Chapter 1. Reduce false positives with Exploit Intelligence

Procedure

1. In the Red Hat OpenShift Container Platform web console, navigate to Operators OperatorHub or Ecosystem Software Catalog.
2. In the Filter by keyword box, enter RHTPA exploit intelligence.
3. Click the RHTPA exploit intelligence Operator tile.
4. Read the Operator description and click Install.
5. On the Install Operator page, select the installation mode and click Install.

6. Verify the Operator installation:

   $ oc get csv -n <operator-namespace> | grep exploit-iq-operator

   The output should show the Operator with a Succeeded phase.

7. Create a project for the Exploit Intelligence stack:

   $ oc new-project exploit-iq

8. Create the API credentials secret:

   $ oc create secret generic exploit-iq-secret \
     --from-literal=ghsa_api_key="<github-token>" \
     --from-literal=nvidia_api_key="<nvidia-api-key>" \
     --from-literal=ngc_api_key="<ngc-organization-key>" \
     --from-literal=nvd_api_key="<nvd-api-key>" \
     --from-literal=serpapi_api_key="<serpapi-key>" \
     --from-literal=registry_redhat_username="<redhat-registry-username>" \
     --from-literal=registry_redhat_password="<redhat-registry-password>"

9. Create the Red Hat registry credentials secret:

   1. Download the pull secret from your Red Hat registry service account.

   2. Create the secret:

      $ oc create secret generic image-registry-credentials \
        --from-file=.dockerconfigjson=<path-to-pull-secret.json> \
        --type=kubernetes.io/dockerconfigjson

10. Create the MongoDB credentials secret.

    Choose one of the following options based on your MongoDB configuration:

    • For MongoDB with host and port:

      $ oc create secret generic mongodb-credentials \
        --from-literal=host="<mongodb-host>:27017" \
        --from-literal=username="<mongodb-username>" \
        --from-literal=password="<mongodb-password>"

    • For MongoDB Atlas or SRV connection string:

      $ oc create secret generic mongodb-credentials \
        --from-literal=connection-string="mongodb+srv://<user>:<password>@<cluster>/"

11. Optional: Create the OAuth client secret.

    Note

    The Operator automatically generates a random OAuth client secret if you do not provide one.

    1. Generate the OAuth secrets:

       $ export OAUTH_CLIENT_SECRET=$(openssl rand -base64 32)
       $ export OPENSHIFT_DOMAIN=$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')

    2. Create the secret:

       $ oc create secret generic oauth-client-secret \
         --from-literal=client-secret="$OAUTH_CLIENT_SECRET" \
         --from-literal=openshift-domain="$OPENSHIFT_DOMAIN"

12. Create the credential encryption key secret:

    $ oc create secret generic credential-encryption-key \
      --from-literal=credential-encryption-key="$(openssl rand -hex 32)"

13. Deploy the Exploit Intelligence stack by creating an ExploitIQStack custom resource:

    The Exploit Intelligence Operator provides multiple ExploitIQStack custom resource sample configurations in the exploit-iq-operator repository depending on your deployment scenario:

    • exploitiq_v1alpha1_exploitiqstack.yaml: Minimal production deployment on Red Hat OpenShift Container Platform with Routes, OAuth integration, and automatic TLS certificate management.
    • exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml: For self-hosted LLM deployments using OpenAI-compatible APIs (Ollama, vLLM, LocalAI, Text Generation Inference) instead of NVIDIA NIM.

    1. Download the ExploitIQStack custom resource for your deployment scenario:

       • For minimal production deployment:

         $ curl -O https://raw.githubusercontent.com/RHEcosystemAppEng/exploit-iq-operator/0.0.3/config/samples/exploitiq_v1alpha1_exploitiqstack.yaml

       • For self-hosted LLM deployment:

         $ curl -O https://raw.githubusercontent.com/RHEcosystemAppEng/exploit-iq-operator/0.0.3/config/samples/exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml

    2. Edit the custom resource to match your secret names:

       apiVersion: exploitiq.openshift.io/v1alpha1
       kind: ExploitIQStack
       metadata:
         name: exploit-iq
       spec:
         webApp:
           registryCredentialsSecretRef:
             name: image-registry-credentials
         database:
           mode: hostPort       # Use 'connectionString' for MongoDB Atlas
           secretRef:
             name: mongodb-credentials

    3. Apply the custom resource:

       $ oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

14. Monitor the deployment progress:

    $ oc get exploitiqstack exploit-iq -w

    Wait for the stack to reach a ready state.

15. Grant user access to the Exploit Intelligence application:

    $ oc adm groups new exploit-iq-view
    $ oc adm groups add-users exploit-iq-view <username>

16. Optional: Configure custom OIDC CA certificate.

    If your OIDC or OAuth provider uses a private or self-signed certificate authority (CA) that the WebApp does not trust by default, configure a custom CA bundle.

    Note

    This step is only required when using external OIDC providers (such as Keycloak or AWS Cognito) with custom or self-signed certificates. If you are using the default Red Hat OpenShift Container Platform OAuth or a provider with a publicly trusted certificate, skip this step.

    1. Extract the cluster domain from the API server URL:

       $ export OCP_DOMAIN=$(oc whoami --show-server | sed -E 's#^https?://api\.##; s#:[0-9]+/?$##; s#/$##')
       $ echo "Cluster domain: ${OCP_DOMAIN}"

    2. Retrieve the OAuth issuer URL from the public well-known endpoint:

       $ export OAUTH_ISSUER=$(curl -sk \
         "https://api.${OCP_DOMAIN}:6443/.well-known/oauth-authorization-server" \
         | jq -r '.issuer')
       $ echo "OAuth issuer: ${OAUTH_ISSUER}"

    3. Extract the OAuth hostname from the issuer URL:

       $ export OAUTH_HOST=$(echo "${OAUTH_ISSUER}" | sed -E 's#^https?://##; s#/.*$##')
       $ echo "OAuth host: ${OAUTH_HOST}"

    4. Create a working directory for the CA certificates:

       $ export CA_DIR=$(mktemp -d)

    5. Extract the CA certificate chain from the OAuth endpoint:

       $ openssl s_client \
         -connect "${OAUTH_HOST}:443" \
         -servername "${OAUTH_HOST}" \
         -showcerts </dev/null 2>/dev/null \
         | awk '/BEGIN CERT/,/END CERT/' \
         | awk 'BEGIN{n=0;buf=""} /BEGIN CERT/{n++;buf=""} {buf=buf $0"\n"} /END CERT/{if(n>1) printf buf}' \
         > "${CA_DIR}/oauth-ca.crt"

    6. Extract the CA certificate chain from the API server endpoint:

       $ openssl s_client \
         -connect "api.${OCP_DOMAIN}:6443" \
         -servername "api.${OCP_DOMAIN}" \
         -showcerts </dev/null 2>/dev/null \
         | awk '/BEGIN CERT/,/END CERT/' \
         | awk 'BEGIN{n=0;buf=""} /BEGIN CERT/{n++;buf=""} {buf=buf $0"\n"} /END CERT/{if(n>1) printf buf}' \
         > "${CA_DIR}/api-ca.crt"

    7. Merge both certificate chains into a single CA bundle:

       $ cat "${CA_DIR}/oauth-ca.crt" "${CA_DIR}/api-ca.crt" > "${CA_DIR}/ca-bundle.crt"

    8. Create a ConfigMap with the CA bundle in your deployment namespace:

       $ oc create configmap oidc-ca-bundle \
         --from-file=ca-bundle.crt="${CA_DIR}/ca-bundle.crt" \
         -n exploit-iq

    9. Update the ExploitIQStack custom resource to reference the CA bundle ConfigMap:

       Edit your ExploitIQStack custom resource YAML file to add the oidcCaBundleConfigMapRef field under spec.webApp:

       apiVersion: exploitiq.openshift.io/v1alpha1
       kind: ExploitIQStack
       metadata:
         name: exploit-iq
         namespace: exploit-iq
       spec:
         webApp:
           oidcCaBundleConfigMapRef:
             name: oidc-ca-bundle
           registryCredentialsSecretRef:
             name: image-registry-credentials
         database:
           mode: hostPort
           secretRef:
             name: mongodb-credentials

    10. Apply the updated custom resource:

        $ oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

        The Operator automatically mounts the ConfigMap into the WebApp pod at /etc/oidc-ca/ca-bundle.crt and configures the required environment variables.

    11. Verify that the WebApp pod mounts the OIDC CA volume:

        $ oc get pod -n exploit-iq -l app.kubernetes.io/component=webapp \
          -o jsonpath='{.items[0].spec.volumes[*].name}' | grep oidc-ca

        The output should include oidc-ca.

Verification

1. Verify that all Exploit Intelligence pods are running:

   $ oc get pods -n exploit-iq

   All pods should show a Running status.

2. Verify the ExploitIQStack custom resource status:

   $ oc get exploitiqstack exploit-iq -o yaml

   Check the status section for successful deployment conditions.

3. Access the Exploit Intelligence web interface:

   1. Retrieve the route URL:

      $ oc get route -n exploit-iq

   2. Open the route URL in a web browser and verify that you can log in using your Red Hat OpenShift Container Platform credentials.

Procedure

1. Clone the Exploit Intelligence vulnerability analysis repository:

   $ git clone https://github.com/RHEcosystemAppEng/exploit-iq-agent
   $ cd exploit-iq-agent/kustomize

2. Create a namespace for the Exploit Intelligence deployment:

   $ export YOUR_NAMESPACE_NAME=<your_namespace_name>
   $ oc new-project $YOUR_NAMESPACE_NAME

   Where:

   <your_namespace_name> is the name for your Exploit Intelligence deployment namespace, for example, exploit-iq.

