authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC #291

Ruoyu-y · 2024-08-12T02:47:07Z

Description

Support GUI-based authentication and authorization with the help of Istio, oauth2-proxy and OIDC provider.

Issues

#169

Type of change

List the type of change like below. Please delete options that are not relevant.

[*] New feature (non-breaking change which adds new functionality)

Dependencies

oauth2-proxy

Tests

n/a

Ruoyu-y · 2024-08-12T02:48:57Z

Please do NOT merge before #260 got merged. I need to do a rebase for this.

irisdingbj · 2024-08-12T17:52:20Z

microservices-connector/config/authN-authZ/README.md

+# then deploy oauth2-proxy
+export REALM=<YOUR_REALM_NAME>
+export CLIENT=<YOUR_CLIENT_NAME>
+envsubst < $(pwd)/config/authN-authZ/oauth2_install.yaml | kubectl -n chatqa apply -f -


Does it matter if we have istio sidecar injeciton for oauth2-proxy and keycloak or not? better to have this info in the steps

Thanks for the notice. Let me add that

zhlsunshine · 2024-08-14T07:34:20Z

microservices-connector/config/authN-authZ/README.md

+
+<img src="./docs/create_realm.png" width="600" height="300">
+
+2. Create a new client called `chatqna` and set `Client authentication` to 'On'. Set "http://chatqna-ui.com:${INGRESS_PORT}/*" in the `Valid redirect URIs` part. Under the Credentials tab you will now be able to locate `<your client's secret>`, which will be used in the oauth2-proxy configs.


Hi @Ruoyu-y, we may need to tell user how to obtain this INGRESS_PORT, by executing shell command or a link of Istio?

The same to INGRESS_HOST

At the top of the readme, I am redirecting them to the istio website to do that. Maybe i can just add the notice again here.

zhlsunshine · 2024-08-14T09:13:33Z

microservices-connector/config/authN-authZ/README.md

+
+<img src="./docs/create_user.png" width="600" height="300">
+
+5. Create a new Client Scope with the name `groups` in Keycloak with `Include in Token Scope` set as `On`. Include a mapper of type `Group Membership` and set the `Token Claim Name` to `groups`. If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the --allowed-group option of OAuth2 Proxy. Example: "/groupname". After creating the Client Scope named `groups` you will need to attach it to your client. Go to Clients and find `<your client's id> -> Client scopes` and add client scope and select `groups` and choose `Optional` and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.


Suggested change

5. Create a new Client Scope with the name `groups` in Keycloak with `Include in Token Scope` set as `On`. Include a mapper of type `Group Membership` and set the `Token Claim Name` to `groups`. If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the --allowed-group option of OAuth2 Proxy. Example: "/groupname". After creating the Client Scope named `groups` you will need to attach it to your client. Go to Clients and find `<your client's id> -> Client scopes` and add client scope and select `groups` and choose `Optional` and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.

6. Create a new Client Scope with the name `groups` in Keycloak with `Include in Token Scope` set as `On`. Include a mapper of type `Group Membership` and set the `Token Claim Name` to `groups`. If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the --allowed-group option of OAuth2 Proxy. Example: "/groupname". After creating the Client Scope named `groups` you will need to attach it to your client. Go to Clients and find `<your client's id> -> Client scopes` and add client scope and select `groups` and choose `Optional` and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.

Thanks for comment. Will revise.

zhlsunshine · 2024-08-14T09:14:04Z

microservices-connector/config/authN-authZ/README.md

+
+<img src="./docs/attach_group_scope.png" width="600" height="300">
+
+6. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.


Suggested change

6. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.

7. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.

* Add more descriptions for the authentication and authorization part * change the sample authorization to perform on role Signed-off-by: Ruoyu Ying <ruoyu.ying@intel.com>

* add the yamls for configurations of oauth2 * add oauth2-proxy installation guide * update documentations Signed-off-by: Ruoyu Ying <ruoyu.ying@intel.com>

for more information, see https://pre-commit.ci

irisdingbj · 2024-08-15T16:12:40Z

@Ruoyu-y plz remove the draft status from this PR so that we can get it merged

zhlsunshine

Thanks @Ruoyu-y, LGTM!

Ruoyu-y marked this pull request as draft August 12, 2024 02:47

Ruoyu-y changed the title ~~gmc: add oauth2-proxy support for authentication and authorization~~ authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC Aug 12, 2024

irisdingbj reviewed Aug 12, 2024

View reviewed changes

Ruoyu-y force-pushed the auth-oauth2 branch from ceb9bd7 to 79ecde3 Compare August 12, 2024 23:33

irisdingbj approved these changes Aug 13, 2024

View reviewed changes

zhlsunshine reviewed Aug 14, 2024

View reviewed changes

Ruoyu-y added 2 commits August 15, 2024 08:18

authN-authZ: update documentation and policy

919e492

* Add more descriptions for the authentication and authorization part * change the sample authorization to perform on role Signed-off-by: Ruoyu Ying <ruoyu.ying@intel.com>

authN-authZ: add documentation and configs for oauth2

2b12a68

* add the yamls for configurations of oauth2 * add oauth2-proxy installation guide * update documentations Signed-off-by: Ruoyu Ying <ruoyu.ying@intel.com>

Ruoyu-y force-pushed the auth-oauth2 branch from feed1da to 2b12a68 Compare August 15, 2024 00:19

[pre-commit.ci] auto fixes from pre-commit.com hooks

b267cf9

for more information, see https://pre-commit.ci

irisdingbj marked this pull request as ready for review August 15, 2024 16:15

Merge branch 'main' into auth-oauth2

d2ab2da

kevinintel mentioned this pull request Aug 16, 2024

Authentication and Authorization opea-project/GenAIComps#491

Closed

zhlsunshine approved these changes Aug 16, 2024

View reviewed changes

zhlsunshine merged commit 488a1ca into opea-project:main Aug 16, 2024
7 checks passed

Ruoyu-y mentioned this pull request Aug 19, 2024

authN-authZ: update documentation and policy #260

Closed

Ruoyu-y deleted the auth-oauth2 branch August 26, 2024 05:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC #291

authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC #291

Ruoyu-y commented Aug 12, 2024

Ruoyu-y commented Aug 12, 2024 •

edited

Loading

irisdingbj Aug 12, 2024

Ruoyu-y Aug 12, 2024

zhlsunshine Aug 14, 2024

zhlsunshine Aug 14, 2024

Ruoyu-y Aug 15, 2024

Ruoyu-y Aug 15, 2024

zhlsunshine Aug 14, 2024

Ruoyu-y Aug 15, 2024

Ruoyu-y Aug 15, 2024

zhlsunshine Aug 14, 2024

Ruoyu-y Aug 15, 2024

irisdingbj commented Aug 15, 2024

zhlsunshine left a comment


		<img src="./docs/create_realm.png" width="600" height="300">

		2. Create a new client called `chatqna` and set `Client authentication` to 'On'. Set "http://chatqna-ui.com:${INGRESS_PORT}/*" in the `Valid redirect URIs` part. Under the Credentials tab you will now be able to locate `<your client's secret>`, which will be used in the oauth2-proxy configs.


		<img src="./docs/create_user.png" width="600" height="300">

		5. Create a new Client Scope with the name `groups` in Keycloak with `Include in Token Scope` set as `On`. Include a mapper of type `Group Membership` and set the `Token Claim Name` to `groups`. If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the --allowed-group option of OAuth2 Proxy. Example: "/groupname". After creating the Client Scope named `groups` you will need to attach it to your client. Go to Clients and find `<your client's id> -> Client scopes` and add client scope and select `groups` and choose `Optional` and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.


		<img src="./docs/attach_group_scope.png" width="600" height="300">

		6. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.

	6. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.
	7. Create two groups `user` and `viewer` by navigating to Groups -> Create group. Assign role `user` to group `user` and role `viewer` to group `viewer` and add user `mary` as a member of group `user` and `bob` as a member of group `viewer`.

authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC #291

authN-authZ: add oauth2-proxy support for authentication and authorization together with GMC #291

Conversation

Ruoyu-y commented Aug 12, 2024

Description

Issues

Type of change

Dependencies

Tests

Ruoyu-y commented Aug 12, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

irisdingbj commented Aug 15, 2024

zhlsunshine left a comment

Choose a reason for hiding this comment

Ruoyu-y commented Aug 12, 2024 •

edited

Loading