OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Configuring OpenShift Container Platform OAuth server as an identity provider

OpenShift Container Platform includes a built-in OAuth server that you can use as an authentication provider for Red Hat Advanced Cluster Security for Kubernetes (RHACS).

Configuring OpenShift Container Platform OAuth server as an identity provider in Red Hat Advanced Cluster Security for Kubernetes

To integrate the built-in OpenShift Container Platform OAuth server as an identity provider for Red Hat Advanced Cluster Security for Kubernetes (RHACS) use the instructions in this section.

Prerequisites

  • You must have the AuthProvider permission to configure identity providers in RHACS.

  • You must have already configured users and groups in OpenShift Container Platform OAuth server through an identity provider. For information about the identity provider requirements, see Understanding identity provider configuration.

The following procedure configures only a single main route named central for the OpenShift Container Platform OAuth server.
Procedure

  1. On the RHACS portal, navigate to Platform Configuration → Access Control.

  2. Open the Add an Auth Provider menu and select OpenShift Auth.

  3. Enter a name for the authentication provider in the Name field.

  4. Choose a Minimum access role for users accessing RHACS by using the selected identity provider.

    For security, Red Hat recommends setting the Minimum access role to None while you complete setup. Later, you can return to the Access Control page to set up more tailored access rules based on user metadata from your identity provider.

  5. To add access rules for users and groups accessing RHACS, use the Rules section. For example:

    1. To give the Admin role to a user called administrator, you can use the following key-value pairs to create access rules:

      Key

      Value

      Name

      administrator

      Role

      Admin

    2. If you are using the HTPasswd Identity Provider with the username UserA that is part of the group GroupA, you can use the following key-value pairs to create access rules:

      Key

      Value

      Name

      UserA

      Group

      GroupA

      UserID

      <UUID>

  6. Click Save.

  • If you use a custom TLS certificate for OpenShift Container Platform OAuth server, you must add the root certificate of the CA to Red Hat Advanced Cluster Security for Kubernetes as a trusted root CA. Otherwise, Central cannot connect to the OpenShift Container Platform OAuth server.

  • To enable the OpenShift Container Platform OAuth server integration when installing Red Hat Advanced Cluster Security for Kubernetes using the roxctl CLI, set the ROX_ENABLE_OPENSHIFT_AUTH environment variable to true in Central:

    $ oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true

  • For access rules, you should use the key Name to reference the user name that the OpenShift Container Platform OAuth server returns.

  • For access rules, the OpenShift Container Platform OAuth server does not return the key Email.
Additional resources

Creating additional routes for OpenShift Container Platform OAuth server

When you configure OpenShift Container Platform OAuth server as an identity provider by using Red Hat Advanced Cluster Security for Kubernetes portal, RHACS configures only a single route for the OAuth server. However, you can create additional routes by specifying them as annotations in the Central custom resource.

Prerequisites
Procedure

  • If you installed RHACS using the RHACS Operator:

    1. Create a CENTRAL_ADDITIONAL_ROUTES environment variable that contains a patch for the Central custom resource:

      $ CENTRAL_ADDITIONAL_ROUTES='
spec:
  central:
    exposure:
      loadBalancer:
        enabled: false
        port: 443
      nodePort:
        enabled: false
      route:
        enabled: true
    persistence:
      persistentVolumeClaim:
        claimName: stackrox-db
  customize:
    annotations:
      serviceaccounts.openshift.io/oauth-redirecturi.main: sso/providers/openshift/callback (1)
      serviceaccounts.openshift.io/oauth-redirectreference.main: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"central\"}}" (2)
      serviceaccounts.openshift.io/oauth-redirecturi.second: sso/providers/openshift/callback (3)
      serviceaccounts.openshift.io/oauth-redirectreference.second: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"second-central\"}}" (4)
'
      1 The redirect URI for setting the main route.
      2 The redirect URI reference for the main route.
      3 The redirect for setting the second route.
      4 The redirect reference for the second route.

    2. Apply the CENTRAL_ADDITIONAL_ROUTES patch to the Central custom resource:

      $ oc patch centrals.platform.stackrox.io \
  -n <namespace> \ (1)
  <custom-resource> \ (2)
  --patch "$CENTRAL_ADDITIONAL_ROUTES" \
  --type=merge
      1 Replace <namespace> with the name of the project that contains the Central custom resource.
      2 Replace <custom-resource> with the name of the Central custom resource.

  • Or, if you installed RHACS using Helm:

    1. Add the following annotations to your values-public.yaml file:

      customize:
  central:
    annotations:
      serviceaccounts.openshift.io/oauth-redirecturi.main: sso/providers/openshift/callback (1)
      serviceaccounts.openshift.io/oauth-redirectreference.main: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"central\"}}" (2)
      serviceaccounts.openshift.io/oauth-redirecturi.second: sso/providers/openshift/callback (3)
      serviceaccounts.openshift.io/oauth-redirectreference.second: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"second-central\"}}" (4)
      1 The redirect for setting the main route.
      2 The redirect reference for the main route.
      3 The redirect for setting the second route.
      4 The redirect reference for the second route.

    2. Apply the custom annotations to the Central custom resource by using helm upgrade:

      $ helm upgrade -n stackrox \
  stackrox-central-services rhacs/central-services \
  -f <path_to_values_public.yaml> (1)
      1 Specify the path of the values-public.yaml configuration file using the -f option.
Additional resources