Skip to content

mbp-1043: Client Assertion based authentication using Entra ID #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mlorenzofr wants to merge 1 commit into
base: main
Choose a base branch
from
Open

mbp-1043: Client Assertion based authentication using Entra ID #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 22 additions & 7 deletions charts/qtodo/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,21 +21,36 @@ quay.io/ztvp/qtodo) so no VP --set override is needed.
Generate the URL of the OIDC service
*/}}
{{- define "qtodo.oidc.url" }}
{{- if not .Values.app.oidc.authServerUrl }}
{{- printf "https://keycloak.%s/realms/%s" .Values.global.localClusterDomain .Values.app.oidc.realm }}
{{- else }}
{{- if .Values.app.oidc.authServerUrl }}
{{- print .Values.app.oidc.authServerUrl }}
{{- else if eq .Values.app.oidc.provider "entraid" }}
{{- if not .Values.app.oidc.entraid.tenantId }}
{{- fail "app.oidc.entraid.tenantId is required when using Entra ID provider" }}
{{- end }}
{{- printf "https://login.microsoftonline.com/%s/v2.0" .Values.app.oidc.entraid.tenantId }}
{{- else }}
{{- printf "https://keycloak.%s/realms/%s" .Values.global.localClusterDomain .Values.app.oidc.realm }}
{{- end }}
{{- end }}

{{/*
Generate the JWT Audience
Generate the JWT Audience for SPIFFE authentication
*/}}
{{- define "qtodo.jwt.audience" }}
{{- if not .Values.app.vault.audience }}
{{- printf "https://keycloak.%s/realms/%s" .Values.global.localClusterDomain .Values.app.oidc.realm }}
{{- else }}
{{- if .Values.app.vault.audience }}
{{- print .Values.app.vault.audience }}
{{- else if eq .Values.app.oidc.provider "entraid" }}
{{- if .Values.app.oidc.entraid.audience }}
{{- if hasPrefix "api://" .Values.app.oidc.entraid.audience }}
{{- print .Values.app.oidc.entraid.audience }}
{{- else }}
{{- printf "api://%s" .Values.app.oidc.entraid.audience }}
{{- end }}
{{- else }}
{{- fail "app.oidc.entraid.audience is required when using Entra ID provider" }}
{{- end }}
{{- else }}
{{- printf "https://keycloak.%s/realms/%s" .Values.global.localClusterDomain .Values.app.oidc.realm }}
{{- end }}
{{- end }}

Expand Down
3 changes: 3 additions & 0 deletions charts/qtodo/templates/app-config-env.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,8 @@ data:
{{- if and .Values.app.oidc.clientAssertion.enabled (not .Values.app.oidc.clientSecret.enabled) }}
QUARKUS_OIDC_CREDENTIALS_JWT_SOURCE: "bearer"
QUARKUS_OIDC_CREDENTIALS_JWT_TOKEN_PATH: "{{ .Values.app.oidc.clientAssertion.jwtTokenPath }}"
{{- if eq .Values.app.oidc.provider "entraid" }}
QUARKUS_OIDC_CREDENTIALS_JWT_AUDIENCE: "{{ include "qtodo.jwt.audience" . }}"
{{- end }}
{{- end }}
{{- end }}
8 changes: 7 additions & 1 deletion charts/qtodo/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ app:

oidc:
enabled: false # Will be enabled when SPIFFE is enabled
# OIDC Provider: keycloak or entraid
provider: "keycloak"
authServerUrl: ""
realm: "ztvp"
clientId: "qtodo-app"
Expand All @@ -63,6 +65,10 @@ app:
enabled: false
name: "oidc-client-secret"
vaultPath: "secret/data/apps/qtodo/qtodo-oidc-client"
# Entra ID specific configuration
entraid:
tenantId: ""
audience: "api://AzureADTokenExchange"

# Route configuration
route:
Expand All @@ -83,7 +89,7 @@ app:
url: ""
role: "qtodo"
# JWT Audience (auto-generated if not set)
# audience: "api://client-id"
# audience: "<URI for the audience>"
# QTodo secrets path (app-level isolation)
secretPath: "secret/data/apps/qtodo/qtodo-db"

Expand Down
2 changes: 1 addition & 1 deletion charts/rhtpa-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ rhtpa:
cli:
clientId: "rhtpa-cli" # Confidential client for RHTPA CLI/API
secretName: "rhtpa-oidc-cli-secret" # Kubernetes secret containing client secret
apiId: "" # API client ID, used in Azure Entra ID integration
apiId: "" # Azure Entra ID Application (client) ID - UUID only
# RHTPA OIDC CLI secret path (infra)
secretVaultPath: "secret/data/hub/infra/rhtpa/rhtpa-oidc-cli"

Expand Down
2 changes: 1 addition & 1 deletion charts/supply-chain/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ rhtpa:
enabled: true
url: ""
realm: "ztvp" # Keycloak realm to use for authentication
apiId: "" # Azure Entra ID API ID to use for authentication
apiId: "" # Azure Entra ID Application (client) ID - UUID only
clientId: "rhtpa-cli"
clientSecretName: "qtodo-rhtpa-cli-password"
# RHTPA OIDC CLI secret path (infra)
Expand Down
Loading
Loading