Docker containers for testing httpd against JLab's keycloak-based OIDC implementation.
This repository contains a Dockerfile for building a Docker image that integrates Apache HTTP Server (httpd) with Keycloak for authentication and authorization. The Docker image is based on the official httpd image and includes the necessary Keycloak client configuration to enable keycloak-based OIDC authentication and authorization for web applications served by Apache's httpd daemon. It enables testing of JLab's keycloak configuration against httpd clients that use mod_auth_oidc.
The most important detail for this project is that mod_auth_oidc does not
support the use of role information in the Keycloak-provided access token.
Special mapper rules need to be introduced at either the client or realm
level that place role claims in the ID tokens or userinfo endpoint. A new
client role mapper feature was introduced in jeffersonlab/keycloak:2.7.0
that uses the KC_UPDATE_CLIENT_ROLES_MAPPER='true' environment variable
as a trigger that handles this for a specific client.
If OIDC is working as expected, the oidcdump link on the index page should
show realm_roles at the bottom of the output. This should only be accessible
by tbrown or jdoe as they are members of the admin group list in the httpd
config files Require claim statement.
Expected oidcdump output
=== All Env ===
HTTP_ACCEPT_ENCODING=gzip, deflate, br, zstd
SSL_SERVER_S_DN_CN=httpd
SERVER_NAME=localhost
...
=== All OIDC claims ===
OIDC_CLAIM_acr=1
OIDC_CLAIM_at_hash=mAqBU3MCn37NsRkb85vMfw
OIDC_CLAIM_aud=httpd
OIDC_CLAIM_auth_time=1782394868
OIDC_CLAIM_azp=httpd
OIDC_CLAIM_email=tbrown@example.com
OIDC_CLAIM_email_verified=0
OIDC_CLAIM_exp=1782395168
OIDC_CLAIM_family_name=Brown
OIDC_CLAIM_given_name=Tom
OIDC_CLAIM_iat=1782394868
OIDC_CLAIM_iss=http://localhost:8081/auth/realms/test-realm
OIDC_CLAIM_jti=7f261cc9-9311-ee22-9d03-45fb88ead479
OIDC_CLAIM_name=Tom Brown
OIDC_CLAIM_nonce=BIxlU39g7Yj_j4RiM9J6O_wPMCKHOlJDZxzdWLSk1wE
OIDC_CLAIM_preferred_username=tbrown
OIDC_CLAIM_realm_access={"roles":["default-roles-test-realm","offline_access","httpd-admin","uma_authorization","httpd-user"]}
OIDC_CLAIM_sid=3rm4nz2F0SXF_5LjBkCgmElQ
OIDC_CLAIM_sub=131b8bcb-4d32-4c4f-9d8e-e5da08e46cf2
OIDC_CLAIM_typ=ID
=== realm_access specifically ===
{"roles":["default-roles-test-realm","offline_access","httpd-admin","uma_authorization","httpd-user"]}
- Tinkering with httpd custom config files. This works, but they could possibly be simpler and or use environment variables for OIDC config.
- Automated testing