Chapter 10. Keyless authentication with robot accounts

Procedure

1. On the Red Hat Single Sign-On UI:

   1. Click Clients and then the name of the application or service that can request authentication of a user.

   2. On the Settings page of your client, ensure that the following options are set or enabled:

      • Client ID
      • Valid redirect URI
      • Client authentication
      • Authorization
      • Standard flow

      • Direct access grants

        Note

        Settings can differ depending on your setup.

   3. On the Credentials page, store the Client Secret for future use.
   4. On the Users page, click Add user and enter a username, for example, service-account-quaydev. Then, click Create.
   5. Click the name of the user, for example service-account-quaydev on the Users page.
   6. Click the Credentials tab Set password and provide a password for the user. If warranted, you can make this password temporary by selecting the Temporary option.

   7. Click the Realm settings tab OpenID Endpoint Configuration. Store the /protocol/openid-connect/token endpoint. For example:

      http://localhost:8080/realms/master/protocol/openid-connect/token

2. On a web browser, navigate to the following URL:

   http://<keycloak_url>/realms/<realm_name>/protocol/openid-connect/auth?response_type=code&client_id=<client_id>

3. When prompted, log in with the service-account-quaydev user and the temporary password you set. Complete the login by providing the required information and setting a permanent password if necessary.

4. You are redirected to the URI address provided for your client. For example:

   https://localhost:3000/cb?session_state=5c9bce22-6b85-4654-b716-e9bbb3e755bc&iss=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Fmaster&code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43

   Take note of the code provided in the address. For example:

   code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43

   Note

   This is a temporary code that can only be used one time. If necessary, you can refresh the page or revisit the URL to obtain another code.

5. On your terminal, use the following curl -X POST command to generate a temporary OAuth2 access token:

   $ curl -X POST "http://localhost:8080/realms/master/protocol/openid-connect/token" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "client_id=quaydev" \
   -d "client_secret=g8gPsBLxVrLo2PjmZkYBdKvcB9C7fmBz" \
   -d "grant_type=authorization_code" \
   -d "code=ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43"

   where:

   http://localhost:8080/realms/master/protocol/openid-connect/token

   Specifies the protocol/openid-connect/token endpoint found on the Realm settings page of the Red Hat Single Sign-On UI.

   quaydev

   Specifies the Client ID used for this procedure.

   g8gPsBLxVrLo2PjmZkYBdKvcB9C7fmBz

   Specifies the Client Secret for the Client ID.

   ea5b76eb-47a5-4e5d-8f71-0892178250db.5c9bce22-6b85-4654-b716-e9bbb3e755bc.cdffafbc-20fb-42b9-b254-866017057f43

   Specifies the code returned from the redirect URI.

   Example output

   {"access_token":"<access_token>...",
   "expires_in":60,"refresh_expires_in":1800,"refresh_token":"<refresh_token>","token_type":"Bearer","not-before-policy":0,"session_state":"5c9bce22-6b85-4654-b716-e9bbb3e755bc","scope":"profile email"}

6. Store the access_token from the previous step so that you can exchange it for a Red Hat Quay robot account token in the following procedure.

Procedure

1. On the Red Hat Single Sign-On main page:

   1. Select the appropriate realm that is authenticated for use with Red Hat Quay. Store the issuer URL, for example, https://keycloak-auth-realm.quayadmin.org/realms/quayrealm.
   2. Click Users the name of the user to be linked with the robot account for authentication. You must use the same user account that you used when generating the OAuth2 access token.

   3. On the Details page, store the ID of the user, for example, 449e14f8-9eb5-4d59-a63e-b7a77c75f770.

      Note

      The information collected in this step varies depending on your OIDC provider. For example, with Red Hat Single Sign-On, the ID of a user is used as the Subject to configure the robot account federation in a subsequent step. For a different OIDC provider, like Microsoft Entra ID, this information is stored as the Subject.

2. On your Red Hat Quay registry:

   1. Navigate to Organizations and click the name of your organization, for example, fed_test.
   2. Click Robot Accounts.
   3. Click the menu kebab Set robot federation.
   4. Click the + symbol.

