loggin-into-identity-provider+location

modules/installation-guide/examples/system-variables.adoc

@@ -310,7 +310,7 @@
 ,=== 
  Environment Variable Name,Default value, Description 
 
- `+CHE_INFRA_OPENSHIFT_OAUTH__IDENTITY__PROVIDER+`,"`+NULL+`","Alias of the Openshift identity provider registered in Keycloak, that should be used to create workspace OpenShift resources in Openshift namespaces owned by the current {prod-short} user. Should be set to NULL if `che.infra.openshift.project` is set to a non-empty value. For more information see the following documentation: \https://www.keycloak.org/docs/latest/server_admin/index.html#openshift-4" 
+ `+CHE_INFRA_OPENSHIFT_OAUTH__IDENTITY__PROVIDER+`,"`+NULL+`","Alias of the Openshift identity provider registered in Keycloak, which will be used to create workspace OpenShift resources in Openshift namespaces owned by the current {prod-short} user. Should be set to NULL if `che.infra.openshift.project` is set to a non-empty value. For more information see the following documentation: \https://www.keycloak.org/docs/latest/server_admin/index.html#openshift-4" 
 ,=== 
 
 [id="keycloak-configuration"]

modules/installation-guide/partials/proc_configuring-che-hostname.adoc

@@ -22,16 +22,16 @@ IMPORTANT: Ask a DNS provider to point the custom hostname to the cluster ingres
 $ {orch-cli} create {orch-namespace} {prod-namespace}
 ----
 
-. Create a tls secret:
+. Create a TLS secret:
 +
 [subs="+quotes,attributes"]
 ----
-$ {orch-cli} create secret tls $\{secret} \  <1>
+$ {orch-cli} create secret TLS $\{secret} \  <1>
 --key $\{key_file} \                       <2>
 --cert $\{cert_file} \                     <3>
 -n {prod-namespace}
 ----
-<1> The tls secret name
+<1> The TLS secret name
 <2> A file with the private key
 <3> A file with the certificate
 
@@ -46,8 +46,12 @@ spec:
     cheHostTLSSecret: <secret>  <2>
 ----
 <1> Custom {prod} server hostname
-<2> The tls secret name
+<2> The TLS secret name
 
 . If {prod-short} has been already deployed and {prod-short} reconfiguring to use a new {prod-short} hostname is required, log in using {identity-provider} and select the `{prod-deployment}-public` client in the `{prod-short}` realm and update `Validate Redirect URIs` and `Web Origins` fields with the value of the {prod-short} hostname.
 +
 image::keycloak/keycloak_che_public_client.png[]
++
+For logging in to {identity-provider}, follow the procedure below.
+
+include::partial$proc_logging-in-to-identity-provider.adoc[]

modules/installation-guide/partials/proc_logging-in-to-identity-provider.adoc

@@ -0,0 +1,34 @@
+[id="proc_logging-in-to-identity-provider_{context}"]
+== Logging in to {identity-provider}
+
+The following procedure describes how to log in to {identity-provider}, which acts as a route for OpenShift platforms. To log in to {identity-provider}, a user has to obtain the {identity-provider} URL and a user's credentials first.
+
+.Prerequisites
+
+* The `{orch-cli}` tool installed.
+* Logged in to OpenShift cluster using the `{orch-cli}` tool.
+
+.Procedure
+
+. Obtain a user {identity-provider} login:
++
+[subs="+attributes,+quotes"]
+----
+{orch-cli} get secret che-identity-secret  -n {prod-namespace} -o json | jq -r '.data.user' | base64 -d
+----
+
+. Obtain a user {identity-provider} password:
++
+[subs="+attributes,+quotes"]
+----
+{orch-cli} get secret che-identity-secret  -n {prod-namespace} -o json | jq -r '.data.password' | base64 -d 
+----
+
+. Obtain the {identity-provider} URL:
++
+[subs="+attributes,+quotes"]
+----
+{orch-cli}  get ingress -n {prod-namespace} -l app=che,component=keycloak   -o 'custom-columns=URL:.spec.rules[0].host' --no-headers
+----
+
+. Open the URL in a browser and log in to {identity-provider} using the obtained login and password. 

modules/installation-guide/partials/proc_setting-up-the-keycloak-che-username-readonly-theme-for-the-eclipse-che-login-page.adoc

@@ -7,9 +7,14 @@
 
 The following procedure is relevant for all {prod-short} instances with the OpenShift OAuth service enabled.
 
-When a user with pre-created namespaces logs in to {prod} Dashboard for the first time, a page allowing the user to update account information is displayed. It is possible to change the username, but choosing a username that doesn't match the OpenShift username, prevents the user's workspaces from running. This is caused by {prod-short} attempts to use a non-existing namespace, the name of which is derived from a user OpenShift username, to create a workspace. To prevent this, modify the {identity-provider} settings using the steps below. 
+When a user with pre-created namespaces logs in to {prod} Dashboard for the first time, a page allowing the user to update account information is displayed. It is possible to change the username, but choosing a username that doesn't match the OpenShift username, prevents the user's workspaces from running. This is caused by {prod-short} attempts to use a non-existing namespace, the name of which is derived from a user OpenShift username, to create a workspace. To prevent this, log in to {identity-provider} and modify the theme settings.
 
 
+include::partial$proc_logging-in-to-identity-provider.adoc[]
+
+
+== Setting up the {identity-provider} {prod-id-short}-username-readonly theme
+
 .Prerequisites
 
 * An instance of {prod-short} running in OpenShift.
@@ -20,7 +25,7 @@ When a user with pre-created namespaces logs in to {prod} Dashboard for the firs
 After changing a username, set the *Login Theme* option to `readonly`.
 
 . In the main *Configure* menu on the left, select *Realm Settings*:
-+
+
 image::keycloak/{project-context}-keycloak-username-readonly-theme.png[link="../_images/keycloak/{project-context}-keycloak-username-readonly-theme.png"]
 
 . Navigate to the *Themes* tab.