Kubernetes Dashboard SSO OIDC with keycloak-Part1

 Hello Guys,

For a long time i was working on this how to chive a SSO for k8s dashboard and I have failed many time while setup the sso for my K8S cluster and after searching a lot on internet and putting together a complete documentation how we can achieve it without any buying any domain and with a self sign ssl certs. I was trying to achieve it only with the open source software available and on base metal cluster.

here is my setup looks like for POC.

  

1. Vm1 (Pfsense)        192.168.56.100
2. vm2  (console)        192.168.56.109
3. vm3   (keycloak)     192.168.56.162
4. vm4   (master-sso)  192.168.56.164 

for the sake of the simplicity i am not going to include the integration between keycloak and Active directory or OpenLdap i will cover it in another post.

so lets start.

In pfsense which is my router so that i can create a local network on my Laptop it have two interfaces 

1 NAT  2 hostonly adapter and i have stop the DHCP server run by the virtualbox

on Console VM I have installed a  GUI based centos so that i can use browser in that  network.

 yum groupinstall "GNOME Desktop" "Graphical Administration Tools"

Make it boot by default in init 5 mode

 ln -sf /lib/systemd/system/runlevel5.target /etc/systemd/system/default.target

apart form this i have also make the ssh password less auth on keycloak and master-sso server for this 

ssh-keygen -t rsa

ssh-copy-id  root@keycloak

ssh-copy-id  root@master-sso

Setup Keycloak server with Selfsign cert with CA

• Update & Upgrade your server

apt updateapt upgrade

• Install JDK 8, keycloak need Java to run

apt-get install openjdk-8-jdk

• Download keycloak, the program directory will run in /opt

wget https://downloads.jboss.org/keycloak/8.0.2/keycloak-8.0.2.tar.gztar -xzf keycloak-8.0.2.tar.gz -C /opt/mv /opt/keycloak-8.0.2 /opt/keycloak

• Create user & group for keycloak

groupadd keycloakuseradd -r -g keycloak -d /opt/keycloak -s /sbin/nologin keycloak

• How to run the keycloak? using systemd service file

mkdir -p /etc/keycloakcp /opt/keycloak/docs/contrib/scripts/systemd/wildfly.conf /etc/keycloak/keycloak.confcp /opt/keycloak/docs/contrib/scripts/systemd/launch.sh /opt/keycloak/bin/cp /opt/keycloak/docs/contrib/scripts/systemd/wildfly.service /etc/systemd/system/keycloak.service

• Edit launch.sh and specify home environment variable

vi /opt/keycloak/bin/launch.shWILDFLY_HOME='/opt/keycloak/'

• Edit keycloak service

vi /etc/systemd/system/keycloak.service[Unit]Description=The Keycloak ServerAfter=syslog.target network.targetBefore=httpd.service[Service]Environment=LAUNCH_JBOSS_IN_BACKGROUND=1EnvironmentFile=/etc/keycloak/keycloak.confUser=keycloakGroup=keycloakLimitNOFILE=102642PIDFile=/var/run/keycloak/keycloak.pidExecStart=/opt/keycloak/bin/launch.sh $WILDFLY_MODE $WILDFLY_CONFIG $WILDFLY_BINDStandardOutput=null[Install]WantedBy=multi-user.target

• Set permission in keycloak directory to user that we create before

chown keycloak:keycloak -R /opt/keycloakchmod o+x /opt/keycloak/bin

• Start keycloak service

systemctl daemon-reloadsystemctl enable keycloaksystemctl start keycloaksystemctl status keycloak

• Create admin user

/opt/keycloak/bin/add-user-keycloak.sh -r master -u <username> -p <password>systemctl restart keycloak

• Open keycloak web

http://IP_SERVER:8080/auth

Secure the Keycloak using SSL

Kubernetes currently not support provider with http, should be https. This tutorial will create self signed CA for keycloak.

• Create folder for certificate

mkdir -p /opt/kc-certificate

• Edit openssl configuration

vi /etc/ssl/openssl.cnf# RANDFILE = $ENV::HOME/.rnd

• Generate CA, I am using wildcard domain.

cd /opt/kc-certificateopenssl genrsa -out ca.key 2048openssl req -new -x509 -key ca.key -out ca.crt -subj "/C=US/ST=CA/O=Acme, Inc./CN=*.nrathi.io"keytool -import -file ca.crt -keystore ca.truststore -keypass PASSWORD -storepass PASSWORD
openssl genrsa -out keycloak.key 2048openssl req -new -key keycloak.key -out keycloak.csr -subj "/C=US/ST=CA/O=Acme, Inc./CN=*.nrathi.io"openssl x509 -req -days 3650 -in keycloak.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out keycloak.crtopenssl pkcs12 -export -in keycloak.crt -inkey keycloak.key -out keycloak.p12 -name myserverkeystore -CAfile ca.crtkeytool -importkeystore -deststorepass PASSWORD -destkeypass PASSWORD -destkeystore keycloak.keystore -srckeystore keycloak.p12 -srcstoretype PKCS12 -srcstorepass PASSWORD

if you ask for password, just add `PASSWORD`

• Copy generated certificate into keyclock directory

cp ca.truststore /opt/keycloak/standalone/configuration/cp keycloak.keystore /opt/keycloak/standalone/configuration/

• Change the permission again

chown keycloak:keycloak -R /opt/keycloak

• Enter to jboss CLI

cd /opt/keycloak/./bin/jboss-cli.shconnect

• Setup the SSL

/core-service=management/security-realm=ssl-realm:add()/core-service=management/security-realm=ssl-realm/server-identity=ssl:add(keystore-relative-to=jboss.server.config.dir,keystore-path=keycloak.keystore, keystore-password=PASSWORD)/core-service=management/security-realm=ssl-realm/authentication=truststore:add(keystore-relative-to=jboss.server.config.dir,keystore-path=ca.truststore, keystore-password=PASSWORD)/subsystem=undertow/server=default-server/https-listener=https:remove()/subsystem=undertow/server=default-server/https-listener=https:add(socket-binding=https, security-realm=ssl-realm,enable-http2=true, verify-client=REQUESTED)reloadexit

• Restart Keycloak

systemctl restart keycloak

• Open keycloak

https://IP_SERVER:8443/auth

you will see warning because self signed certificate, just accept that certificate.

Good, Integration with kubernetes will be in the Part 2.

Get the list of most popular users on Github by Location and Language

Hello Guys,

recently i have been asked to get the list of most popular users from github and get the github handle and  retrieve the email. and get the output in CSV
many of you think its a typical developers stuff in which we are going to take response and extract the data etc.etc but I have solve the same proble with shell script which i want to share .

#!/bin/bash
read -p "Enter Your language: "  lang
read -p "Enter Your location: "  location
query="language:$lang+location:$location+type:user+repos:>5"
# for debugging..
#echo $query
#curl "https://api.github.com/search/users?q=$query" |grep -v total_count | grep -v incomplete_results |jq -r '.items[] | .login'
echo "GithubHandle, Email"
for i in `curl --silent  "https://api.github.com/search/users?q=$query" |grep -v total_count | grep -v incomplete_results |jq -r '.items[] | .login'`
do
arr=(`curl --silent https://api.github.com/users/$i/events/public|grep '"email":' | sort |uniq | awk -F ':' '{print$2}'|sed 's/,$//'`)
echo "$i,${arr[*]}" 
done

This will do the magic 

AWS SAML AUTH with CLI/Programatic access the easiest way

Hello Guys,

As you know from my previous blog that I have setup keycloak server with Azure AD as identity federation now most of you have face the problem about getting the access and secret access key for those role. I have also face the same problem and yet there is no easy solution for this so after much searching on internet i got a radical idea why not use a google chrome plugin, Its not the case i have tried the other solution like saml2aws and other but they want help you if you are login in keycloak using federated identity.so the below method will work with other sso provider as well.
 
1. Search for SAML to AWS key converter & add the plugin to Chrome

 

2. After adding the extension to the chrome, it will appear as below

We are now ready login AWS through KeyCloak and generate AWS Access Keys.

Login AWS through KeyCloak

1. Click on the below link to login to KeyCloak.
https://keycloakserver/auth/realms//account/applications

2. Login through your sso provider or keycloak


3. After Logging keycloak, navigate to the Application & choose the account to login (eg.AWS application name)

4. After selecting the required application you will be navigated to the AWS account and credentials will be generated for the same. and downloaded in your browser its the most easy way a user can login and have his programmatic access with him.

If you want to say anything please put it in comments

Free SSO with AWS SAML on Prem

Hello Guys,

I started working with a start up and they have about 7 to 8 AWS account and user management in all the AWS account is becoming a problem as well as the users who are leaving the company or in the company also using there programmatic access here and there,
     If we delete or inactive the users then some application is going to stop working so my manager want to came up with plan we have gone through many options and we also have budget issue as its a start up company.so we came up with a plan of using keycloak as our SSO SAML provider backed with postgress and i also want to demonstrate the capability of kubernetes so i deployed it in the kubernetes cluster
   I have use help to install keycloak on the kubernetes cluster which a got from codecentric repo.
https://codecentric.github.io/helm-charts i am also using kubeapps to deploy it in my kubernetes environement.

once install i have started configuring the keycloak

1) First step you need to do is — get saml-metadata.xml from Amazon AWS.

2) After you saved saml-metadata.xml file, go to your Keycloak server, go to “Clients” section and create new client:

your_realm_name — is the name of the keycloak realm, for which you configure SAML client

The only fields you need to fill are:

“Base URL” and “IDP Initiated SSO URL Name”

Set your “Base URL” to:  /auth/realms/<your_realm_name>/protocol/saml/clients/amazon-aws

and “IDP Initiated SSO URL Name” to  amazon-aws

5) Press “Save”

After you saved client settings, go to “Installation” tab, select “Mode Auth Mellon files” and press “Download”  zip file will get downloaded you need to extract the same  and file name idp-metadata.xml

Amazon AWS Service Provider setup

1) After you downloaded idp-metadata.xml file, go to your Amazon AWS account

2) Go to “IAM” section, select “Identity providers” and press “Create Provider” button.

3) Choose “SAML” as the provider type, set provider name and upload idp-metadata.xml file downloaded  and extracted from Keycloak server.

4) Press “Next Step” and then “Create”.

5) After you created your SAML Identity Provider, you need to create IAM role for this provider.

6) Go to “IAM” section, select “Roles”.

7) Press “Create New Role”, set role name.

For “Select Role Type” choose

“SAML 2.0 fedration”

and select your Saml provider which we have created earlier

PART 2: Keycloak Identity Provider setup

1) After IAM SAML role in AWS has been created, go to role summary and copy Role ARN, it should look like this:

arn:aws:iam::aws_acct_id:role/aws_iam_saml_role,arn:aws:iam:aws_acct_id:saml-provider/aws_iam_saml_idp

Go back to your Keycloak server, go to your realm in which you created AWS SAML client, go to “Roles” tab and press “Add Role”:

aws_acct_id — your AWS account ID, aws_iam_saml_role — AWS IAM SAML role, aws_iam_saml_idp — AWS IAM SAML Identity Provider

2) After that, go to “Mappers” section and create mappers for “Session Role”, “Session Duration” and “Session Name”

“Session Role” mapper:

“Session Name” mapper:

“Session Duration” mapper:

These mappers are required as per Amazon AWS SAML documentation.

3) After “Mappers”, go to Keycloak realm “Manage” section, select “Users” or “Groups” and choose, which group or user will be assigned to AWS SAML role, and assign it:

aws_acct_id — your AWS account ID, aws_iam_saml_role — AWS IAM SAML role, aws_iam_saml_idp — AWS IAM SAML Identity Provider

5) And, finally, go back to your defined AWS client, and press “Base URL” link:

your_realm_name — is the name of the keycloak realm, for which you configure SAML client

6) After you press “Base URL” link, it should redirect you to Keycloak login page, where you’ll need to enter user name and password for the user, who is member of a group, which has been assigned to AWS IAM SAML role, defined in Keycloak.

And after you enter your credentials, hopefully, you’ll be redirected to Amazon AWS console.

You can integrate the Keycloak with  Azure AD well.

Click on identity provider select microsoft  and fill the retails as requested Application ID and Application secret and you will be able to authenticate in keycloak using azure AD.

For the CLI/Programatic  access i will get bacl to you in my next blog 

MongoDB Getting Started and Setup Cluster

In the past couple of days. I have change my job started working on server less model.so all of there data they don't store in the traditional way in RDBMS in fact thay store all of there application logs in the DB.

So We have started using MongoDB As a document database few of the advantages of mongodb.

• Document Oriented Storage − Data is stored in the form of JSON style documents.
• Index on any attribute
• Replication and high availability
• Auto-sharding
• Rich queries
• Fast in-place update
• Professional support by MongoDB.
  
  Now Lets start Building the Mongo cluster with 1 master 1 stave 1 Arbiter
  
  
  
  Pre-requisites.
• 3 Centos machines (in cloud or on premises)

mongo0 192.168.56.131

mongo1 192.168.56.132

mongo2 192.168.56.133

2. 1 Windows Host for testing using studio 3T

Login on all 3 vms,

1. Disable the firewalld service

# systemctl disable firewalld

2. Stop the firewalld service

# systemctl stop firewalld

3. Disable SeLinux

To permanently disable SELinux, use your favorite text editor to open the file /etc/sysconfig/selinux 

Then change the directive SELinux=enforcing to SELinux=disabled 

4. Update the all packages and Install EPEL release repo

# yum update -y && yum insall epel-release

5. Edit hostname file and change the hostname mongo0,mongo1,mongo2… /etc/hostanme

6. Add the below entry in the /etc/hosts

mongo0 192.168.56.131

mongo1 192.168.56.132

mongo2 192.168.56.133

7. reboot the system

# reboot now

Configure the package management system (yum).

Create a /etc/yum.repos.d/mongodb-org-4.2.repo file so that you can install MongoDB directly using yum:

[mongodb-org-4.2]

name=MongoDB Repository

baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/4.2/x86_64/

gpgcheck=1

enabled=1

gpgkey=https://www.mongodb.org/static/pgp/server-4.2.asc

Install the MongoDB packages.

