keycloak variables

docs/authentication.md

@@ -0,0 +1,18 @@
+# Authentication
+
+Yaptide platform can authenticate users using two methods:
+
+  * using own database of users. In that case submission of simulation is limited only to a local pool of workers.
+  * using Keycloak server. Such server is provided for example in PLGrid infrastructure. This solution offers a possibility to submit simulations to an HPC cluster.
+
+
+Configuration of keycloak is based on following environmental variables:
+
+  * `KEYCLOAK_BASE_URL` - URL of the keycloak server, for example `'https://sso.pre.plgrid.pl'`
+  * `KEYCLOAK_REALM` - name of the realm, for example `PLGrid`
+  * `KEYCLOAK_CLIENT_ID` - name of the client, for example `yaptide`
+
+  These variables needs to be provided to the docker compose files via the `.env` file, both for backend and the frontend parts.
+  The backend propagates this variable to the `yaptide_flask` container, to be able to verify keycloak tokens.
+  The frontend needs to know the URL of the keycloak server, so it can redirect the user to the login page.
+  To properly setup these variables in case of ansible deployment, please use `plgrid_vars.yml` as an example.

mkdocs.yml

@@ -15,15 +15,16 @@ theme:
     - navigation.top
 
 nav:
-- Home:
-  - Overview: index.md
-  - Maintenance: maintenance.md
-  - Simulators: simulators.md
-  - Cloud deploy: ansible.md
+  - Home:
+      - Overview: index.md
+      - Maintenance: maintenance.md
+      - Simulators: simulators.md
+      - Authentication: authentication.md
+      - Cloud deploy: ansible.md
 
 plugins:
-- search
-- git-revision-date-localized
+  - search
+  - git-revision-date-localized
 
 markdown_extensions:
   - pymdownx.superfences

plgrid_vars.yml

@@ -1,12 +1,23 @@
 ---
+
+# general settings
 frontend_backend_hostname: 'yap-dev.c3.plgrid.pl'
 frontend_backend_url: 'https://yap-dev.c3.plgrid.pl:8443'
 frontend_ui_hostname: 'yap-dev.c3.plgrid.pl'
 frontend_ui_url: 'https://yap-dev.c3.plgrid.pl'
 
+# backend cluster settings
 backend_cluster: 'ares.cyfronet.pl'
 backend_cert_auth_url: 'https://ccm-dev.kdm.cyfronet.pl/key'
 backend_backend_external_url: 'https://yap-dev.c3.plgrid.pl:8443'
 
+# keycloak settings
+frontend_keycloak_base_url: 'https://sso.pre.plgrid.pl'
+frontend_keycloak_realm: 'PLGrid'
+frontend_keycloak_client_id: 'yaptide-staging'
+backend_keycloak_base_url: 'https://sso.pre.plgrid.pl'
+backend_keycloak_realm: 'PLGrid'
+
+# github repo settings
 frontend_repo_version: 'master'
 backend_repo_version: 'master'

roles/backend/defaults/main.yml

@@ -6,6 +6,7 @@ backend_password: "password"
 backend_cluster: ""
 backend_cert_auth_url: ""
 backend_backend_external_url: "http://localhost:5000"
-
+backend_keycloak_base_url: ""
+backend_keycloak_realm: ""
 
 ansible_become: false

roles/backend/tasks/deploy.yml

@@ -29,8 +29,16 @@
     create: true
     block: |
       MAX_CORES = {{ [1, backend_vcpus_output.ansible_facts.ansible_processor_vcpus - 2] | max }}
+      {% if backend_cert_auth_url != "" %}
       CERT_AUTH_URL = {{ backend_cert_auth_url }}
+      {% endif %}
       BACKEND_EXTERNAL_URL = {{ backend_backend_external_url }}
+      {% if backend_keycloak_base_url != "" %}
+      KEYCLOAK_BASE_URL = {{ backend_keycloak_base_url }}
+      {% endif %}
+      {% if backend_keycloak_realm != "" %}
+      KEYCLOAK_REALM = {{ backend_keycloak_realm }}
+      {% endif %}
       {% if lookup('file', './.env', errors='ignore') is defined %}
       {{ lookup('file', './.env', errors='ignore') }}
       {% endif %}

roles/frontend/defaults/main.yml

@@ -7,3 +7,7 @@ frontend_backend_hostname: "localhost"
 frontend_backend_url: "http://localhost:5000"
 frontend_ui_hostname: "localhost"
 frontend_ui_url: "http://localhost:80"
+
+frontend_keycloak_base_url: ""
+frontend_keycloak_realm: ""
+frontend_keycloak_client_id: ""

roles/frontend/tasks/deploy.yml

@@ -32,6 +32,15 @@
     block: |
       REACT_APP_BACKEND_URL = {{ frontend_backend_url }}
       REACT_APP_ALT_AUTH = 'plg'
+      {% if frontend_keycloak_base_url != "" %}
+      KEYCLOAK_BASE_URL = {{ frontend_keycloak_base_url }}
+      {% endif %}
+      {% if frontend_keycloak_realm != "" %}
+      KEYCLOAK_REALM = {{ frontend_keycloak_realm }}
+      {% endif %}
+      {% if frontend_keycloak_client_id != "" %}
+      KEYCLOAK_CLIENT_ID = {{ frontend_keycloak_client_id }}
+      {% endif %}
 
 # https://docs.ansible.com/ansible/latest/collections/community/docker/docker_compose_module.html
 - name: Run `docker-compose up` to bring up the frontend