Multi-user Eclipse Che #6441

skabashnyuk · 2017-09-26T12:35:41Z

steps required before merge

CQ approval of https://dev.eclipse.org/ipzilla/show_bug.cgi?id=14132

What does this PR do?

Introduce multi-user Eclipse Che based on Keyclaok identity server.

What is it

Added authentification and user management provided by Keycloak http://www.keycloak.org/
Permissions and Organization ported from Codenvy https://codenvy.com/docs/user-guide/permissions/index.html

How to run it.

docker run -it -e CHE_MULTIUSER=true -e CHE_HOST=<your ip> -e CHE_KEYCLOAK_AUTH__SERVER__URL=http://<your ip>:5050/auth -v /var/run/docker.sock:/var/run/docker.sock -v ~/.che-multiuser:/data eclipse/che:nightly start --skip:pull --skip:nightly

How to manage it

Keycloak configured with two realms. Master and che. Also we have one user admin/admin in both realm. Admin user in master realm is - super admin.
Eclipse Che configured for che realm
We enabled user registration in Che realm

Known limitation

swagger would not work. We need to upgrade a version. to support openid authentification Adapt swagger to use keycloak openid authentication #6015
It's working on local docker. We are going to provide scalable version based on OpenShift on next versions.
Invitation of non-existent users to Eclipse Che organization Invitation of non-existent users to Eclipse Che workspace/organization #6335

How to run it when it is in a branch

To run an multiuser Che version, the following steps are required after building the branch:

Rebuild init, cli and che images (in the given sequence). To do that, proceed to folder dockerfiles/<image_name> and run build.sh
Run Che in a usual way using cli, with additional parameters: -e CHE_MULTIUSER=true and --skip:pull --skip:nightly
Full command example:
docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock -v /home/user/.che:/data -e CHE_MULTIUSER=true eclipse/che-cli:nightly start --skip:pull --skip:nightly
MacOS users may need to edit che.env file in the data folder, changing CHE_HOST and CHE_KEYCLOAK_AUTH__SERVER__URL values to their specific IP.

When start is succeeded, the following docker containers should be created:

che, exposing 8080 port;
che_keycloak, exposing 5050 port;
che_postgres, exposing 5432 port;

What issues does this PR fix or reference?

#5362

Changelog

Introduce multi-user Eclipse Che based on Keyclaok identity server.

Release Notes

Introduce multi-user Eclipse Che based on Keyclaok identity server.

Docs PR

eclipse-che/che-docs#296

This reverts commit 203cdd0.

This reverts commit 5fb9d0b.

…user

codenvy-ci · 2017-10-05T18:16:56Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/4018/

benoitf · 2017-10-05T19:25:11Z

-0
adding keycloak support and having multi-user support is awesome. I love that.
But, there are too many duplicates in the code and it's kind hard to maintain as it's based on some include/exclude/duplicates between the two assemblies.
Besides that, it will be hard for onboarding users as they'll to figure out which assembly they need to use and it's not clear how you could migrate from one to another

skabashnyuk · 2017-10-06T06:02:44Z

Good point @benoitf. We received a couple more feedback like yours. And we have an agreement to have a single assembly in next releases. It's going to improve onboarding and probably remove duplication problems you've mentioned.

codenvy-ci · 2017-10-06T06:56:53Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/4027/

codenvy-ci · 2017-10-06T08:51:23Z

Build # 4032 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/4032/ to view the results.

mshaposhnik · 2017-10-06T10:15:30Z

...rc/main/java/org/eclipse/che/multiuser/api/permission/server/InstanceParameterValidator.java

+    if (permissionsManager.getDomain(domain).isInstanceRequired() && instance == null) {
+      throw new BadRequestException("Specified domain requires non nullable value for instance");
+    }
+  }


@sleshchenko simplify proposal:

checkArgument(domain != null, "Domain id required"); checkArgument((permissionsManager.getDomain(domain).isInstanceRequired() && instance == null), "Specified domain requires non nullable value for instance" );

It can be rewritten with checkArgument method. But then condition should be rewritten as

checkArgument(!permissionsManager.getDomain(domain).isInstanceRequired() || instance != null), "Specified domain requires non nullable value for instance");

So I'd not change it because then condition becomes more complicated.

We can remove negation in the checkArgument so than condition will be the same (and domain == null in first check )

This method is named after Precondition#checkArgument from guava. And I think it is
logical to have negation there while it is named in this way. Up to you change it or not =)

Signed-off-by: Oleksii Orel <oorel@redhat.com>

bmicklea · 2017-10-06T12:16:34Z

@skabashnyuk the move to a single assembly noted here is for multi-user only right? We haven’t agreed that we don’t need a single user assembly yet.

skabashnyuk · 2017-10-06T12:17:55Z

@bmicklea it's topic TBD. I'll create an issue for that.

Running integrations tests on centos/postgresql-96-centos7 image

codenvy-ci · 2017-10-06T13:06:49Z

Build # 4042 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/4042/ to view the results.

Multi-user Eclipse Che (#6441) #### How to run it. ```docker run -it -e CHE_MULTIUSER=true -e CHE_HOST=<your ip> -e CHE_KEYCLOAK_AUTH-SERVER-URL=http://<your ip>:5050/auth -v /var/run/docker.sock:/var/run/docker.sock -v ~/.che-multiuser:/data eclipse/che:nightly start --skip:pull --skip:nightly``` #### How to manage it - Keycloak configured with two realms. ```Master``` and ```che```. Also we have one user admin/admin in both realm. Admin user in master realm is - super admin. - Eclipse Che configured for che realm - We enabled user registration in ```Che``` realm #### Known limitation - swagger would not work. We need to upgrade a version. to support openid authentification #6015 - It's working on local docker. We are going to provide scalable version based on OpenShift on next versions. - Invitation of non-existent users to Eclipse Che organization #6335 #### How to run it when it is in a branch To run an multiuser Che version, the following steps are required after building the branch: - Rebuild init, cli and che images (in the given sequence). To do that, proceed to folder _dockerfiles/<image_name>_ and run _build.sh_ - Run Che in a usual way using cli, with additional parameters: `-e CHE_MULTIUSER=true` and `--skip:pull --skip:nightly` Full command example: `docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock -v /home/user/.che:/data -e CHE_MULTIUSER=true eclipse/che-cli:nightly start --skip:pull --skip:nightly` - MacOS users may need to edit _che.env_ file in the data folder, changing `CHE_HOST` and `CHE_KEYCLOAK_AUTH__SERVER__URL` values to their specific IP. When start is succeeded, the following docker containers should be created: - che, exposing 8080 port; - che_keycloak, exposing 5050 port; - che_postgres, exposing 5432 port;

sainirijul · 2018-01-30T22:19:31Z

Hi,
I am trying to set up a workspace supporting multiple concurrent users. For this, i am using Multiple user assembly of Eclipse che and followed this thread.

On running the below command in windows powershell:
docker run -it -e CHE_MULTIUSER=true -e CHE_HOST= -e CHE_KEYCLOAK_AUTH_SERVER_URL=http:///auth -v /var/run/docker.sock:/var/run/docker.sock -v /c/tmp:/data eclipse/che start

I am getting the below message:
WARN: Bound 'eclipse/che' to 'eclipse/che:5.22.1'
/scripts/base/startup_02_pre_docker.sh: line 14: /data/cli.log: Resource busy
INFO: (che cli): 5.22.1 - using docker 17.12.0-ce / docker4windows
WARN: Newer version '6.0.0-M4' available
INFO: (che start): Booted and reachable
INFO: (che start): Ver: 5.22.1
INFO: (che start): Use: http://localhost:8080
INFO: (che start): API: http://localhost:8080/swagger

Now can you please guide me further steps and other steps if i am missing to set up the workspace which multiple users can access concurrently from different machines ? I could not find simple straight forward documents/references for this. Your help would be highly appreciated.

Looking forward to your response.

Multi-user Eclipse Che (#6441) #### How to run it. ```docker run -it -e CHE_MULTIUSER=true -e CHE_HOST=<your ip> -e CHE_KEYCLOAK_AUTH-SERVER-URL=http://<your ip>:5050/auth -v /var/run/docker.sock:/var/run/docker.sock -v ~/.che-multiuser:/data eclipse/che:nightly start --skip:pull --skip:nightly``` #### How to manage it - Keycloak configured with two realms. ```Master``` and ```che```. Also we have one user admin/admin in both realm. Admin user in master realm is - super admin. - Eclipse Che configured for che realm - We enabled user registration in ```Che``` realm #### Known limitation - swagger would not work. We need to upgrade a version. to support openid authentification #6015 - It's working on local docker. We are going to provide scalable version based on OpenShift on next versions. - Invitation of non-existent users to Eclipse Che organization #6335 #### How to run it when it is in a branch To run an multiuser Che version, the following steps are required after building the branch: - Rebuild init, cli and che images (in the given sequence). To do that, proceed to folder _dockerfiles/<image_name>_ and run _build.sh_ - Run Che in a usual way using cli, with additional parameters: `-e CHE_MULTIUSER=true` and `--skip:pull --skip:nightly` Full command example: `docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock -v /home/user/.che:/data -e CHE_MULTIUSER=true eclipse/che-cli:nightly start --skip:pull --skip:nightly` - MacOS users may need to edit _che.env_ file in the data folder, changing `CHE_HOST` and `CHE_KEYCLOAK_AUTH__SERVER__URL` values to their specific IP. When start is succeeded, the following docker containers should be created: - che, exposing 8080 port; - che_keycloak, exposing 5050 port; - che_postgres, exposing 5432 port;

mshaposhnik and others added 30 commits July 12, 2017 11:03

Merge branch 'master' into che5362

b027fdc

Fix patch with master

203cdd0

Revert "Fix patch with master"

5fb9d0b

This reverts commit 203cdd0.

