fix: example app deployment with saml login app

This commit is contained in:
wpetit 2023-11-02 18:32:37 +01:00
parent 8075071f22
commit 518d9d6177
25 changed files with 317 additions and 82 deletions

View File

@ -10,4 +10,4 @@ hydra:
login_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGIN_URL)%" login_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGIN_URL)%"
consent_url: "%env(string:HYDRA_DISPATCHER_SAML_CONSENT_URL)%" consent_url: "%env(string:HYDRA_DISPATCHER_SAML_CONSENT_URL)%"
logout_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGOUT_URL)%" logout_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGOUT_URL)%"
attributes_rewrite_rules: [] attributes_rewrite_configuration: {}

View File

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: hydra-saml-remote-user - name: hydra-saml-remote-user
image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-170-g485b138 image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-218-g4b5e1d9
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-saml-env name: hydra-saml-env

View File

@ -6,7 +6,7 @@ metadata:
name: hydra-saml-remote-user name: hydra-saml-remote-user
spec: spec:
ports: ports:
- name: hydra-saml-remote-user - name: http
port: 80 port: 80
selector: selector:
io.kompose.service: hydra-saml-remote-user io.kompose.service: hydra-saml-remote-user

View File

@ -6,7 +6,7 @@ metadata:
name: hydra-saml name: hydra-saml
spec: spec:
ports: ports:
- name: hydra-saml-shibboleth-sp - name: http
port: 80 port: 80
selector: selector:
io.kompose.service: hydra-saml-shibboleth-sp io.kompose.service: hydra-saml-shibboleth-sp

View File

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: hydra-saml-shibboleth-sp - name: hydra-saml-shibboleth-sp
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-172-g0f44679 image: reg.cadoles.com/wpetit/shibboleth-sp-v3:v0.0.0-230-g266901c
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-saml-env name: hydra-saml-env

