Testing SSO providers for Social Login: (1) from pre-integrated RH-SSO (2) from pre-registered RH-SSO and Open Liberty Operator #2
Assignees
Labels
Comments
|
|
|
Next:
|
|
Next:
|
|
'rh-sso' worked by referring the following doc:
Learned about access type when creating a client: example config for oidcLogin: |
|
Collected test result with SSL Termination in Routes while running Social Login test and provided it to Bruce for suggestion. From the result, when using target ssl port, the security route termination only 'passthrough' worked; 'reencrypt' and 'edge' failed. |
|
Investigated Edge and Reencrypt TLS terminations but found these 2 require customer certificates. See doc: Need to explore how to gather the required certificate. |
|
Went back to scenario 1 with <variable name= value= /> in server.xml and initially the sso xml was placed in configDropins/overrides, which caused some of user defined values overridden (and failure to display the social media login page). |
|
Parameters from trace log: |
|
twitter: |
|
GHE: Old: |
|
LinkedIn: |
|
facebook: |
|
oauth2Login (github.com): |
|
oidcLogin (RH-SSO): |
|
Addressed a minor issue: OpenLiberty/open-liberty#11180. |
meiaus
changed the title
|
Completed Pre-registered RH-SSO scenario with Open Liberty Operator. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Background dev work:
Delivery:
set up sso providers:
each sso provider configured in Liberty server variables
<variable name= value= />in a server xml file at image build timeeach sso provider passed in as environment variables at build time (Dockerfile)
each sso provider passed in as environment variables at start time (docker container)
validate parameters from tracing
server_trace.log
investigated routes with TLS Termination: Edge and Re-encrypt (both not working at this time)
Test with TLS Termination Passthrough
Test with
getcert.shandserver.envto handle trust certificate between open liberty and social media as well as between open liberty and RH-SSO (within Open Shift cluster)validate RedirectToRPHostAndPort
pod event output
pod log (open liberty messages.log)
messages.log
For testing purpose, "getcerts.sh" was used to handle trust certificate between open liberty and social media, as well as between open liberty and RH-SSO (within open shift cluster)
See item 2 on Pre-registered below
- [ ] each sso provider passed in through an include file by the Liberty operator at start time.
- - [ ] When operator becomes available from Leo in an early build, try that out. Make sure ssl can be configured.
- - [ ] See if operator's ability to set redirectToRPHostAndPort is working.
- - [ ] Do full config from operator and make sure trace of config params matches what we got without operator.
- [ ] final test with the merged codeDocument the test details in box note (https://ibm.ent.box.com/notes/623216495506)
Install Open Liberty Operator
Create secret (to contain client ID, secret for social media and RH-SSO)
Create OLA (OpenLibertyApplication) deployment yaml (with
ssospec and other env variables)Docker build time with ENV variables (
SEC_TLS_TRUSTDEFAULTCERTS=true,SEC_IMPORT_K8S_CERTS=true)Deploy OLA and also containing below ENV when Dockerfile not containing them:
SEC_TLS_TRUSTDEFAULTCERTS=trueto handle trust certificates for social mediaSEC_IMPORT_K8S_CERTS=trueto handle trust certificates for RH-SSO (within Open Shift Cluster)cert_defaultKeyStore=/var/run/secrets/kubernetes.io/serviceaccount/ca.crtin server.env to handle the trust certificate for RH-SSOSecured Route with Passthrough TLS Termination
(Updated 4/14/2020) TLS Termination with Reencrypt using Open Shift Cert-manager worked, git issue closed: Pre-registered RH-SSO scenario: Investigate Route's TLS Termination with Reencrypt using Open Shift Cert-manager #3)
Passthrough scenario: messages.log
Passthrough scenario: server_trace.log.zip
Document the test details in box note (https://ibm.ent.box.com/notes/648295410899)
The text was updated successfully, but these errors were encountered: