CadolesKube
/
sso-kustom
14
0
Fork 0
Code Issues 19 Pull Requests 4 Projects Releases Wiki Activity

wip: integrate hydra-sql in example environment

This commit is contained in:
wpetit 2024-04-04 11:52:57 +02:00
parent 546f31b2dd
commit 62ef2763de
18 changed files with 526 additions and 425 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
components/hydra-ldap/resources/deployment.yaml
View File

@ -38,7 +38,7 @@ spec:
key: WERTHER_LDAP_BINDPW
ports:
- containerPort: 8080
name: hydra-ldap-http
name: http
securityContext:
allowPrivilegeEscalation: false
capabilities:

4
components/hydra-ldap/resources/service.yaml
View File

@ -7,9 +7,9 @@ metadata:
spec:
type: ClusterIP
ports:
- name: hydra-ldap
- name: http
port: 8080
targetPort: hydra-ldap-http
targetPort: http
protocol: TCP
selector:
app.kubernetes.io/name: hydra-ldap

30
components/hydra-sql/files/hydra/sql.yaml Normal file
View File

@ -0,0 +1,30 @@
hydra:
apps:
- id: sql
title:
fr: Connexion SQL
en: Login SQL
description:
fr: Authentification avec SQL
en: Authentication with SQL
login_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGIN_URL)%"
consent_url: "%env(string:HYDRA_DISPATCHER_SQL_CONSENT_URL)%"
logout_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGOUT_URL)%"
attributes_rewrite_configuration:
uid:
rules:
- "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
email:
rules:
- "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
eduPersonAffiliation:
rules:
- "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
firewall:
rules:
email:
required: false
uid:
required: false
eduPersonAffiliation:
required: false

19
components/hydra-sql/kustomization.yaml
View File

@ -2,15 +2,15 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
resources:
- ./resources/hydra-sql-service.yaml
- ./resources/hydra-sql-deployment.yaml
- ./resources/hydra-sql-service.yaml
- ./resources/hydra-sql-deployment.yaml
generatorOptions:
labels:
com.cadoles.forge.sso-kustom/session: redis
configMapGenerator:
- name: hydra-sql-env
- name: hydra-sql-env
literals:
- ISSUER_URL="http://localhost:8000"
- BASE_URL='http://localhost:8080'
@ -23,6 +23,17 @@ configMapGenerator:
- DB_PASSWORD="makeMeASecret"
- REDIS_DSN="redis://redis:6379"
- PEPPER="MakeMeABigSecret"
- name: sql-login-config
- name: sql-login-config
files:
- ./files/sql_login.yaml
- name: hydra-dispatcher-apps
behavior: merge
files:
- ./files/hydra/sql.yaml
patchesJson6902:
- target:
version: v1
kind: ConfigMap
name: hydra-dispatcher-env
path: patches/hydra-dispatcher-env.yaml

9
components/hydra-sql/patches/hydra-dispatcher-env.yaml Normal file
View File

@ -0,0 +1,9 @@
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
value: http://hydra-sql/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
value: http://hydra-sql/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
value: http://hydra-sql/logout

4
components/oidc-test/resources/deployment.yaml
View File

@ -30,10 +30,10 @@ spec:
valueFrom:
secretKeyRef:
name: oidc-test-oauth2-client
key: client_id
key: CLIENT_ID
- name: OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: oidc-test-oauth2-client
key: client_secret
key: CLIENT_SECRET
restartPolicy: Always

16
examples/authenticated-app/README.md
View File

@ -24,14 +24,6 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
kubectl apply -k ./examples/authenticated-app
```
**Note** Il est possible d'avoir l'erreur suivante:
```
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
```
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
```
@ -55,7 +47,7 @@ kind delete cluster -n sso-kustom-example
#### URL utiles
|URL|Description|
|---|-----------|
|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|
| URL | Description |
| --------------------------------------------------- | ------------------------------------- |
| https://ssokustom/auth/saml/Shibboleth.sso/Session | Attributs de la session SP Shibboleth |
| https://ssokustom/auth/saml/Shibboleth.sso/Metadata | Métadonnées du SP Shibboleth |

7
examples/authenticated-app/kustomization.yaml
View File

@ -8,7 +8,7 @@ resources:
- ./resources/self-signed-issuer.yaml
- ./resources/port-forwarder.yaml
patchesJson6902:
patches:
- target:
version: v1
kind: ConfigMap
@ -39,3 +39,8 @@ patchesJson6902:
kind: OAuth2Client
name: oidc-test-oauth2-client
path: patches/oidc-test-oauth2-client.yaml
- target:
version: v1
kind: ConfigMap
name: hydra-sql-env
path: patches/hydra-sql-env.yaml

10
examples/authenticated-app/patches/hydra-dispatcher-env.yaml
View File

@ -28,3 +28,13 @@
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
value: https://ssokustom/auth/saml/logout
# Hydra SQL configuration
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
value: https://ssokustom/auth/sql/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
value: https://ssokustom/auth/sql/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
value: https://ssokustom/auth/sql/logout

24
examples/authenticated-app/patches/hydra-sql-env.yaml Normal file
View File

@ -0,0 +1,24 @@
- op: replace
path: "/data/BASE_URL"
value: https://ssokustom/auth/sql
- op: replace
path: "/data/ISSUER_URL"
value: https://ssokustom
- op: replace
path: "/data/ISSUER_URL"
value: https://ssokustom
- op: replace
path: "/data/HYDRA_ADMIN_BASE_URL"
value: http://hydra-dispatcher
- op: replace
path: "/data/DSN_REMOTE_DATABASE"
value: pgsql:host='postgres';port=5432;dbname=lasql
- op: replace
path: "/data/REDIS_DSN"
value: redis://redis:6379
- op: replace
path: "/data/DB_USER"
value: makeMeASecret
- op: replace
path: "/data/DB_PASSWORD"
value: rmakeMeASecret

29
examples/authenticated-app/resources/ingress.yaml
View File

@ -50,6 +50,30 @@ spec:
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-sql
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/sql(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra-sql
port:
name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-dispatcher
annotations:
@ -124,8 +148,3 @@ spec:
name: saml-idp
port:
name: https

9
examples/k8s/kind/cluster/kustomization.yaml
View File

@ -1,10 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
patchesJson6902:
- target: