.sso_secret to the name of the secret created in Creating a Secret to hold the Red Hat Single Sign On connection details . Note This YAML turns off SSL verification ( ssl_verify: false ). If you are not using self-signed certificates for OpenShift this setting can be removed. Click Create and wait for the process to complete. 6.8. Determining the automation hub Route Use the following procedure to determine the hub route. Procedure Navigate to Networking Routes . Select the project you used for the install. Copy the location of the private-ah-web-svc service. The name of the service is different if you used a different name when creating the automation hub instance. This is used later to update the Red Hat Single Sign-On client. 6.9. Updating the Red Hat Single Sign-On client When automation hub is installed and you know the URL of the instance, you must update the Red Hat Single Sign-On to set the Valid Redirect URIs and Web Origins settings. Procedure Navigate to Operator Installed Operators . Select the RH-SSO project. Click Red Hat Single Sign-On Operator . Select Keycloak Client . Click on the automation-hub-client-secret client. Select YAML . Update the Client YAML to add the Valid Redirect URIs and Web Origins settings. redirectUris: - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*' webOrigins: - 'https://private-ah-ansible-automation-platform.apps-crc.testing' Field Description redirectURIs This is the location determined in Determine Automation Hub Route . Be sure to add the /* to the end of the redirectUris setting. webOrigins This is the location determined in Determine Automation Hub Route . Note Ensure the indentation is correct when entering these settings. Click Save . To verify connectivity Navigate to the automation hub route. Enter the hub_admin user credentials and sign in. Red Hat Single Sign-On processes the authentication and redirects back to automation hub. 6.10. Additional resources For more information on running operators on OpenShift Container Platform, see Working with Operators in OpenShift Container Platform in the OpenShift Container Platform product documentation.

Commands:
apiVersion: keycloak.org/v1alpha1 kind: Keycloak metadata: name: example-keycloak labels: app: sso namespace: aap spec: externalAccess: enabled: true instances: 1
kind: KeycloakRealm apiVersion: keycloak.org/v1alpha1 metadata: name: ansible-automation-platform-keycloakrealm namespace: rh-sso labels: app: sso realm: ansible-automation-platform spec: realm: id: ansible-automation-platform realm: ansible-automation-platform enabled: true displayName: Ansible Automation Platform instanceSelector: matchLabels: app: sso
kind: KeycloakClient apiVersion: keycloak.org/v1alpha1 metadata: name: automation-hub-client-secret labels: app: sso realm: ansible-automation-platform namespace: rh-sso spec: realmSelector: matchLabels: app: sso realm: ansible-automation-platform client: name: Automation Hub clientId: automation-hub secret: <client-secret> 1 clientAuthenticatorType: client-secret description: Client for automation hub attributes: user.info.response.signature.alg: RS256 request.object.signature.alg: RS256 directAccessGrantsEnabled: true publicClient: true protocol: openid-connect standardFlowEnabled: true protocolMappers: - config: access.token.claim: "true" claim.name: "family_name" id.token.claim: "true" jsonType.label: String user.attribute: lastName userinfo.token.claim: "true" consentRequired: false name: family name protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: userinfo.token.claim: "true" user.attribute: email id.token.claim: "true" access.token.claim: "true" claim.name: email jsonType.label: String name: email protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: multivalued: "true" access.token.claim: "true" claim.name: "resource_access.USD{client_id}.roles" jsonType.label: String name: client roles protocol: openid-connect protocolMapper: oidc-usermodel-client-role-mapper consentRequired: false - config: userinfo.token.claim: "true" user.attribute: firstName id.token.claim: "true" access.token.claim: "true" claim.name: given_name jsonType.label: String name: given name protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: id.token.claim: "true" access.token.claim: "true" userinfo.token.claim: "true" name: full name protocol: openid-connect protocolMapper: oidc-full-name-mapper consentRequired: false - config: userinfo.token.claim: "true" user.attribute: username id.token.claim: "true" access.token.claim: "true" claim.name: preferred_username jsonType.label: String name: <username> protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper consentRequired: false - config: access.token.claim: "true" claim.name: "group" full.path: "true" id.token.claim: "true" userinfo.token.claim: "true" consentRequired: false name: group protocol: openid-connect protocolMapper: oidc-group-membership-mapper - config: multivalued: 'true' id.token.claim: 'true' access.token.claim: 'true' userinfo.token.claim: 'true' usermodel.clientRoleMapping.clientId: 'automation-hub' claim.name: client_roles jsonType.label: String name: client_roles protocolMapper: oidc-usermodel-client-role-mapper protocol: openid-connect - config: id.token.claim: "true" access.token.claim: "true" included.client.audience: 'automation-hub' protocol: openid-connect name: audience mapper protocolMapper: oidc-audience-mapper roles: - name: "hubadmin" description: "An administrator role for automation hub"
apiVersion: keycloak.org/v1alpha1 kind: KeycloakUser metadata: name: hubadmin-user labels: app: sso realm: ansible-automation-platform namespace: rh-sso spec: realmSelector: matchLabels: app: sso realm: ansible-automation-platform user: username: hub_admin firstName: Hub lastName: Admin email: hub_admin@example.com enabled: true emailVerified: false credentials: - type: password value: <ch8ngeme> clientRoles: automation-hub: - hubadmin
apiVersion: v1 kind: Secret metadata: name: automation-hub-sso 1 namespace: ansible-automation-platform type: Opaque stringData: keycloak_host: "keycloak-rh-sso.apps-crc.testing" keycloak_port: "443" keycloak_protocol: "https" keycloak_realm: "ansible-automation-platform" keycloak_admin_role: "hubadmin" social_auth_keycloak_key: "automation-hub" social_auth_keycloak_secret: "client-secret" 2 social_auth_keycloak_public_key: >- 3
apiVersion: automationhub.ansible.com/v1beta1 kind: AutomationHub metadata: name: private-ah 1 namespace: ansible-automation-platform spec: sso_secret: automation-hub-sso 2 pulp_settings: verify_ssl: false route_tls_termination_mechanism: Edge ingress_type: Route loadbalancer_port: 80 file_storage_size: 100Gi image_pull_policy: IfNotPresent web: replicas: 1 file_storage_access_mode: ReadWriteMany content: log_level: INFO replicas: 2 postgres_storage_requirements: limits: storage: 50Gi requests: storage: 8Gi api: log_level: INFO replicas: 1 postgres_resource_requirements: limits: cpu: 1000m memory: 8Gi requests: cpu: 500m memory: 2Gi loadbalancer_protocol: http resource_manager: replicas: 1 worker: replicas: 2
redirectUris: - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*' webOrigins: - 'https://private-ah-ansible-automation-platform.apps-crc.testing'