Skip to content

Commit 8636773

Browse files
deniskvistdeniskvist
committed
Configure temporary access to the Keycloak admin interface as long as he_pause_host is set to true
Resolve issue: oVirt/ovirt-engine-keycloak#54 Signed-off-by: Denis Kvist <[email protected]>
1 parent 18107de commit 8636773

File tree

4 files changed

+143
-0
lines changed

4 files changed

+143
-0
lines changed

‎roles/hosted_engine_setup/files/keycloak_he_pause_host.sh‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/bash
2+
3+
# This file is a part of the hosted-engine deployment process
4+
# The goal is to add a temporary URI to the ovirt-engine-internal client, and return the original value on the second pass.
5+
6+
# KEYCLOAK_URL get from ENV: "https://{{ he_fqdn }}/ovirt-engine-auth"
7+
# HOST_FQDN get from ENV: "{{ he_host_name }}"
8+
# PASSWORD get from ENV: "{{ he_admin_password }}"
9+
10+
KEYCLOAK_REALM=ovirt-internal
11+
KEYCLOAK_CLIENT_ID=ovirt-engine-internal
12+
USERNAME="admin"
13+
REDIRECT_URIS_TMPFILE=/tmp/keycloak_redirect_uris.tmp
14+
15+
TKN=$(curl --insecure --silent -X POST "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
16+
--header "content-type: application/x-www-form-urlencoded" \
17+
--data-urlencode "client_id=admin-cli" \
18+
--data-urlencode "username=${USERNAME}" \
19+
--data-urlencode "password=${PASSWORD}" \
20+
--data-urlencode "grant_type=password" | jq --raw-output '.access_token' )
21+
22+
CLIENT_DATA=$(curl --insecure --silent -X GET "${KEYCLOAK_URL}/admin/realms/${KEYCLOAK_REALM}/clients?clientId=${KEYCLOAK_CLIENT_ID}" \
23+
--header "Accept: application/json" \
24+
--header "Authorization: Bearer $TKN")
25+
26+
CLIENT_ID=$(echo $CLIENT_DATA | jq -r '.[0].id')
27+
28+
if [ -f "$REDIRECT_URIS_TMPFILE" ]; then
29+
# Second pass
30+
# Restore original redirectUris parameters
31+
NEW_URI=$(<$REDIRECT_URIS_TMPFILE)
32+
UPDATED_CLIENT_DATA=$(echo $CLIENT_DATA | jq --argjson new_uri "$NEW_URI" '.[0] | .redirectUris = $new_uri')
33+
rm -rf $REDIRECT_URIS_TMPFILE
34+
else
35+
# First pass
36+
# Save original redirectUris parameters
37+
REDIRECT_URIS=$(echo $CLIENT_DATA | jq -r '.[0].redirectUris')
38+
echo "$REDIRECT_URIS" > $REDIRECT_URIS_TMPFILE
39+
40+
# Add a temporary URI to redirectUris
41+
NEW_URI="https://${HOST_FQDN}:6900*"
42+
UPDATED_CLIENT_DATA=$(echo $CLIENT_DATA | jq --arg new_uri "$NEW_URI" '.[0] | .redirectUris += [$new_uri]')
43+
fi
44+
45+
# Update client data
46+
curl --insecure --silent --http1.0 -X PUT "${KEYCLOAK_URL}/admin/realms/${KEYCLOAK_REALM}/clients/${CLIENT_ID}" \
47+
--header "Authorization: Bearer $TKN" \
48+
--header "Content-Type: application/json" \
49+
--data-raw "$UPDATED_CLIENT_DATA"

‎roles/hosted_engine_setup/tasks/bootstrap_local_vm/05_add_host.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,13 @@
121121
loop_control:
122122
loop_var: after_add_host_item
123123
register: include_after_add_host_results
124+
- name: Configure the Keycloak to be accessed over the first host
125+
block:
126+
- include_tasks: ../keycloak_config_for_he_pause_host.yml
127+
when:
128+
- he_pause_host|bool
129+
- he_enable_keycloak|bool
130+
delegate_to: "{{ groups.engine[0] }}"
124131
- name: Pause the execution to let the user interactively reconfigure the host
125132
block:
126133
- name: Let the user connect to the bootstrap engine VM to manually fix host configuration
@@ -130,6 +137,13 @@
130137
eventually remediate it, please continue only when the host is listed as 'up'
131138
- include_tasks: ../pause_execution.yml
132139
when: he_pause_host|bool
140+
- name: Configure the Keycloak to be accessed over the Engine FQDN
141+
block:
142+
- include_tasks: ../keycloak_restore_after_he_pause_host.yml
143+
when:
144+
- he_pause_host|bool
145+
- he_enable_keycloak|bool
146+
delegate_to: "{{ groups.engine[0] }}"
133147
# refresh the auth token after a long operation to avoid having it expired
134148
- include_tasks: ../auth_revoke.yml
135149
- include_tasks: ../auth_sso.yml

‎roles/hosted_engine_setup/tasks/keycloak_config_for_he_pause_host.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
- name: Configure Apache
3+
block:
4+
- name: Replace OIDCProviderMetadataURL value
5+
ansible.builtin.replace:
6+
path: /etc/httpd/conf.d/internalsso-openidc.conf
7+
regexp: '(^\s+OIDCProviderMetadataURL https:\/\/).+(\/ovirt-engine.*)'
8+
replace: '\g<1>{{ he_host_address }}:6900\g<2>'
9+
- name: Replace OIDCRedirectURI value
10+
ansible.builtin.replace:
11+
path: /etc/httpd/conf.d/internalsso-openidc.conf
12+
regexp: '(^\s+OIDCRedirectURI https:\/\/).+(\/ovirt-engine.*)'
13+
replace: '\g<1>{{ he_host_address }}:6900\g<2>'
14+
- name: Replace OIDCDefaultURL value
15+
ansible.builtin.replace:
16+
path: /etc/httpd/conf.d/internalsso-openidc.conf
17+
regexp: '(^\s+OIDCDefaultURL https:\/\/).+(\/ovirt-engine.*)'
18+
replace: '\g<1>{{ he_host_address }}:6900\g<2>'
19+
- name: Replace OIDCOAuthIntrospectionEndpoint value
20+
ansible.builtin.replace:
21+
path: /etc/httpd/conf.d/internalsso-openidc.conf
22+
regexp: '(^\s+OIDCOAuthIntrospectionEndpoint https:\/\/).+(\/ovirt-engine.*)'
23+
replace: '\g<1>{{ he_host_address }}:6900\g<2>'
24+
- name: Configure Keycloak
25+
block:
26+
- name: Copy keycloak_he_pause_host.sh
27+
ansible.builtin.copy:
28+
src: /usr/share/ansible/collections/ansible_collections/ovirt/ovirt/roles/hosted_engine_setup/files/keycloak_he_pause_host.sh
29+
dest: /tmp/keycloak_he_pause_host.sh
30+
mode: '0644'
31+
- name: Run keycloak_he_pause_host.sh
32+
shell: /bin/bash /tmp/keycloak_he_pause_host.sh
33+
environment:
34+
KEYCLOAK_URL: "https://{{ he_fqdn }}/ovirt-engine-auth"
35+
HOST_FQDN: "{{ he_host_name }}"
36+
PASSWORD: "{{ he_admin_password }}"
37+
- name: Restart httpd service
38+
ansible.builtin.service:
39+
name: httpd
40+
state: restarted

‎roles/hosted_engine_setup/tasks/keycloak_restore_after_he_pause_host.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
- name: Configure Apache
3+
block:
4+
- name: Restore original OIDCProviderMetadataURL value
5+
ansible.builtin.replace:
6+
path: /etc/httpd/conf.d/internalsso-openidc.conf
7+
regexp: '(^\s+OIDCProviderMetadataURL https:\/\/).+(\/ovirt-engine.*)'
8+
replace: '\g<1>{{ he_fqdn }}\g<2>'
9+
- name: Restore original OIDCRedirectURI value
10+
ansible.builtin.replace:
11+
path: /etc/httpd/conf.d/internalsso-openidc.conf
12+
regexp: '(^\s+OIDCRedirectURI https:\/\/).+(\/ovirt-engine.*)'
13+
replace: '\g<1>{{ he_fqdn }}\g<2>'
14+
- name: Restore original OIDCDefaultURL value
15+
ansible.builtin.replace:
16+
path: /etc/httpd/conf.d/internalsso-openidc.conf
17+
regexp: '(^\s+OIDCDefaultURL https:\/\/).+(\/ovirt-engine.*)'
18+
replace: '\g<1>{{ he_fqdn }}\g<2>'
19+
- name: Restore original OIDCOAuthIntrospectionEndpoint value
20+
ansible.builtin.replace:
21+
path: /etc/httpd/conf.d/internalsso-openidc.conf
22+
regexp: '(^\s+OIDCOAuthIntrospectionEndpoint https:\/\/).+(\/ovirt-engine.*)'
23+
replace: '\g<1>{{ he_fqdn }}\g<2>'
24+
- name: Configure Keycloak
25+
block:
26+
- name: Copy keycloak_he_pause_host.sh
27+
ansible.builtin.copy:
28+
src: /usr/share/ansible/collections/ansible_collections/ovirt/ovirt/roles/hosted_engine_setup/files/keycloak_he_pause_host.sh
29+
dest: /tmp/keycloak_he_pause_host.sh
30+
mode: '0644'
31+
- name: Run keycloak_he_pause_host.sh
32+
shell: /bin/bash /tmp/keycloak_he_pause_host.sh
33+
environment:
34+
KEYCLOAK_URL: "https://{{ he_fqdn }}/ovirt-engine-auth"
35+
HOST_FQDN: "{{ he_host_name }}"
36+
PASSWORD: "{{ he_admin_password }}"
37+
- name: Restart httpd service
38+
ansible.builtin.service:
39+
name: httpd
40+
state: restarted

0 commit comments

Comments
 (0)