Skip to content

Commit 4394659

Browse files
MarcialRosalesMarcialRosales
committed
Configure keycloak+uaa+oauth2-proxy with tls
1 parent 4cc52a4 commit 4394659

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+429
-416
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ tls-gen/*
1111
conf/entra/rabbitmq.conf
1212
conf/auth0/rabbitmq.conf
1313
.DS_Store
14+
venv

‎Makefile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,3 +154,6 @@ get-jwt-token: ## Get a JWT token from an authorzation server
154154
start-mqtt-publish: ## publish mqtt message . e.g. make start-mqtt-publish TOKEN=$(bin/jwt_token legacy-token-key private.pem public.pem)
155155
@(docker run --rm -it --network rabbitmq_net ruimarinho/mosquitto mosquitto_pub \
156156
-h rabbitmq -u "" -P $(TOKEN) -t test -m hello-world)
157+
158+
clean-certs: ## remove all auto-generated certificates from any oauth provider and rabbitmq
159+
@rm -r conf/*/certs

‎bin/common

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#!/usr/bin/env bash
22

3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
ROOT=$SCRIPT/..
5+
36
tabs 1
47
declare -i PADDING_LEVEL=0
58
declare -i STEP=1
@@ -50,33 +53,42 @@ ensure_docker_network() {
5053
fi
5154
end "$NETWORK network exists"
5255
}
56+
5357
function generate-ca-server-client-kpi {
5458
NAME=$1
5559
FOLDER=$2
56-
TLSGEN_FOLDER=$3
57-
60+
if [[ ! -f "${FOLDER}/server_${NAME}_key.pem" ]]; then
61+
do_generate-ca-server-client-kpi $1 $2
62+
fi
63+
}
64+
function do_generate-ca-server-client-kpi {
65+
NAME=$1
66+
FOLDER=$2
5867
begin "Generate certs for $NAME"
5968

6069
if [ -d "$NAME" ]; then
6170
end "SSL Certificates already present under $NAME. Skip SSL generation"
6271
return
6372
fi
6473

65-
if [ ! -d "$SCRIPT/tls-gen" ]; then
66-
git clone https://github.com/michaelklishin/tls-gen $TLSGEN_FOLDER
74+
if [ ! -d "$ROOT/tls-gen" ]; then
75+
git clone https://github.com/michaelklishin/tls-gen $ROOT/tls-gen
6776
fi
6877

6978
print "Generating CA and Server (localhost and $NAME) PKI under $FOLDER ..."
7079
mkdir -p $FOLDER
71-
cp -r $TLSGEN_FOLDER/* $FOLDER
7280

7381
CUR_DIR=$(pwd)
74-
cd $FOLDER/basic
82+
cd $ROOT/tls-gen/basic
7583
make CN=$NAME
76-
#make PASSWORD=$PASSWORD
84+
#make PASSWORD=foobar
7785
make verify
7886
make info
7987
cd $CUR_DIR
8088

89+
cp $ROOT/tls-gen/basic/result/ca_certificate.pem $FOLDER/ca_${NAME}_certificate.pem
90+
cp $ROOT/tls-gen/basic/result/server_${NAME}_certificate.pem $FOLDER
91+
cp $ROOT/tls-gen/basic/result/server_${NAME}_key.pem $FOLDER
92+
cp $ROOT/tls-gen/basic/result/server_${NAME}.p12 $FOLDER
8193
end "SSL Certificates generated for $NAME under $FOLDER"
8294
}

‎bin/curl_with_token

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
55
URL=${1:?First parameter must be the url to curl}
66
TOKEN=${2:?Second parameter must be the token}
77

8-
curl -u :$TOKEN $URL
8+
curl -k -u :$TOKEN $URL

‎bin/deploy-rabbit

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -11,72 +11,72 @@ OAUTH_PROVIDER=${OAUTH_PROVIDER:-$MODE}
1111
ADVANCED=${ADVANCED:-advanced.config}
1212
IMAGE_TAG=${IMAGE_TAG:-4.0.2-management}
1313
IMAGE=${IMAGE:-rabbitmq}
14+
RABBITMQ_CONF=${RABBITMQ_CONF:-rabbitmq.conf}
1415

15-
CONF_DIR=$SCRIPT/../conf/${MODE}
16+
if [[ "${MODE}" == "uaa" ]]; then
17+
if [[ -z "${CONF_FILES}" ]]; then
18+
CONF_FILES="rabbitmq.conf,oauth2-only.conf"
19+
fi
20+
fi
1621

17-
function generate-ca-server-client-kpi {
18-
NAME=$1
22+
CONF_DIR=$SCRIPT/../conf/${MODE}
23+
CERTS_DIR=${CONF_DIR}/certs
1924

20-
if [ -d "$NAME" ]; then
21-
echo "SSL Certificates already present under $NAME. Skip SSL generation"
22-
return
25+
function generate-final-conf-dir {
26+
FINAL_CONF_DIR=`mktemp -d -t "oauth2"`
27+
if [[ -z "${CONF_FILES}" ]]; then
28+
for i in $CONF_DIR/*.conf
29+
do
30+
cp $i $FINAL_CONF_DIR
31+
done
32+
cp ${CONF_DIR}/${RABBITMQ_CONF} $FINAL_CONF_DIR
33+
else
34+
for i in ${CONF_FILES//,/ }
35+
do
36+
cp $CONF_DIR/${i}.conf $FINAL_CONF_DIR
37+
done
2338
fi
2439

25-
if [ ! -d "$SCRIPT/tls-gen" ]; then
26-
git clone https://github.com/michaelklishin/tls-gen $SCRIPT/tls-gen
40+
}
41+
function generate-tls-certs-if-required {
42+
if [[ -f "${CONF_DIR}/requires-tls" && ! -f "${CERTS_DIR}" ]]; then
43+
generate-ca-server-client-kpi rabbitmq $CERTS_DIR
2744
fi
28-
29-
echo "Generating CA and Server PKI under $NAME ..."
30-
mkdir -p $NAME
31-
cp -r $SCRIPT/tls-gen/* $NAME
32-
33-
CUR_DIR=$(pwd)
34-
cd $NAME/basic
35-
make CN=localhost
36-
#make PASSWORD=$PASSWORD
37-
make verify
38-
make info
39-
cd $CUR_DIR
4045
}
4146

4247
function deploy {
43-
USED_CONFIG=""
44-
CERTS_DIR=${CONF_DIR}/certs
45-
if [[ -f "${CONF_DIR}/requires-tls" && ! -f "${CERTS_DIR}" ]]; then
46-
generate-ca-server-client-kpi $CERTS_DIR
47-
cp $CERTS_DIR/basic/testca/cacert.pem $CERTS_DIR
48-
cp $CERTS_DIR/basic/server_localhost/key.pem $CERTS_DIR
49-
cp $CERTS_DIR/basic/server_localhost/cert.pem $CERTS_DIR
50-
EXTRA_PORTS="-p 15671:15671 "
51-
fi
52-
EXTRA_MOUNTS="-v ${SCRIPT}/../conf/enabled_plugins:/etc/rabbitmq/enabled_plugins "
53-
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${CONF_DIR}:/conf "
48+
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${SCRIPT}/../conf/enabled_plugins:/etc/rabbitmq/enabled_plugins "
49+
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${FINAL_CONF_DIR}:/conf -v ${CERTS_DIR}:/certs "
50+
USED_CONFIG="${FINAL_CONF_DIR}/*.conf "
51+
52+
if [[ -f "${CONF_DIR}/requires-tls" ]]; then
53+
EXTRA_PORTS="-p 15671:15671 "
54+
fi
55+
if [[ "${MODE}" == "oauth2-proxy" ]]; then
56+
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v $SCRIPT/../conf/keycloak/certs:/etc/keycloak/certs "
57+
fi
5458

55-
if [[ -n "${CONFIG}" && -f "${CONF_DIR}/${CONFIG}" ]]; then
56-
USED_CONFIG="${CONF_DIR}/${CONFIG}"
57-
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${USED_CONFIG}:/etc/rabbitmq/rabbitmq.config:ro "
58-
elif [ -f "${CONF_DIR}/${CONF:-rabbitmq.conf}" ]; then
59-
USED_CONFIG="${CONF_DIR}/${CONF:-rabbitmq.conf}"
60-
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${USED_CONFIG}:/etc/rabbitmq/rabbitmq.conf:ro "
61-
fi
6259
if [[ -n "${ADVANCED}" && -f "${CONF_DIR}/${ADVANCED}" ]]; then
6360
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${CONF_DIR}/${ADVANCED}:/etc/rabbitmq/advanced.config:ro "
6461
USED_CONFIG="${USED_CONFIG} ${CONF_DIR}/${ADVANCED}"
6562
fi
6663

67-
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
68-
docker rm -f rabbitmq 2>/dev/null || echo "rabbitmq was not running"
69-
echo "running RabbitMQ ($IMAGE:$IMAGE_TAG) with Idp $MODE and configuration file(s) $USED_CONFIG"
64+
echo "Running RabbitMQ ($IMAGE:$IMAGE_TAG) with Idp $MODE and configuration file(s) $USED_CONFIG"
7065
docker run -d --name rabbitmq \
7166
--net rabbitmq_net \
7267
-p 15672:15672 \
7368
-p 5672:5672 \
7469
-p 5552:5552 \
75-
${EXTRA_PORTS}\
70+
--env RABBITMQ_CONFIG_FILES="/conf" \
71+
${EXTRA_PORTS} \
7672
${EXTRA_MOUNTS} \
7773
${IMAGE}:${IMAGE_TAG}
7874
}
7975

76+
generate-final-conf-dir
77+
generate-tls-certs-if-required
78+
ensure_docker_network
79+
kill_container_if_exist rabbitmq
8080
deploy
81-
wait_for_message rabbitmq "Time to start RabbitMQ"
81+
wait_for_message rabbitmq "Starting broker... completed"
8282
print "RabbitMQ is running"

‎bin/devkeycloak/curl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ CLIENT_SECRET=${3:?Third parameter must be the client_secret}
99

1010
ACCESS_TOKEN=$($SCRIPT/token ${CLIENT_ID} ${CLIENT_SECRET})
1111

12-
curl -u :$ACCESS_TOKEN $URL
12+
curl -k -u :$ACCESS_TOKEN $URL

‎bin/devkeycloak/deploy

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@
22

33
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44
ROOT=$SCRIPT/../..
5+
CONF_DIR=${ROOT}/conf/multi-keycloak
6+
CERTS_DIR=${CONF_DIR}/certs
57

6-
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
7-
docker rm -f keycloak 2>/dev/null || echo "keycloak was not running"
8+
ensure_docker_network
9+
kill_container_if_exist devkeycloak
810

9-
echo "Running keycloack docker image ..."
11+
generate-ca-server-client-kpi devkeycloak $CERTS_DIR
12+
13+
echo "Running devkeycloack docker image ..."
1014

1115
docker run \
1216
--detach \
@@ -15,9 +19,12 @@ docker run \
1519
--publish 8443:8443 \
1620
--env KEYCLOAK_ADMIN=admin \
1721
--env KEYCLOAK_ADMIN_PASSWORD=admin \
18-
--mount type=bind,source=${ROOT}/conf/multi-keycloak/dev_import/,target=/opt/keycloak/data/import/ \
19-
--mount type=bind,source=${ROOT}/conf/multi-keycloak/certs/,target=/opt/keycloak/certs/ \
22+
--mount type=bind,source=${CONF_DIR}/dev_import/,target=/opt/keycloak/data/import/ \
23+
--mount type=bind,source=${CERTS_DIR}/,target=/opt/keycloak/certs/ \
2024
quay.io/keycloak/keycloak:20.0 start-dev --import-realm \
2125
--https-certificate-file=/opt/keycloak/certs/server_devkeycloak_certificate.pem \
2226
--https-certificate-key-file=/opt/keycloak/certs/server_devkeycloak_key.pem \
2327
--hostname=devkeycloak --hostname-admin=devkeycloak --https-port=8443
28+
29+
wait_for_message devkeycloak "Running the server"
30+
print "devkeycloak is running"

‎bin/devkeycloak/token

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ set -ex
44
CLIENT_ID=${1:?First parameter must be client_id}
55
CLIENT_SECRET=${2:?Second parameter must be the client_secret}
66

