Skip to content

Commit

Permalink
Updates proc to configure github/bitbucket oauth (#1859)
Browse files Browse the repository at this point in the history
* Update github/bitbucket oauth configuration

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

Co-authored-by: Yana Hontyk <yhontyk@redhat.com>
  • Loading branch information
tolusha and Yana Hontyk committed Feb 17, 2021
1 parent c0fecd5 commit 9acc918
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 39 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ It enables {prod-short} to obtain and renew link:https://confluence.atlassian.co

.Procedure

. Generate a RSA key pair and a stripped down version of the public key:
. Generate a RSA key pair and a stripped down version of the public key:
+
[subs="+quotes,+attributes"]
----
Expand All @@ -41,48 +41,32 @@ openssl rand -base64 24 > __<bitbucket_server_consumer_key>__
openssl rand -base64 24 > __<bitbucket_shared_secret>__
----

. Create a Kubernetes Secret in {prod-short} namespace containing the RSA key pair, the consumer key and the shared secret.
. Create a Kubernetes Secret in {prod-short} namespace containing the consumer and private keys.
+
[subs="+quotes,+attributes"]
----
$ {orch-cli} apply -f - <<EOF
kind: Secret
apiVersion: v1
metadata:
name: github-oauth-credentials
name: bitbucket-oauth-config
namespace: <...> <1>
labels:
app.kubernetes.io/part-of: che.eclipse.org
app.kubernetes.io/component: che-secret
app.kubernetes.io/component: oauth-scm-configuration
annotations:
che.eclipse.org/mount-path: /home/user/eclipse-che/conf/oauth1/bitbucket
che.eclipse.org/mount-as: file
data:
private.key: <...> <2>
consumer.key: <...> <3>
shared_secret: <...> <4>
che.eclipse.org/oauth-scm-server: bitbucket
che.eclipse.org/scm-server-endpoint: <...> <2>
type: Opaque
data:
private.key: <...> <3>
consumer.key: <...> <4>
EOF
----
<1> {prod-short} namespace. The default is {prod-namespace}
<2> base64 encoded content of the __<privatepkcs8.pem>__ file without first and last lines.
<3> base64 encoded content of the `__<bitbucket_server_consumer_key>__` file.
<4> base64 encoded content of the `__<bitbucket_shared_secret>__` file.

. Configure the {prod-short} server environment variables:
+
[subs="+quotes,macros"]
----
spec:
server:
customCheProperties:
pass:[CHE_OAUTH1_BITBUCKET_CONSUMERKEYPATH]: '/home/user/eclipse-che/conf/oauth1/bitbucket/consumer.key'
pass:[CHE_OAUTH1_BITBUCKET_SHAREDSECRETPATH]: '/home/user/eclipse-che/conf/oauth1/bitbucket/shared_secret'
pass:[CHE_OAUTH1_BITBUCKET_PRIVATEKEYPATH]: '/home/user/eclipse-che/conf/oauth1/bitbucket/private.key'
pass:[CHE_OAUTH1_BITBUCKET_ENDPOINT]: '__<Bitbucket Server URL>__'
pass:[CHE_INTEGRATION_BITBUCKET_SERVER__ENDPOINTS]: '__<Bitbucket Server URL>__'
----
<2> Bitbucket Server URL
<3> base64 encoded content of the __<privatepkcs8.pem>__ file without first and last lines.
<4> base64 encoded content of the `__<bitbucket_server_consumer_key>__` file.

. Configure an link:https://confluence.atlassian.com/adminjiraserver/using-applinks-to-link-to-other-applications-938846918.html[Application Link] in Bitbucket to enable the communication from {prod-short} to Bitbucket Server.

Expand Down Expand Up @@ -136,5 +120,5 @@ Public Key:: Paste the content of the `__<public-stripped.pub>__` file.
* link:https://bitbucket.org/product/download[Download Bitbucket Server]
* link:https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html[Bitbucket Server Personal access tokens]
* link:https://confluence.atlassian.com/jirakb/how-to-generate-public-key-to-application-link-3rd-party-applications-913214098.html[How to generate public key to application link 3rd party applications]
* link:https://confluence.atlassian.com/adminjiraserver/using-applinks-to-link-to-other-applications-938846918.html[Using AppLinks to link to other applications]
* link:https://confluence.atlassian.com/adminjiraserver/using-applinks-to-link-to-other-applications-938846918.html[Using AppLinks to link to other applications]
* xref:end-user-guide:authentication-against-bitbucket-server-with-the-personal-access-token.adoc[].
Original file line number Diff line number Diff line change
Expand Up @@ -29,20 +29,17 @@ $ {orch-cli} apply -f - <<EOF
kind: Secret
apiVersion: v1
metadata:
name: github-oauth-credentials
name: github-oauth-config
namespace: <...> <1>
labels:
app.kubernetes.io/part-of: che.eclipse.org
app.kubernetes.io/component: keycloak-secret
app.kubernetes.io/component: oauth-scm-configuration
annotations:
che.eclipse.org/github-oauth-credentials: 'true'
che.eclipse.org/mount-as: env
che.eclipse.org/id_env-name: GITHUB_CLIENT_ID
che.eclipse.org/secret_env-name: GITHUB_SECRET
che.eclipse.org/oauth-scm-server: github
type: Opaque
data:
id: <...> <2>
secret: <...> <3>
type: Opaque
EOF
----
<1> {prod-short} namespace. The default is {prod-namespace}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@
[id="enabling-self-registration_{context}"]
= Enabling self-registration

Self-registration allows users to register themselves in a {prod-short} instance by accessing the {prod-short} server URL.
Self-registration allows users to register themselves in a {prod-short} instance by accessing the {prod-short} server URL.

For {prod-short} installed without OpenShift OAuth support, self-registration is disabled by default, therefore the option to register a new user is not available on the login page.
For {prod-short} installed without OpenShift OAuth support, self-registration is disabled by default, therefore the option to register a new user is not available on the login page.

.Prerequisites

Expand All @@ -15,6 +15,6 @@ For {prod-short} installed without OpenShift OAuth support, self-registration is

To enable self-registration of users:

. Navigate to the *Realm Settings* menu on the left and open the *Login* tab.
. Navigate to the *Realm Settings* menu on the left and open the *Login* tab.

. Set *User registration* option to *On*.

0 comments on commit 9acc918

Please sign in to comment.