Revert "Revert "Fix patch with master""

09837c3

This reverts commit 5fb9d0b.

revert machine auth commititing

a77f283

revert machine auth commititing

33974e5

Add machine auth

013b1a7

Add machine auth

4e80799

Merge branch 'master' into che5362-2

5bde38e

refactor machine auth

340f031

Merge branch 'master' into che5362-2

448aa87

refactor machine auth

fdcc37b

Merge with master

945261d

Upgrade version

cb55c5f

machine token

9900928

Merge branch 'master' into che5362-2

e8cfd89

Fix client auth

163bf70

fixes

037859c

Merge branch 'master' into che5362-2

86fd405

Move shared code into commons-auth

372d2c2

Move shared code into commons-auth

a501f86

Move shared code into commons-auth

f087189

Move shared code into commons-auth

f0ba126

use tag version of keycloak, sort pom

43c997b

Split machine and keyclock filters

9bc7fc2

Split machine and keyclock filters

36196e5

Fix sessions

53f4337

added possibility to switch between single / multi user CHE

1163861

Merge branch 'che-multiuser' of github.com:eclipse/che into che-multi…

ba51e18

…user

minor changes

dba9cf3

Fix binding of che test user

a3841ba

ashumilova approved these changes Oct 5, 2017

View reviewed changes

akurinnoy approved these changes Oct 5, 2017

View reviewed changes

Merge with master

b291cad

davidfestal approved these changes Oct 6, 2017

View reviewed changes

vparfonov approved these changes Oct 6, 2017

View reviewed changes

Move dependencies to che-deps repo (#6606)

a399d32

garagatyi approved these changes Oct 6, 2017

View reviewed changes

mshaposhnik reviewed Oct 6, 2017

View reviewed changes

fix tabs style

14479fe

Signed-off-by: Oleksii Orel <oorel@redhat.com>

riuvshin approved these changes Oct 6, 2017

View reviewed changes

fix deploy to OS wait scripts (#6612)

511a426

eclipse-che deleted a comment from codenvy-ci Oct 6, 2017

Running integrations tests on centos/postgresql-96-centos7 image (#6614)

7ed3903

Running integrations tests on centos/postgresql-96-centos7 image

skabashnyuk merged commit ee01b29 into master Oct 6, 2017

benoitf removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Oct 6, 2017

skabashnyuk deleted the che-multiuser branch October 13, 2017 06:04

JamesDrummond mentioned this pull request Nov 7, 2017

Keycloak URL #7216

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Multi-user Eclipse Che #6441

Multi-user Eclipse Che #6441

skabashnyuk commented Sep 26, 2017 •

edited by benoitf

Loading

codenvy-ci commented Oct 5, 2017

benoitf commented Oct 5, 2017

skabashnyuk commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

mshaposhnik Oct 6, 2017 •

edited

Loading

sleshchenko Oct 6, 2017

mshaposhnik Oct 6, 2017

sleshchenko Oct 6, 2017

bmicklea commented Oct 6, 2017

skabashnyuk commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

sainirijul commented Jan 30, 2018

Multi-user Eclipse Che #6441

Multi-user Eclipse Che #6441

Conversation

skabashnyuk commented Sep 26, 2017 • edited by benoitf Loading

steps required before merge

What does this PR do?

What is it

How to run it.

How to manage it

Known limitation

How to run it when it is in a branch

What issues does this PR fix or reference?

Changelog

Release Notes

Docs PR

codenvy-ci commented Oct 5, 2017

benoitf commented Oct 5, 2017

skabashnyuk commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

mshaposhnik Oct 6, 2017 • edited Loading

Choose a reason for hiding this comment

sleshchenko Oct 6, 2017

Choose a reason for hiding this comment

mshaposhnik Oct 6, 2017

Choose a reason for hiding this comment

sleshchenko Oct 6, 2017

Choose a reason for hiding this comment

bmicklea commented Oct 6, 2017

skabashnyuk commented Oct 6, 2017

codenvy-ci commented Oct 6, 2017

sainirijul commented Jan 30, 2018

skabashnyuk commented Sep 26, 2017 •

edited by benoitf

Loading

mshaposhnik Oct 6, 2017 •

edited

Loading