7-
TOKEN=$(curl --silent --location --request POST 'http://localhost:8081/realms/dev/protocol/openid-connect/token' \
7+
TOKEN=$(curl -k --silent --location --request POST 'https://localhost:8443/realms/dev/protocol/openid-connect/token' \
88
--header 'Content-Type: application/x-www-form-urlencoded' \
99
--data-urlencode client_id=${CLIENT_ID} \
1010
--data-urlencode client_secret=${CLIENT_SECRET} \

‎bin/keycloak/curl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ REALM=${4:?Forth parameter must be the realm}
1010

1111
ACCESS_TOKEN=$($SCRIPT/token ${CLIENT_ID} ${CLIENT_SECRET} ${REALM})
1212

13-
curl -u :$ACCESS_TOKEN $URL
13+
curl -k -u :$ACCESS_TOKEN $URL

‎bin/keycloak/deploy

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,15 @@
33
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44

55
ROOT=$SCRIPT/../..
6+
CONF_DIR=${ROOT}/conf/keycloak
7+
CERTS_DIR=${CONF_DIR}/certs
68

79
source $SCRIPT/../common
810

911
ensure_docker_network
1012
kill_container_if_exist keycloak
1113

12-
generate-ca-server-client-kpi keycloak $ROOT/conf/keycloak/certs $ROOT/tls-gen
13-
find $ROOT/conf/keycloak/certs -mindepth 1 -maxdepth 1 ! -name 'basic' -type f -exec rm -f {} +
14-
find $ROOT/conf/keycloak/certs -mindepth 1 -maxdepth 1 ! -name "basic" -type d -exec rm -rf {} +
15-
cp $ROOT/conf/keycloak/certs/basic/result/* $ROOT/conf/keycloak/certs
16-
rm -rf $ROOT/conf/keycloak/certs/basic
14+
generate-ca-server-client-kpi keycloak $CERTS_DIR
1715

1816
begin "Running keycloack docker image ..."
1917

@@ -25,7 +23,10 @@ docker run \
2523
--env KEYCLOAK_ADMIN=admin \
2624
--env KEYCLOAK_ADMIN_PASSWORD=admin \
2725
--mount type=bind,source=${ROOT}/conf/keycloak/import/,target=/opt/keycloak/data/import/ \
28-
--mount type=bind,source=${ROOT}/conf/keycloak/certs/,target=/opt/keycloak/certs/ \
26+
--mount type=bind,source=${CERTS_DIR}/,target=/opt/keycloak/certs/ \
2927
quay.io/keycloak/keycloak:20.0 start-dev --import-realm \
3028
--https-certificate-file=/opt/keycloak/certs/server_keycloak_certificate.pem \
3129
--https-certificate-key-file=/opt/keycloak/certs/server_keycloak_key.pem
30+
31+
wait_for_message keycloak "Running the server"
32+
print "keycloak is running"

‎bin/keycloak/token

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ CLIENT_ID=${1:?First parameter must be client_id}
55
CLIENT_SECRET=${2:?Second parameter must be the client_secret}
66
REALM=${3:?Third parameter must be the realm}
77

8-
URL=http://localhost:8080/realms/${REALM}/protocol/openid-connect/token
9-
TOKEN=$(curl $URL --silent --location --request POST \
8+
URL=https://localhost:8443/realms/${REALM}/protocol/openid-connect/token
9+
TOKEN=$(curl -k $URL --silent --location --request POST \
1010
--header 'Content-Type: application/x-www-form-urlencoded' \
1111
--data-urlencode client_id=${CLIENT_ID} \
1212
--data-urlencode client_secret=${CLIENT_SECRET} \

‎bin/oauth2-proxy/deploy

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,21 @@
33
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44

55
ROOT=$SCRIPT/../..
6+
CONF_DIR=${ROOT}/conf/oauth2-proxy
7+
CERTS_DIR=${CONF_DIR}/certs
68

7-
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
9+
source $SCRIPT/../common
10+
11+
ensure_docker_network
812
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml down 2>/dev/null || echo "oauth2-proxy was not running"
13+
generate-ca-server-client-kpi oauth2-proxy $CERTS_DIR
914