View File

@ -1,19 +1,21 @@
# Exemple: Déploiement d'une application authentifiée avec la stack SSO # Exemple: Déploiement d'une application authentifiée avec la stack SSO
L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
## Procédure ## Procédure
### Avec `k3d` ### Avec `kind`
1. Créer un cluster avec `k3d` 1. Créer un cluster avec `kind`
``` ```
k3d cluster create -c ./examples/k8s/k3d/k3d/cluster-config.yaml kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
``` ```
2. Déployer les opérateurs nécessaires au déploiement 2. Déployer les opérateurs nécessaires au déploiement
``` ```
kubectl apply -k ./examples/k8s/k3d/cluster kubectl kustomize --enable-helm ./examples/k8s/kind/cluster | kubectl apply -f -
``` ```
3. Déployer l'application 3. Déployer l'application
@ -22,4 +24,25 @@
kubectl apply -k ./examples/authenticated-app kubectl apply -k ./examples/authenticated-app
``` ```
Après stabilisation du déploiement, l'application devrait être accessible à l'adresse http://localhost:8080/ **Note** Il est possible d'avoir l'erreur suivante:
```
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
```
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
```
127.0.0.1 ssokustom
```
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
#### Supprimer le cluster
```
kind delete cluster -n sso-kustom-example
```

View File

@ -7,7 +7,9 @@ resources:
- ./resources/app-deployment.yaml - ./resources/app-deployment.yaml
- ./resources/app-service.yaml - ./resources/app-service.yaml
- ./resources/ingress.yaml - ./resources/ingress.yaml
- ./resources/ingress-prefix-traefik-middleware.yaml - ./resources/oauth2-client.yaml
- ./resources/saml-idp.yaml
- ./resources/self-signed-issuer.yaml
- ./resources/port-forwarder-deployment.yaml - ./resources/port-forwarder-deployment.yaml
- ./resources/port-forwarder-service.yaml - ./resources/port-forwarder-service.yaml

View File

@ -1,18 +1,30 @@
- op: replace - op: replace
path: "/data/HYDRA_BASE_URL" path: "/data/HYDRA_BASE_URL"
value: http://ssokustom:8080/auth value: http://hydra:4444
- op: replace - op: replace
path: "/data/HYDRA_ADMIN_BASE_URL" path: "/data/HYDRA_ADMIN_BASE_URL"
value: http://hydra:4445/admin value: http://hydra:4445/admin
- op: replace - op: replace
path: "/data/HYDRA_ORIGINAL_ISSUER" path: "/data/HYDRA_ORIGINAL_ISSUER"
value: http://ssokustom:8080/auth value: http://hydra:4444
- op: replace - op: replace
path: "/data/HYDRA_NEW_ISSUER" path: "/data/HYDRA_NEW_ISSUER"
value: http://ssokustom:8080/auth/dispatcher/ value: https://ssokustom/auth/dispatcher
- op: replace - op: replace
path: "/data/BASE_URL" path: "/data/BASE_URL"
value: http://ssokustom:8080/auth/dispatcher value: https://ssokustom/auth/dispatcher
- op: replace - op: replace
path: "/data/COOKIE_PATH" path: "/data/COOKIE_PATH"
value: /auth/dispatcher value: /auth/dispatcher
# Hydra SAML configuration
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_LOGIN_URL"
value: https://ssokustom/auth/saml/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_CONSENT_URL"
value: https://ssokustom/auth/saml/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
value: https://ssokustom/auth/saml/logout

View File

@ -1,15 +1,15 @@
- op: replace - op: replace
path: "/data/URLS_SELF_ISSUER" path: "/data/URLS_SELF_ISSUER"
value: http://ssokustom:8080/auth value: https://ssokustom/auth
- op: replace - op: replace
path: "/data/URLS_LOGIN" path: "/data/URLS_LOGIN"
value: http://ssokustom:8080/auth/dispatcher/login value: https://ssokustom/auth/dispatcher/login
- op: replace - op: replace
path: "/data/URLS_LOGOUT" path: "/data/URLS_LOGOUT"
value: http://ssokustom:8080/auth/dispatcher/logout value: https://ssokustom/auth/dispatcher/logout
- op: replace - op: replace
path: "/data/URLS_CONSENT" path: "/data/URLS_CONSENT"
value: http://ssokustom:8080/auth/dispatcher/consent value: https://ssokustom/auth/dispatcher/consent
- op: replace - op: replace
path: "/data/HYDRA_SERVE_ALL_ARGS" path: "/data/HYDRA_SERVE_ALL_ARGS"
value: "--dev" value: "--dev"

View File

@ -1,6 +1,6 @@
- op: replace - op: replace
path: "/data/HTTP_BASE_URL" path: "/data/HTTP_BASE_URL"
value: http://ssokustom:8080/auth/saml value: https://ssokustom/auth/saml
- op: replace - op: replace
path: "/data/COOKIE_PATH" path: "/data/COOKIE_PATH"
value: /auth/saml value: /auth/saml
@ -9,23 +9,29 @@
value: http://hydra-dispatcher value: http://hydra-dispatcher
- op: replace - op: replace
path: "/data/LOGOUT_REDIRECT_URL_PATTERN" path: "/data/LOGOUT_REDIRECT_URL_PATTERN"
value: http://ssokustom:8080/auth/saml/Shibboleth.sso/Logout?return=%s value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=%s
- op: replace - op: replace
path: "/data/SP_ENTITY_ID" path: "/data/SP_ENTITY_ID"
value: http://ssokustom:8080/auth/saml value: https://ssokustom/auth/saml
- op: replace - op: replace
path: "/data/IDP_ENTITY_ID" path: "/data/IDP_ENTITY_ID"
value: http://ssokustom:8080/idp value: http://ssokustom/simplesaml/saml2/idp/metadata.php
- op: replace - op: replace
path: "/data/IDP_METADATA_URL" path: "/data/IDP_METADATA_URL"
value: http://ssokustom:8080/idp/metadata value: http://ssokustom/simplesaml/saml2/idp/metadata.php
- op: replace
path: "/data/APACHE_BACKEND_URL"
value: http://hydra-remote-user
- op: replace - op: replace
path: "/data/APACHE_FORCE_HTTPS" path: "/data/APACHE_FORCE_HTTPS"
value: "false" value: "false"
- op: replace - op: replace
path: "/data/SP_HANDLER_BASE_PATH" path: "/data/SP_HANDLER_BASE_PATH"
value: /auth/saml value: /
- op: replace
path: "/data/SP_LOG_LEVEL"
value: DEBUG
- op: replace
path: "/data/SP_SESSIONS_REDIRECT_LIMIT"
value: none
- op: replace
path: "/data/SP_SESSIONS_REDIRECT_ALLOW"
value: https://ssokustom

View File

@ -17,7 +17,7 @@ spec:
io.kompose.service: app io.kompose.service: app
spec: spec:
containers: containers:
- image: bornholm/oidc-test:v0.0.0-1-g936a77e - image: bornholm/oidc-test:v0.0.0-6-g96f1f8f
name: app name: app
ports: ports:
- containerPort: 8080 - containerPort: 8080
@ -28,13 +28,21 @@ spec:
- name: HTTP_ADDRESS - name: HTTP_ADDRESS
value: 0.0.0.0:8080 value: 0.0.0.0:8080
- name: OIDC_CLIENT_ID - name: OIDC_CLIENT_ID
value: oidc-test valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_id
- name: OIDC_CLIENT_SECRET - name: OIDC_CLIENT_SECRET