To install the latest stable version of MongoDB, issue the following command:

sudo yum install -y mongodb-org

Alternatively, to install a specific release of MongoDB, specify each component package individually and append the version number to the package name, as in the following example:

sudo yum install -y mongodb-org-4.2.0 mongodb-org-server-4.2.0 mongodb-org-shell-4.2.0 mongodb-org-mongos-4.2.0 mongodb-org-tools-4.2.0

You can specify any available version of MongoDB. However yum upgrades the packages when a newer version becomes available. To prevent unintended upgrades, pin the package. To pin a package, add the following exclude directive to your /etc/yum.conf file:

exclude=mongodb-org,mongodb-org-server,mongodb-org-shell,mongodb-org-mongos,mongodb-org-tools

Start one member (master) of the replica set.

This mongod should not enable auth.

Create administrative users.

The following operations will create two users: a user administrator that will be able to create and modify users (siteUserAdmin), and a root user (siteRootAdmin) that you will use to complete the remainder of the tutorial:

use admin

db.createuser( {

user: "siteUserAdmin",

pwd: "",

roles: [ "userAdminAnyDatabase" ]

});

db.createuser( {

user: "siteRootAdmin",

pwd: "",

roles: [ "userAdminAnyDatabase",

"readWriteAnyDatabase",

"dbAdminAnyDatabase",

"clusterAdmin" ]

});

Stop the mongod instance.

Create the key file to be used by each member of the replica set.

Create the key file your deployment will use to authenticate servers to each other.

To generate pseudo-random data to use for a keyfile, issue the following openssl command:

mkdir -p /etc/mongod

openssl rand -base64 741 > /etc/mongod/mongodb-keyfile

chown -R mongod:mongod /etc/mongod

chmod 600 /etc/mongod/mongodb-keyfile

You may generate a key file using any method you choose. Always ensure that the password stored in the key file is both long and contains a high amount of entropy. Using openssl in this manner helps generate such a key.

Copy the key file to each member of the replica set.

Copy the mongodb-keyfile to all hosts where components of a MongoDB deployment run. Set the permissions of these files to 600 so that only the owner of the file can read or write this file to prevent other users on the system from accessing the shared secret.

mkdir -p /etc/mongod

chown -R mongod:mongod /etc/mongod

chmod 600 /etc/mongod/mongodb-keyfile

on master

Execute the scp command for all the slaves one by one.

scp /etc/mongod/mongodb-keyfile user@slave: /etc/mongod/mongodb-keyfile

Sample mongod.conf file is looks something like this

# mongod.conf

# for documentation of all options, see:

# http://docs.mongodb.org/manual/reference/configuration-options/

# where to write logging data.

systemLog:

destination: file

logAppend: true

path: /var/log/mongodb/mongod.log

# Where and how to store data.

storage:

dbPath: /var/lib/mongo

journal:

enabled: true

# engine:

# wiredTiger:

# how the process runs

processManagement:

fork: true # fork and run in background

pidFilePath: /var/run/mongodb/mongod.pid # location of pidfile

timeZoneInfo: /usr/share/zoneinfo

# network interfaces

net:

port: 27017

bindIp: 0.0.0.0 # Enter 0.0.0.0,:: to bind to all IPv4 and IPv6 addresses or, alternatively, use the net.bindIpAll setting.

replication:

replSetName: "rs0"

security:

keyFile: /etc/mongod/mongodb-keyfile

#operationProfiling:

#replication:

#sharding:

## Enterprise-Only Options

#auditLog:

#snmp:

Make sure the changes highlighted in yellow are available in your conf file

Connect to the member of the replica set where you created the administrative users.

Connect to the replica set member you started and authenticate as the siteRootAdmin user. From the mongo shell, use the following operation to authenticate:

use admin

db.auth("siteRootAdmin", "");

Initiate the replica set.

Use rs.initiate() on the replica set member:

rs.initiate()

MongoDB initiates a set that consists of the current member and that uses the default replica set configuration.

Verify the initial replica set configuration.

Use rs.conf() to display the replica set configuration object:

rs.conf()

The replica set configuration object resembles the following:

{

"_id" : "rs0",

"version" : 1,

"members" : [

{

"_id" : 1,

"host" : "mongo0:27017"

}

]

}

Add the remaining members to the replica set.

Add the remaining members with the rs.add() method.

The following example adds two members:

rs.add("mongo1")

rs.addArb("mongo2")

When complete, you have a fully functional replica set. The new replica set will elect a primary.

Check the status of the replica set.

Use the rs.status() operation:

rs.status()

On secondary (slave) execute

rs.slaveOk()