1015
echo "Running oauth2-proxy docker image ..."
1116

12-
export OAUTH2_PROXY_COOKIE_SECRET=`python -c 'import os,base64; print(base64.b64encode(os.urandom(16)).decode("ascii"))'`
13-
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml up
17+
export OAUTH2_PROXY_COOKIE_SECRET=`dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo`
18+
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml up -d
19+
20+
wait_for_message oauth2-proxy-oauth2-proxy-1 "Cookie settings"
21+
print "oauth2-proxy is running"
22+
23+

‎bin/prodkeycloak/curl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ CLIENT_ID=${2:?Second parameter must be client_id}
88
CLIENT_SECRET=${3:?Third parameter must be the client_secret}
99
ACCESS_TOKEN=$($SCRIPT/token ${CLIENT_ID} ${CLIENT_SECRET})
1010

11-
curl -u :$ACCESS_TOKEN $URL
11+
curl -k -u :$ACCESS_TOKEN $URL

‎bin/prodkeycloak/deploy

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@
22

33
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44
ROOT=$SCRIPT/../..
5+
CONF_DIR=${ROOT}/conf/multi-keycloak
6+
CERTS_DIR=${CONF_DIR}/certs
57

6-
docker network inspect rabbitmq_net >/dev/null 2>&1 || docker network create rabbitmq_net
7-
docker rm -f keycloak 2>/dev/null || echo "keycloak was not running"
8+
ensure_docker_network
9+
kill_container_if_exist prodkeycloak
810

9-
echo "Running keycloack docker image ..."
11+
generate-ca-server-client-kpi prodkeycloak $CERTS_DIR
12+
13+
echo "Running prodkeycloak docker image ..."
1014

1115
docker run \
1216
--detach \
@@ -15,9 +19,12 @@ docker run \
1519
--publish 8442:8442 \
1620
--env KEYCLOAK_ADMIN=admin \
1721
--env KEYCLOAK_ADMIN_PASSWORD=admin \
18-
--mount type=bind,source=${ROOT}/conf/multi-keycloak/prod_import/,target=/opt/keycloak/data/import/ \
19-
--mount type=bind,source=${ROOT}/conf/multi-keycloak/certs/,target=/opt/keycloak/certs/ \
22+
--mount type=bind,source=${CONF_DIR}/prod_import/,target=/opt/keycloak/data/import/ \
23+
--mount type=bind,source=${CERTS_DIR}/,target=/opt/keycloak/certs/ \
2024
quay.io/keycloak/keycloak:20.0 start-dev --import-realm \
2125
--https-certificate-file=/opt/keycloak/certs/server_prodkeycloak_certificate.pem \
2226
--https-certificate-key-file=/opt/keycloak/certs/server_prodkeycloak_key.pem \
2327
--hostname=prodkeycloak --hostname-admin=prodkeycloak --https-port=8442
28+
29+
wait_for_message prodkeycloak "Running the server"
30+
print "prodkeycloak is running"

‎bin/prodkeycloak/token

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ set -ex
44
CLIENT_ID=${1:?First parameter must be client_id}
55
CLIENT_SECRET=${2:?Second parameter must be the client_secret}
66

7-
TOKEN=$(curl --silent --location --request POST 'http://localhost:8082/realms/prod/protocol/openid-connect/token' \
7+
TOKEN=$(curl -k --silent --location --request POST 'https://localhost:8442/realms/prod/protocol/openid-connect/token' \
88
--header 'Content-Type: application/x-www-form-urlencoded' \
99
--data-urlencode client_id=${CLIENT_ID} \
1010
--data-urlencode client_secret=${CLIENT_SECRET} \

‎bin/run-perftest

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ if [ -z "$TOKEN" ]; then
66
echo "Getting token from UAA ..."
77
TOKEN=$(uaac context $CLIENT_ID | awk '/access_token/ { print $2}')
88
fi
9+
echo "Using token ${TOKEN}"
10+
911
url="amqp://:$TOKEN@rabbitmq:5672/%2F"
1012

1113
shift 1

‎bin/uaa/curl_url

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ URL=${2:?Second parameter must be the url to curl}
66
token=$(uaac context $CONTEXT | awk '/access_token/ { print $2}')
77
echo "token => $token"
88

9-
curl -u :$token $URL
9+
curl -k -u :$token $URL

0 commit comments

Comments
 (0)