   5. In the popup window, include the following information:

      • Issuer URL: https://keycloak-auth-realm.quayadmin.org/realms/quayrealm. For Red Hat Single Sign-On, this is the URL of your Red Hat Single Sign-On realm. This might vary depending on your OIDC provider.
      • Subject: 449e14f8-9eb5-4d59-a63e-b7a77c75f770. For Red Hat Single Sign-On, the Subject is the ID of your Red Hat Single Sign-On user. This varies depending on your OIDC provider. For example, if you are using Microsoft Entra ID, the Subject is the Subject of your Entra ID user.

   6. Click Save.

      Note

      The Red Hat Quay v2 UI federation modal accepts Issuer URL and Subject only.

Procedure

1. Create or update the robot federation configuration by using POST /api/v1/organization/{orgname}/robots/{robot_shortname}/federation. Include issuer and subject in each federation entry. For example:

   $ curl -X POST "https://<quay-server.example.com>/api/v1/organization/fed_test/robots/robot1/federation" \
     -H "Authorization: Bearer <your_access_token>" \
     -H "Content-Type: application/json" \
     -d '[
       {
         "issuer": "https://login.microsoftonline.com/<tenant-id>/v2.0",
         "subject": "<user-object-id>"
       }
     ]'

2. After you configure federation, exchange an external OIDC access token for a Red Hat Quay robot token.

Procedure

1. Save the following Python script in a .py file, for example, robot_fed_token_auth.py:

   import requests
   import os
   
   TOKEN=os.environ.get('TOKEN')
   robot_user = "fed-test+robot1"
   
   def get_quay_robot_token(fed_token):
       URL = "https://<quay-server.example.com>/oauth2/federation/robot/token"
       response = requests.get(URL, auth=(robot_user,fed_token))
       print(response)
       print(response.text)
   
   if __name__ == "__main__":
       get_quay_robot_token(TOKEN)

   where:

   response = requests.get(URL, auth=(robot_user,fed_token))

   Specifies the request that retrieves the robot token. If your Red Hat Quay deployment is using custom SSL/TLS certificates, the response must be response = requests.get(URL,auth=(robot_user,fed_token),verify=False), which includes the verify=False flag.

2. Export the OAuth2 access token as TOKEN. For example:

   $ export TOKEN=<export_token>...

3. Run the robot_fed_token_auth.py script by entering the following command:

   $ python3 robot_fed_token_auth.py

   Example output

   <Response [200]>
   {"token": "string..."}

   Important

   This token expires after one hour. After one hour, you must generate a new token.

4. Export the robot account access token as QUAY_TOKEN. For example:

   $ export QUAY_TOKEN=<quay_token>

Procedure

1. Log in to your Red Hat Quay registry by using the fed_test+robot1 robot account and the QUAY_TOKEN access token. For example:

   $ podman login <quay-server.example.com> -u fed_test+robot1 -p $QUAY_TOKEN

2. Pull an image from a Red Hat Quay repository for which the robot account has the proper permissions. For example:

   $ podman pull <quay-server.example.com>/<repository_name>/<image_name>

   Example output

   Getting image source signatures
   Copying blob 900e6061671b done
   Copying config 8135583d97 done
   Writing manifest to image destination
   Storing signatures
   8135583d97feb82398909c9c97607159e6db2c4ca2c885c0b8f590ee0f9fe90d
   0.57user 0.11system 0:00.99elapsed 68%CPU (0avgtext+0avgdata 78716maxresident)k
   800inputs+15424outputs (18major+6528minor)pagefaults 0swaps

3. Attempt to pull an image from a Red Hat Quay repository for which the robot account does not have the proper permissions. For example:

   $ podman pull <quay-server.example.com>/<different_repository_name>/<image_name>

   Example output

   Error: initializing source docker://quay-server.example.com/example_repository/busybox:latest: reading manifest in quay-server.example.com/example_repository/busybox: unauthorized: access to the requested resource is not authorized

   After one hour, the credentials for this robot account expire. Afterwards, you must generate a new access token for this robot account.