[FEATURE REQUEST]: API enhancement to support Keycloak Authentication URL

[FHanbali]

Feature Request Type

• User Interface (UI)
• Application Programming Interface (API)

The Cumulus Plugin for the CWMS CAVI needs to be able to dynamically retrieve the correct keycloak authentication URL based on the specified instance (e.g. dev.cwib.us vs. test.cwib.us) of the Cumulus API.

Requesting an addition to the Cumulus API to support Keycloak authentication URL retrieval.

[adamscarberry]

Adding to notes:

• OpenID Connect Discovery
• https://swagger.io/docs/specification/v3_0/authentication/openid-connect-discovery/
• [https://server.com/.well-known/openid-configuration]

Because Cumulus is not the auth server, the info would be limited to just essential info needs to point to the keycloak auth server.

[adamscarberry]

Maybe an example would look like: https://cumulus.dev.cwbi.us/api/auth/keycloak-configuration

{
  "issuer": "https://keycloak.example.com/realms/myrealm",
  "authorization_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/auth",
  "token_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token",
  "userinfo_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/userinfo",
  "end_session_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/logout",
  "jwks_uri": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/certs",
  "registration_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/registrations",
  "scopes_supported": ["openid", "profile", "email", "address"],
  "response_types_supported": ["code", "token", "id_token", "code id_token", "token id_token", "code token", "code token id_token"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "client_secret_jwt"],
  "revocation_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/revoke",
  "introspection_endpoint": "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/introspect"
}

This an example, but what fields would really be required?

[adamkorynta]

The only field that would be required is ""token_endpoint" for right now. Eventually the "end_session_endpoint" and some of the others would be useful.

I believe just a link to keycloak's /.well-known/openid-configuration URL would also suffice as we can get all that information from Keycloak directly.

[adamscarberry]

Note to self or whoever works on this first:

• Test Keycloak endpoint is: https://identity-test.cwbi.us/auth/realms/cwbi/.well-known/openid-configuration

• Test Direct Grant (CAC) is: https://identityc-test.cwbi.us/auth/realms/cwbi/.well-known/openid-configuration

• Prod Keycloak is: https://identity.sec.usace.army.mil/auth/realms/cwbi/.well-known/openid-configuration

• Prod Direct Grant (CAC) is: https://identityc.sec.usace.army.mil/auth/realms/cwbi/.well-known/openid-configuration

[adamscarberry]

@adamkorynta Would this work for you? https://cumulus.dev.cwbi.us/api/identity-provider/configuration

If so, I'll add to the existing corps.cloud instances as well.

cc @FHanbali

[adamkorynta]

@adamscarberry - that looks great.

cc @rma-bryson

[adamscarberry]

Castle Cloud Deployments:

• https://develop-cumulus-api.corps.cloud/identity-provider/configuration
• https://cumulus-api.corps.cloud/identity-provider/configuration

[adamscarberry]

I expect the url for CWBI TEST and PROD to look like:

• TEST - https://cumulus-test.cwbi.us/api/identity-provider/configuration (undecided about the "-test" part right now)
• PROD - https://cumulus.sec.usace.army.mil/api/identity-provider/configuration

@FHanbali This issue should be complete now.