Guide: Securing a WildFly app on k8s with OIDC #2087

theashiot · 2024-01-31T08:29:20Z

Depends on updates to the simple-webapp-oidc example:
wildfly-security-incubator/elytron-examples#209

Preview: https://theashiot.github.io/wildfly-elytron/blog/securing-wildfly-apps-oidc-k8s/

theashiot · 2024-01-31T08:30:52Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+cd /PATH/TO/ELYTRON/EXAMPLES/simple-webapp-oidc/charts
+----
+
+. Create a file `values.yml`.


Hi @fjuma, do we want to add this file in https://github.com/wildfly-security-incubator/elytron-examples/tree/main/simple-webapp-oidc ?

Hi @theashiot, apologies for the delayed response. I haven't gone through this in detail yet but yes, adding a file with the required configuration for k8s to the existing example would make sense.

Thanks, @fjuma, i've created a PR to add the file: wildfly-security-incubator/elytron-examples#209

I'll updated the steps shortly.

I've updates the steps. Ready for review!

Please note that I haven't tested the steps for Quay. I have based them on https://www.wildfly.org/news/2023/06/16/deploy-on-kubernetes-with-helm/ . I'm facing some authentication problems with Quay.

I've tested the steps for Docker Hub.

PrarthonaPaul · 2024-03-18T13:18:37Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+
+== Example Application
+
+We use a simple web application in this guide that consists of a single https://github.com/wildfly-security/elytron-examples/blob/main/simple-webapp-oidc/src/main/java/org/wildfly/security/examples/SecuredServlet.java[servlet]. We show how to secure this servlet using OIDC. We will use the example in the https://github.com/wildfly-security-incubator/elytron-examples/tree/main/simple-webapp-oidc[simple-webapp-oidc] directory in the https://github.com/wildfly-security/elytron-examples[elytron-examples] repository.


FYI, the examples repo is under the wildfly-security-incubator account.
https://github.com/wildfly-security-incubator/elytron-examples

thanks, fixed!

theashiot · 2024-04-01T10:12:18Z

Hi @PrarthonaPaul,

I've made some updates. The steps for port-forwarding were missing. I've added them now. The steps work for dockerhub, but when i use quay, i get "ErrImagePull".

kubectl get pod
NAME                             READY   STATUS         RESTARTS      AGE
keycloak-65766c8d6b-tdnhn        1/1     Running        1 (42m ago)   75m
oidc-app-5d6f9974fd-srvrg        1/1     Running        0             26m
oidc-app-quay-79d48ff4df-lsb6l   0/1     ErrImagePull   0             68s

oidc-app-5d6f9974fd-srvrg is launched from dockerhub. oidc-app-quay-79d48ff4df-lsb6l is from quay.

I'm not able to figure out whats going wrong.

best,
ashwin

PrarthonaPaul · 2024-04-02T15:29:22Z

Hi @PrarthonaPaul,

I've made some updates. The steps for port-forwarding were missing. I've added them now. The steps work for dockerhub, but when i use quay, i get "ErrImagePull".
kubectl get pod
NAME                             READY   STATUS         RESTARTS      AGE
keycloak-65766c8d6b-tdnhn        1/1     Running        1 (42m ago)   75m
oidc-app-5d6f9974fd-srvrg        1/1     Running        0             26m
oidc-app-quay-79d48ff4df-lsb6l   0/1     ErrImagePull   0             68s
oidc-app-5d6f9974fd-srvrg is launched from dockerhub. oidc-app-quay-79d48ff4df-lsb6l is from quay.

I'm not able to figure out whats going wrong.

best, ashwin

Hello @theashiot
It could be because you don't have your quay secret uploaded to k8.
Here are the steps to doing that for OpenShift: https://wildfly-security.github.io/wildfly-elytron/blog/in-progress-wildfly-feature-on-openshift/#configure-image-pull-secret

theashiot · 2024-04-04T14:25:39Z

Thanks, @PrarthonaPaul for the reply! As discussed, i've removed all mentions of quay. I'll add quay-related info in a separate PR when i'm able to get it running.

best,
ashwin

fjuma · 2024-05-07T20:51:04Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+:toc: macro
+:toc-title:
+
+You can secure your WildFly applications deployed on Kubernetes with OpenID Connect (OIDC). By using OIDC to secure applications, you delegate authentication to OIDC providers. This guide shows how to secure an example application deployed to WildFly on Kubernetes cluster running on your local machine, with OIDC using Keycloak as the OIDC provider.


s/on Kubernetes cluster/on a Kubernetes cluster

s/OIDC provider/OpenID provider

fjuma · 2024-05-07T20:52:12Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+
+== Start Keycloak
+
+We will be using Keycloak as our OIDC identity provider.


s/OIDC identity provider/OpenID provider

fjuma · 2024-05-07T20:52:49Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+
+We will be using Keycloak as our OIDC identity provider.
+
+Follow the instructions, till "Log in to the Admin Console", provided in the https://www.keycloak.org/getting-started/getting-started-kube[Get started with Keycloak on Kubernetes] guide.


s/till/up until

fjuma · 2024-05-07T20:54:43Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+
+[source,subs=+quotes]
+----
+docker login __CONTAINER_REGISTRY__ 


CONTAINER_REGISTRY seems to render a bit odd. Could we use <CONTAINER_REGISTRY> or something similar instead?

updated all italics to <this_form>

fjuma · 2024-05-07T20:54:59Z

_posts/2024-01-30-securing-wildfly-apps-oidc-k8s.adoc

+docker tag simple-webapp-oidc __TAGGED_IMAGE__
+----
+
+Substitute __TAGGED_IMAGE__ as follows:


Same here, renders in a way that's a bit hard to read.

fjuma · 2024-05-07T20:56:22Z

Thanks for the post @theashiot! This looks great!

@PrarthonaPaul Would you be able to try out the steps from this post when you get a chance?

theashiot · 2024-05-08T07:06:14Z

Thanks, @fjuma for the review! I've updated the content.

best,
ashwin

theashiot commented Jan 31, 2024

View reviewed changes

theashiot force-pushed the develop branch 2 times, most recently from 7303027 to b7060de Compare February 8, 2024 06:15

theashiot marked this pull request as ready for review February 8, 2024 06:15

theashiot force-pushed the develop branch from b7060de to 2112c4c Compare February 8, 2024 06:19

PrarthonaPaul reviewed Mar 19, 2024

View reviewed changes

theashiot force-pushed the develop branch from 2112c4c to 8cb197b Compare April 1, 2024 10:07

theashiot force-pushed the develop branch from 8cb197b to 47c1d92 Compare April 4, 2024 14:22

fjuma reviewed May 7, 2024

View reviewed changes

Guide: Securing a WildFly app on k8s with OIDC

ad3a334

theashiot force-pushed the develop branch from 47c1d92 to ad3a334 Compare May 8, 2024 07:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Guide: Securing a WildFly app on k8s with OIDC #2087

Guide: Securing a WildFly app on k8s with OIDC #2087

theashiot commented Jan 31, 2024 •

edited

theashiot Jan 31, 2024

fjuma Feb 5, 2024

theashiot Feb 7, 2024

theashiot Feb 8, 2024 •

edited

PrarthonaPaul Mar 18, 2024

theashiot Apr 1, 2024

theashiot commented Apr 1, 2024

PrarthonaPaul commented Apr 2, 2024

theashiot commented Apr 4, 2024

fjuma May 7, 2024

fjuma May 7, 2024

theashiot May 8, 2024

fjuma May 7, 2024

theashiot May 8, 2024

fjuma May 7, 2024

theashiot May 8, 2024

fjuma May 7, 2024

theashiot May 8, 2024 •

edited

fjuma May 7, 2024

theashiot May 8, 2024

fjuma commented May 7, 2024

theashiot commented May 8, 2024


		== Example Application

		We use a simple web application in this guide that consists of a single https://github.com/wildfly-security/elytron-examples/blob/main/simple-webapp-oidc/src/main/java/org/wildfly/security/examples/SecuredServlet.java[servlet]. We show how to secure this servlet using OIDC. We will use the example in the https://github.com/wildfly-security-incubator/elytron-examples/tree/main/simple-webapp-oidc[simple-webapp-oidc] directory in the https://github.com/wildfly-security/elytron-examples[elytron-examples] repository.


		== Start Keycloak

		We will be using Keycloak as our OIDC identity provider.


		We will be using Keycloak as our OIDC identity provider.

		Follow the instructions, till "Log in to the Admin Console", provided in the https://www.keycloak.org/getting-started/getting-started-kube[Get started with Keycloak on Kubernetes] guide.

Guide: Securing a WildFly app on k8s with OIDC #2087

Are you sure you want to change the base?

Guide: Securing a WildFly app on k8s with OIDC #2087

Conversation

theashiot commented Jan 31, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

theashiot Feb 8, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

theashiot commented Apr 1, 2024

PrarthonaPaul commented Apr 2, 2024

theashiot commented Apr 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

theashiot May 8, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fjuma commented May 7, 2024

theashiot commented May 8, 2024

theashiot commented Jan 31, 2024 •

edited

theashiot Feb 8, 2024 •

edited

theashiot May 8, 2024 •

edited