3. Create the API credentials file in the base directory:

   1. Create a file named base/secrets.env with the following content:

      GHSA_API_KEY=<github_advisory_database_api_key>
      NVD_API_KEY=<national_vulnerability_database_api_key>
      NVIDIA_API_KEY=<nvidia_api_key_or_placeholder>
      SERPAPI_API_KEY=<serpapi_api_key>
      registry_redhat_username=<your_registry_username>
      registry_redhat_password=<your_registry_password_or_token>

      Where:

      <github_advisory_database_api_key>

      Your GitHub Personal Access Token with access to the GitHub Security Advisory Database API.

      <national_vulnerability_database_api_key>

      Your API key from the National Vulnerability Database (NVD).

      <nvidia_api_key_or_placeholder>

      Your NVIDIA API key for NVIDIA-hosted inference services. If using a self-hosted LLM, you can use a placeholder value.

      <serpapi_api_key>

      Your SerpAPI API key for web search functionality.

      <your_registry_username>

      Your Red Hat registry username for accessing registry.redhat.io.

      <your_registry_password_or_token>

      Your Red Hat registry password or token for authenticated pulls.

      Note

      Product scanning requires valid API credentials for authenticated access to vulnerability databases.

4. Create the image registry credentials file:

   1. Create a file named base/image-registry-credentials.env with your Red Hat registry authentication JSON:

      REGISTRY_AUTH_JSON=<registry_auth_json>

      Note

      Product scanning requires valid registry authentication JSON to pull product component container images from registry.redhat.io.

5. Configure OAuth credentials:

   1. For a first-time deployment, generate new OAuth secrets:

      $ export OAUTH_CLIENT_SECRET=$(openssl rand -base64 32)
      $ export OAUTH_SESSION_SECRET=$(openssl rand -base64 32)
      $ export OCP_DOMAIN=$(oc whoami --show-server | sed -E 's#^https?://api\.##; s#:[0-9]+/?$##; s#/$##')

   2. For reusing an existing OAuthClient, extract the existing secret:

      $ export OAUTH_CLIENT_SECRET=$(oc get oauthclient exploit-iq-client -o jsonpath='{..secret}')
      $ export OAUTH_SESSION_SECRET=$(openssl rand -base64 32)

   3. Create the base/oauth-secrets.env file with the generated secrets:

      client-secret=<oauth_client_secret>
      session-secret=<oauth_session_secret>
      openshift-domain=<openshift_cluster_domain>

      Where:

      <oauth_client_secret>

      The OAuth client secret value from the earlier step.

      <oauth_session_secret>

      The OAuth session secret value from the earlier step.

      <openshift_cluster_domain>

      The OpenShift cluster domain extracted from the earlier step.

      Note

      The OAuth client secret must be at least 32 bytes (256 bits) for HS256 signing.

6. Create the MongoDB credentials secret with the following keys:

   $ oc create secret generic mongodb-credentials \
     --from-literal=exploit-iq-user=<mongodb_user> \
     --from-literal=exploit-iq-password=<mongodb_password> \
     --from-literal=admin-user=<mongodb_admin_user> \
     --from-literal=admin-password=<mongodb_admin_password>

7. Set the callback URL:

   $ export CALLBACK_URL="https://exploit-iq-client.$(oc project -q).svc:8443"
   $ find . -type f -name 'exploit-iq-config.yml' -exec sed -i "s|CALLBACK_URL_PLACEHOLDER|$CALLBACK_URL|g" {} +

8. Configure encryption and SSL:

   1. Generate an encryption key for securing sensitive data:

      $ echo -n "credential-encryption-key=$(openssl rand -hex 32)" > base/credential-encryption-key.env

   2. Create the CA certificate bundle:

      The CA bundle file base/ca-certs/ca-bundle.crt is required before running oc kustomize in the deployment step. The bundle must include CA certificates for SSL/TLS verification of external endpoints and internal services.

      1. Create the certificate directory:

         $ mkdir -p base/ca-certs

      2. Add custom CA certificates if you need to connect to internal services:

         $ cp /path/to/your-custom-ca.pem base/ca-certs/

         where /path/to/your-custom-ca.pem is the path to your organization’s CA certificate file.

      3. Create the CA bundle file:

         $ cat /path/to/your-custom-ca.pem > base/ca-certs/ca-bundle.crt

      4. Verify the CA bundle:

         $ openssl crl2pkcs7 -nocrl -certfile base/ca-certs/ca-bundle.crt | \
           openssl pkcs7 -print_certs -noout

9. Deploy a deployment variant:

   Note

   The Exploit Intelligence deployment supports three variants depending on your LLM configuration:

   • Self-Hosted LLM: For self-managed LLM endpoints accessible over the network.
   • Self-Hosted LLM + MLOps: Includes Grafana and Tempo for observability.
   • Remote NVIDIA Inference Microservices (NIM): Uses NVIDIA-hosted inference services.

   1. For a self-hosted LLM deployment:

      $ oc kustomize overlays/self-hosted-llama3.1-70b-4bit | oc apply -f - -n $YOUR_NAMESPACE_NAME

   2. For a self-hosted LLM deployment with MLOps observability:

      Note

      This variant requires additional namespace patches and Grafana token creation. Refer to the overlay documentation for details.

      $ oc kustomize overlays/mlops | oc apply -f - -n $YOUR_NAMESPACE_NAME

   3. For a remote NIM deployment using NVIDIA-hosted services:

      $ oc kustomize overlays/remote-nim-all | oc apply -f - -n $YOUR_NAMESPACE_NAME

10. Verify the OAuth client:

    Verify that the OAuthClient resource was created with the proper redirect URIs.

    $ oc get oauthclient exploit-iq-client

    Note

    If the OAuthClient is missing, re-apply the kustomize overlay from the earlier step: $ oc kustomize overlays/<your_variant> | oc apply -f - -n $YOUR_NAMESPACE_NAME

11. Grant user access to the Exploit Intelligence application:

    $ oc adm groups new exploit-iq-view
    $ oc adm groups add-users exploit-iq-view <username>

Verification

1. Verify that the core services pods are running and in a ready state:

   $ oc get pods -n $YOUR_NAMESPACE_NAME

   Example output:

   NAME                                   READY   STATUS    RESTARTS   AGE
   exploit-iq-6dfdd8fd66-2mcnl            2/2     Running   0          2m
   exploit-iq-client-db-545b94dd6-5d9vl   1/1     Running   0          2m
   nginx-cache-595cd758db-zwkw6           1/1     Running   0          2m

   Note

   All pods should show Running status with containers ready (for example, 2/2 or 1/1). The application pod does not reach a ready state without a reachable MongoDB endpoint.

2. Access the Exploit Intelligence web interface:

   1. Retrieve the route hostname:

      $ oc get route -n $YOUR_NAMESPACE_NAME

   2. Open the route URL in a web browser and verify that you can log in using your Red Hat OpenShift Container Platform credentials.

Procedure

1. Create a Cognito User Pool if one does not already exist:

   1. Navigate to AWS Console Amazon Cognito User Pools.
   2. Click Create user pool.

   3. Follow the wizard to configure your user pool:

      • Under Cognito user pool sign-in options, select Email and Username.
      • Under Self-service sign-up, to prevent public access, disable Enable self-registration.
      • Under Required attributes, select email and preferred_username.
      • Under Initial app client, set App type to Traditional web application.
   4. Click Create user pool to complete the user pool creation.
   5. Note the User Pool ID in the format <region>_<region_id> (for example, eu-north-1_rIW9qmUNl).
   6. Note the AWS Region (for example, eu-north-1).

2. Configure a domain for the hosted UI:

   1. In your User Pool, navigate to Branding Cognito domain.
   2. Under Cognito domain, select the branding version Hosted UI (classic).

   3. Choose one of the following methods:

      Cognito domain: Enter a unique domain prefix (for example, my-exploitiq)

      Custom domain: Use your own domain with SSL certificate

   4. Note the full domain (for example, https://my-exploitiq.auth.eu-north-1.amazoncognito.com).

3. Create a resource server to define the machine-to-machine API access scope:

   1. Navigate to Application Resource servers Create resource server.
   2. Set Resource server name to ExploitIQ API.
   3. Set Identifier to exploitiq-resource-server.

   4. Add a Custom scope:

      Scope name: exploitiq-api-access

      Description: Full access to ExploitIQ API

   5. Click Create resource server.

      Note

      The full scope identifier is exploitiq-resource-server/exploitiq-api-access.

4. Create the UI app client for browser authentication:

   1. Navigate to Application App clients Create app client.
   2. Set App client name to exploitiq-ui-client.
   3. Set App type to Traditional web application.
   4. Click Create app client to create the app client.
   5. After the app client is created, navigate to Login pages of the newly created app client and click Edit to configure the managed login pages.
   6. Under Authentication flows, enable Authorization code grant.
   7. Under Allowed OAuth scopes, enable openid, profile, and email.
   8. Under Allowed OAuth scopes, add exploitiq-resource-server/exploitiq-api-access (custom scope).
   9. Under Identity providers, ensure Cognito user pool is selected.

   10. Under Allowed callback URLs, add both URLs with and without trailing slash:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>
       https://exploit-iq-client-<namespace>.apps.<cluster_domain>/

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

       Note

       These are placeholder URLs. You will update them with the actual route in step 10.

   11. Under Allowed sign-out URLs, add the API logout URL:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>/api/v1/user/logged-out

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

   12. Under Default URL, set the default redirect URL:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

   13. Click Save changes to apply the configuration.
   14. Note the Client ID and Client secret.

5. Create the machine-to-machine app client for agent authentication:

   1. Navigate to Application App clients Create app client.
   2. Set App client name to exploitiq-m2m-client.
   3. Set App type to Machine-to-machine application.
   4. Under Allowed OAuth scopes, enable exploitiq-resource-server/exploitiq-api-access.
   5. Click Create app client to create the app client.
   6. After the app client is created, navigate to Login pages of the newly created app client and click Edit to configure the managed login pages.
   7. Under OAuth 2.0 grant types, ensure Client credentials is enabled.
   8. Under Allowed custom scopes, ensure exploitiq-resource-server/exploitiq-api-access is enabled.
   9. Under Identity providers, ensure Cognito user pool is selected.
   10. Click Save changes to apply the configuration.
   11. Note the Client ID and Client secret.

6. Create a Cognito group to control access:

   1. Navigate to Users and groups Groups Create group.
   2. Set Group name to exploit-iq-admin.

   3. Click Create group.

      Note

      The cognito:groups claim in the JWT token includes the group names.

7. Create a Cognito user and add them to the group:

   1. Navigate to User management Users Create user.

   2. Configure the user information:

      • Under Alias attributes used to sign in, select Email.
      • Under Invitation message, choose whether to send an email invitation or set a temporary password.
      • Set User name to the desired username.
      • Set Email address to the user’s email.
   3. Click Create user to create the user account.
   4. After the user is created, select the user from the Users list and navigate to Group memberships.
   5. Click Add user to group and select the exploit-iq-admin group.

8. Configure the agent deployment for machine-to-machine authentication using the machine-to-machine app client credentials:

   export COGNITO_DOMAIN="https://<your_domain_prefix>.auth.<region>.amazoncognito.com"
   export COGNITO_CLIENT_ID="<m2m_app_client_id>"
   export COGNITO_CLIENT_SECRET="<m2m_app_client_secret>"
   export COGNITO_SCOPE="exploitiq-resource-server/exploitiq-api-access"
   
   oc set env deployment/exploit-iq -n $YOUR_NAMESPACE_NAME \
     AUTH_TYPE=cognito \
     COGNITO_DOMAIN="${COGNITO_DOMAIN}" \
     COGNITO_SCOPE="${COGNITO_SCOPE}" \
     COGNITO_CLIENT_ID="${COGNITO_CLIENT_ID}" \
     COGNITO_CLIENT_SECRET="${COGNITO_CLIENT_SECRET}"

   Where:

   <your_domain_prefix>

   The Cognito domain prefix you configured in step 2 (for example, my-exploitiq)

   <region>

   Your AWS region (for example, eu-north-1)

   <m2m_app_client_id>

   The Client ID from the M2M app client you created in step 5

   <m2m_app_client_secret>

   The Client secret from the M2M app client you created in step 5

9. Configure the client deployment for browser authentication using the UI app client credentials:

   export USER_POOL_ID="<region>_<region_id>"
   export AWS_REGION="<region>"
   export UI_CLIENT_ID="<ui_app_client_id>"
   export UI_CLIENT_SECRET="<ui_app_client_secret>"
   export COGNITO_DOMAIN="https://<your_domain_prefix>.auth.<region>.amazoncognito.com"
   
   oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
     QUARKUS_PROFILE=external-idp \
     QUARKUS_OIDC_ENABLED=true \
     QUARKUS_OIDC_AUTH_SERVER_URL="https://cognito-idp.${AWS_REGION}.amazonaws.com/${USER_POOL_ID}" \
     QUARKUS_OIDC_CLIENT_ID="${UI_CLIENT_ID}" \
     QUARKUS_OIDC_CREDENTIALS_SECRET="${UI_CLIENT_SECRET}" \
     QUARKUS_OIDC_APPLICATION_TYPE=hybrid \
     QUARKUS_OIDC_TOKEN_CLIENT_ID_CHECK=none \
     QUARKUS_OIDC_TOKEN_SUBJECT_REQUIRED=false \
     QUARKUS_OIDC_TOKEN_TOKEN_TYPE=access \
     QUARKUS_OIDC_USER_INFO_REQUIRED=false \
     QUARKUS_OIDC_AUTHENTICATION_USER_INFO_REQUIRED=false \
     QUARKUS_OIDC_ROLES_SOURCE=accesstoken \
     QUARKUS_OIDC_TOKEN_HEADER=Authorization \
     QUARKUS_OIDC_AUTHENTICATION_REDIRECT_PATH=/ \
     QUARKUS_SECURITY_JAXRS_DENY_UNANNOTATED_ENDPOINTS=false \
     COGNITO_DOMAIN="${COGNITO_DOMAIN}" \
     EXPLOITIQ_SECURITY_OIDC_SCOPE_ROLE_MAPPINGS='exploitiq-resource-server/exploitiq-api-access=exploitiq-api-access'

   Where:

   <region>_<region_id>

   Your User Pool ID from step 1 (for example, eu-north-1_rIW9qmUNl)

   <region>

   Your AWS region (for example, eu-north-1)

   <ui_app_client_id>

   The Client ID from the UI app client you created in step 4

   <ui_app_client_secret>

   The Client secret from the UI app client you created in step 4

   <your_domain_prefix>

   The Cognito domain prefix you configured in step 2 (for example, my-exploitiq)

10. After you create the client route, update the Cognito callback and sign-out URLs:

    1. Get the client route:

       oc get route exploit-iq-client -o jsonpath='{.spec.host}' -n $YOUR_NAMESPACE_NAME

    2. In AWS Cognito Console, navigate to Application App clients and click exploitiq-ui-client.
    3. Navigate to Login pages and click Edit.

    4. Update Allowed callback URLs with both URLs with and without trailing slash:

       https://<client_route>
       https://<client_route>/

       Where:

       <client_route>

       The route hostname you retrieved in the earlier step.

    5. Update Allowed sign-out URLs with the API logout URL:

       https://<client_route>/api/v1/user/logged-out

       Where:

       <client_route>

       The route hostname you retrieved in the earlier step.

    6. Click Save changes to apply the updated URLs.

Verification

1. Verify that users in the exploit-iq-admin group can authenticate to the Exploit Intelligence UI.
2. Verify that the agent can authenticate using the machine-to-machine credentials and access API endpoints.

Procedure

1. In your Keycloak admin console, configure a realm with the following settings:

   Realm name: quarkus (or your preferred realm name)

   SSL Required: none (for development) or external (for production)

   Brute Force Protection: Enabled (recommended for production)

2. In your Keycloak realm, create an OIDC client:

   1. Navigate to Clients Create client.
   2. Set Client ID to exploit-iq-client.
   3. Set Client Protocol to openid-connect.

   4. Enable the following settings:

      Client authentication: Enabled (confidential client)

      Standard Flow Enabled: Enabled (Authorization Code flow)

      Direct Access Grants Enabled: Enabled (Resource Owner Password Credentials flow)

      Service Accounts Enabled: Enabled (for agent authentication)

      Implicit Flow Enabled: Disabled

   5. Set Valid Redirect URIs to https://exploit-iq-client-route/* (update with your actual route after deployment).
   6. Set Web Origins to https://exploit-iq-client-route (update with your actual route after deployment).
   7. Set Client secret to match the value you created in the oidc-client-secret secret.

3. Create the openid client scope and assign it to the client. The openid scope is required for OIDC authentication flow and enables the identity token to include standard OpenID claims.

   1. In the left navigation menu under Manage, navigate to Client scopes Create client scope.
   2. Set Name to openid.
   3. Set Type to Default.
   4. Enable the Display on consent screen, Include in token scope, and Include in OpenID Provider Metadata toggle buttons.
   5. Click Save.
   6. In the left navigation menu under Manage, navigate to Clients exploit-iq-client Client scopes tab.
   7. Click Add client scope.
   8. Select openid.
   9. Set Assigned type to Default.
   10. Click Add.

4. Configure protocol mappers for the client. Add the following protocol mappers to ensure required claims are present in tokens:

   preferred_username mapper:

   Name	preferred_username
   Mapper Type	User Property
   Property	username
   Token Claim Name	preferred_username
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   email mapper:

   Name	email
   Mapper Type	User Property
   Property	email
   Token Claim Name	email
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   upn mapper:

   Name	upn
   Mapper Type	User Property
   Property	username
   Token Claim Name	upn
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

5. Create roles for authorization. Define the following roles (either at realm level or client level):

   • exploit-iq-view - Read-only access to the UI
   • exploit-iq-prodsec - Product security team access
   • exploit-iq-admin - Full administrative access
   • exploitiq-api-access - API access for service accounts

6. Assign roles to users and service accounts:

   1. Assign one of the first three roles (exploit-iq-view, exploit-iq-prodsec, or exploit-iq-admin) to human users who need UI access.
   2. Assign the exploitiq-api-access role to the service account user of the client (used by the agent) for API endpoint access.

7. Create the keycloak-credentials secret in your OCP namespace:

   oc create secret generic keycloak-credentials \
     --from-literal=client-secret=<your_client_secret> \
     -n $YOUR_NAMESPACE_NAME

   Where:

   <your_client_secret>

   The client secret from the OIDC client you created in step 2

   Note

   For development environments using the embedded Keycloak component, include admin-user and admin-password keys. For production external Keycloak instances, you must include only the client-secret key.

8. Configure the Exploit Intelligence client deployment with Keycloak environment variables:

   export KEYCLOAK_URL="https://<keycloak_hostname>/realms/quarkus"
   
   oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
     QUARKUS_PROFILE=external-idp \
     QUARKUS_OIDC_ENABLED=true \
     QUARKUS_OIDC_AUTH_SERVER_URL="${KEYCLOAK_URL}" \
     QUARKUS_OIDC_CLIENT_ID=exploit-iq-client \
     QUARKUS_OIDC_AUTHENTICATION_SCOPES=openid,profile,email

   Where:

   <keycloak_hostname>

   The fully qualified domain name of your Keycloak instance (for example, keycloak.example.com)

   The client secret is automatically loaded from the keycloak-credentials secret.

9. Configure the Exploit Intelligence agent deployment with Keycloak environment variables:

   export KC_SERVER="https://<keycloak_hostname>"
   export KC_REALM="quarkus"
   
   oc set env deployment/exploit-iq -n $YOUR_NAMESPACE_NAME \
     AUTH_TYPE=keycloak \
     KC_SERVER="${KC_SERVER}" \
     KC_CLIENT_ID=exploit-iq-client \
     KC_REALM="${KC_REALM}"

   Where:

   <keycloak_hostname>

   The fully qualified domain name of your Keycloak instance (for example, keycloak.example.com)

   The client secret is automatically loaded from the keycloak-credentials secret.

10. After you create the route, update the Keycloak client redirect URIs:

    1. Get the client route:

       oc get route exploit-iq-client -o jsonpath='{.spec.host}' -n $YOUR_NAMESPACE_NAME

    2. In Keycloak Admin Console, navigate to your client Settings.

    3. Update Valid Redirect URIs to:

       https://<client_route>/*

    4. Update Web Origins to:

       https://<client_route>

       Where:

       <client_route>

       The route hostname you retrieved in the previous step

    5. Click Save.

Verification

1. Verify that users with assigned roles can authenticate to the Exploit Intelligence UI.
2. Verify that the agent service account can authenticate and access API endpoints.

Procedure

1. In your Keycloak admin console, configure a realm with the following settings:

   Realm name: quarkus (or your preferred realm name)

   SSL Required: none (for development) or external (for production)

   Brute Force Protection: Enabled (recommended for production)

2. In your Keycloak realm, create an OIDC client:

   1. Navigate to Clients Create client.
   2. Set Client ID to exploit-iq-client.
   3. Set Client Protocol to openid-connect.

   4. Enable the following settings:

      Client authentication: Enabled (confidential client)

      Standard Flow Enabled: Enabled (Authorization Code flow)

      Direct Access Grants Enabled: Enabled (Resource Owner Password Credentials flow)

      Service Accounts Enabled: Enabled (for agent authentication)

      Implicit Flow Enabled: Disabled

   5. Set Valid Redirect URIs to https://exploit-iq-client-route/* (update with your actual route after deployment).
   6. Set Web Origins to https://exploit-iq-client-route (update with your actual route after deployment).
   7. Set Client secret to match the value you will create in the keycloak-credentials secret.

3. Create the openid client scope and assign it to the client. The openid scope is required for OIDC authentication flow and enables the identity token to include standard OpenID claims.

   1. In the left navigation menu under Manage, navigate to Client scopes Create client scope.
   2. Set Name to openid.
   3. Set Type to Default.
   4. Enable the Display on consent screen, Include in token scope, and Include in OpenID Provider Metadata toggle buttons.
   5. Click Save.
   6. In the left navigation menu under Manage, navigate to Clients exploit-iq-client Client scopes tab.
   7. Click Add client scope.
   8. Select openid.
   9. Set Assigned type to Default.
   10. Click Add.

4. Configure protocol mappers for the client. Add the following protocol mappers to ensure required claims are present in tokens:

   preferred_username mapper:

   Name	preferred_username
   Mapper Type	User Property
   Property	username
   Token Claim Name	preferred_username
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   email mapper:

   Name	email
   Mapper Type	User Property
   Property	email
   Token Claim Name	email
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   upn mapper:

   Name	upn
   Mapper Type	User Property
   Property	username
   Token Claim Name	upn
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

5. Create roles for authorization. Define the following roles (either at realm level or client level):

   • exploit-iq-view - Read-only access to the UI
   • exploit-iq-prodsec - Product security team access
   • exploit-iq-admin - Full administrative access
   • exploitiq-api-access - API access for service accounts

6. Assign roles to users and service accounts:

   1. Assign one of the first three roles (exploit-iq-view, exploit-iq-prodsec, or exploit-iq-admin) to human users who need UI access.
   2. Assign the exploitiq-api-access role to the service account user of the client (used by the agent) for API endpoint access.

7. Create the OIDC client secret in your OCP namespace:

   oc create secret generic oidc-client-secret \
     --from-literal=client-secret=<your_client_secret> \
     -n <your_namespace_name>

   Where:

   <your_client_secret>

   The client secret from the OIDC client you created in step 2

   <your_namespace_name>

   The namespace where you will deploy Exploit Intelligence (for example, exploit-iq)

   Important

   Note the secret name oidc-client-secret. You must use the same name in the ExploitIQStack custom resource spec.auth.oidc.clientSecretRef.name field.