value: oidc-test-123456 valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_secret
- name: OIDC_ISSUER_URL - name: OIDC_ISSUER_URL
value: http://ssokustom:8080/auth value: http://hydra:4444
- name: OIDC_REDIRECT_URL - name: OIDC_REDIRECT_URL
value: http://ssokustom:8080 value: https://ssokustom
- name: OIDC_POST_LOGOUT_REDIRECT_URL - name: OIDC_POST_LOGOUT_REDIRECT_URL
value: http://ssokustom:8080 value: https://ssokustom
- name: OIDC_SKIP_ISSUER_VERIFICATION
value: "true"
restartPolicy: Always restartPolicy: Always

View File

@ -1,10 +0,0 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: ingress-prefix
spec:
stripPrefixRegex:
regex:
- ^/auth/dispatcher
- ^/auth/saml
- ^/auth

View File

@ -1,11 +1,17 @@
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
name: portal name: app
annotations: annotations:
ingress.kubernetes.io/ssl-redirect: "false" nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
traefik.ingress.kubernetes.io/router.middlewares: default-ingress-prefix@kubernetescrd cert-manager.io/issuer: "self-signed"
spec: spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
- ssokustom
secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
@ -16,8 +22,26 @@ spec:
name: app name: app
port: port:
name: http name: http
---
- path: /auth/dispatcher apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/dispatcher(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
@ -25,7 +49,7 @@ spec:
port: port:
name: http name: http
- path: /auth - path: /auth(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
@ -33,11 +57,41 @@ spec:
port: port:
name: hydra-public name: hydra-public
# - path: /auth/passwordless/?(.*) - path: /auth/saml(/|$)(.*)
# pathType: Prefix pathType: Prefix
# backend: backend:
# service: service:
# name: hydra name: hydra-saml
# port: port:
# name: http-public name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: saml-idp
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /simplesaml/$2
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /simplesaml(/|$)(.*)
pathType: Prefix
backend:
service:
name: saml-idp
port:
name: http

View File

@ -0,0 +1,18 @@
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
name: app-oauth2-client
spec:
clientName: "app"
tokenEndpointAuthMethod: "client_secret_basic"
grantTypes:
- authorization_code
- refresh_token
responseTypes:
- code
scope: "openid profile email"
secretName: app-oidc-secret
redirectUris:
- https://ssokustom
postLogoutRedirectUris:
- https://ssokustom

View File

@ -18,12 +18,21 @@ spec:
spec: spec:
containers: containers:
- image: hpello/tcp-proxy:latest - image: hpello/tcp-proxy:latest
name: port-forwarder name: port-forwarder-https
env: env:
- name: LISTEN_PORT - name: LISTEN_PORT
value: "8080" value: "443"
ports: ports:
- containerPort: 8080 - containerPort: 443
resources: {} resources: {}
args: ["traefik.kube-system.svc.cluster.local", "80"] args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "443"]
- image: hpello/tcp-proxy:latest
name: port-forwarder-http
env:
- name: LISTEN_PORT
value: "80"
ports:
- containerPort: 80
resources: {}
args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "80"]
restartPolicy: Always restartPolicy: Always

View File

@ -6,7 +6,11 @@ metadata:
io.kompose.service: port-forwarder io.kompose.service: port-forwarder
spec: spec:
ports: ports:
- port: 8080 - name: https
targetPort: 8080 port: 443
targetPort: 443
- name: http
port: 80
targetPort: 80
selector: selector:
io.kompose.service: port-forwarder io.kompose.service: port-forwarder

View File

@ -0,0 +1,51 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: saml-idp
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: saml-idp
spec:
containers:
- image: kristophjunge/test-saml-idp:1.15
name: saml-idp
ports:
- containerPort: 8443
resources: {}
env:
- name: SIMPLESAMLPHP_SP_ENTITY_ID
value: https://ssokustom/auth/saml
- name: SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/SAML2/POST
- name: SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=https://ssokustom
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
ports:
- name: http
port: 8080
targetPort: 8080
- name: https
port: 8443
targetPort: 8443
selector:
io.kompose.service: saml-idp
status:
loadBalancer: {}

View File

@ -0,0 +1,6 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: self-signed
spec:
selfSigned: {}

View File

@ -1,11 +0,0 @@
---
apiVersion: k3d.io/v1alpha4
kind: Simple
metadata:
name: sso-kustom
servers: 1
agents: 2
ports:
- port: 8080:80
nodeFilters:
- loadbalancer

View File

@ -1,4 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop

View File

@ -0,0 +1,45 @@
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: sso-kustom-example
nodes:
- role: control-plane
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: InitConfiguration
nodeRegistration:
kubeletExtraArgs:
node-labels: "ingress-ready=true"
extraPortMappings:
- containerPort: 80
hostPort: 80
listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
- containerPort: 443
hostPort: 443
listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
labels:
ingress-ready: true
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi

1
examples/k8s/kind/cluster/.gitignore vendored Normal file
View File

@ -0,0 +1 @@
/charts

View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml

View File

@ -1,2 +1,17 @@
parameters:
env(HYDRA_DISPATCHER_WEBHOOK_ENABLED): false
env(HYDRA_DISPATCHER_WEBHOOK_API_URL): ""
env(HYDRA_DISPATCHER_WEBHOOK_API_KEY): ""
env(HYDRA_DISPATCHER_WEBHOOK_API_METHOD): POST
env(HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES): true
hydra: hydra:
apps: [] apps: []
webhook:
enabled: "%env(bool:HYDRA_DISPATCHER_WEBHOOK_ENABLED)%"
api_url: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_URL)%"
api_key: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_KEY)%"
api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
firewall:
additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
rules: {}

View File

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: hydra-dispatcher - name: hydra-dispatcher
image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-218-g4b5e1d9 image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-238-g7236416
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-dispatcher-env name: hydra-dispatcher-env