8. Create an ExploitIQStack custom resource file with the following content:

   apiVersion: exploitiq.openshift.io/v1alpha1
   kind: ExploitIQStack
   metadata:
     labels:
       app.kubernetes.io/name: exploitiq-operator
     name: exploitiqstack-keycloak
   spec:
     auth:
       oidc:
         provider: keycloak
         issuerURL: https://<keycloak_hostname>/realms/<realm_name>
         clientID: <client_id>
         clientSecretRef:
           name: oidc-client-secret
           key: client-secret
     engine:
     webApp:
       registryCredentialsSecretRef:
         name: image-registry-credentials
     database:
       mode: hostPort
       secretRef:
         name: mongodb-credentials

   Where:

   spec.auth.oidc.issuerURL

   Replace <keycloak_hostname> with your Keycloak server hostname (for example, keycloak.example.com) and <realm_name> with your realm name (for example, quarkus)

   spec.auth.oidc.clientID

   Replace <client_id> with the Client ID from the OIDC client you created in step 2 (for example, exploit-iq-client)

   Note

   The clientSecretRef.name must match the secret name from step 7 (oidc-client-secret).

9. Apply the ExploitIQStack custom resource:

   oc apply -f exploitiq_v1alpha1_exploitiqstack_oidc_keycloak.yaml

Procedure

1. Identify the Exploit Intelligence client endpoint URL:

   $ oc get route exploit-iq-client -n <exploit_iq_namespace> -o jsonpath='{.spec.host}'

   where:

   <exploit_iq_namespace> is the OpenShift namespace where Exploit Intelligence is deployed (for example, exploit-iq).

   The endpoint is the OpenShift Route or Service URL for the exploit-iq-client deployment that you will use to configure the integration in the TrustedProfileAnalyzer custom resource.

2. In your identity provider (for example, Red Hat build of Keycloak or AWS Cognito), create an OIDC client for RHTPA with the following configuration:

   1. Set the grant type to client credentials.

   2. Assign the exploit-iq-view role:

      • For Keycloak: Assign as a realm role or client role under the exploit-iq-client client.

      • For other providers: Ensure the role appears in the groups claim of the issued token.

        Note

        Note the client ID and client secret. You will use these values in subsequent steps.

3. Ensure the client secret exists as a Kubernetes Secret in the RHTPA namespace:

   The secret can be created manually, managed by your identity provider operator, or synchronized by an external secrets manager. The TrustedProfileAnalyzer custom resource will reference this secret by name.

4. Configure Exploit Intelligence integration in the spec section of your TrustedProfileAnalyzer custom resource:

   spec:
     exploitIntelligence:
       enabled: true
       url: "https://<exploit_iq_client_route>"
       oidc:
         clientId: "<client_id>"
         clientSecret:
           valueFrom:
             secretKeyRef:
               name: <secret_name>
               key: <secret_key>
         issuerUrl: "https://<idp_host>/realms/<realm>"

   <exploit_iq_client_route>

   The Exploit Intelligence client endpoint URL from step 1.

   <client_id>

   The OIDC client ID.

   <secret_name>

   The name of the Kubernetes Secret containing the client secret.

   <secret_key>

   The key within the secret that holds the client secret value.

   <idp_host>

   Your identity provider hostname.

   <realm>

   Your identity provider realm name. For AWS Cognito, use the pattern https://cognito-idp.<region>.amazonaws.com/<user-pool-id> as the issuerUrl.

5. Apply the updated TrustedProfileAnalyzer resource:

   $ oc apply -f trustedprofileanalyzer.yaml

6. In the RHTPA web UI, navigate to an SBOM details page and select the Vulnerabilities tab.

7. Click Request Analysis in the Exploit Intelligence column for a CVE.

   The status changes to In Progress while RHTPA submits the request to Exploit Intelligence.

8. When analysis completes, review the status:

   Vulnerable

   The CVE is exploitable in this SBOM context.

   Not vulnerable

   The vulnerable code path is not reachable.

   Uncertain

   Exploitability could not be determined with sufficient confidence.

   Click the report link next to the status to view full details in the Exploit Intelligence UI.

9. View the CSAF VEX document on the RHTPA advisories page. The document is labeled exploit-intelligence.

Verification

1. In the RHTPA web UI, open an SBOM details page and select the Vulnerabilities tab.
2. Verify that the Request Analysis button appears in the Exploit Intelligence column for CVEs.

3. Check the Exploit Intelligence service logs for successful API connections:

   $ oc logs -n <exploit_iq_namespace> deployment/exploit-iq-client --tail=50

   where:

   <exploit_iq_namespace> is the OpenShift namespace where Exploit Intelligence is deployed (for example, exploit-iq).

   Confirm that log entries show analysis requests from RHTPA:

   INFO: Analysis request received from Red Hat Trusted Profile Analyzer: CVE-2024-1234 for component pkg:maven/org.example/vulnerable-lib@1.2.3
   INFO: Request queued for processing by Exploit Intelligence Engine