Chapter 5. Developer Portal authentication

1. Create a realm as described in the Red Hat Single Sign-On documentation.
2. Add a client by going to Clients and clicking on Create.

3. Fill in the form considering the following fields and values:

   • Client ID: type the desired name for your client.
   • Enabled: switch to ON.
   • Consent Required: switch to OFF.
   • Client Protocol: select openid-connect.
   • Access Type: select confidential.
   • Standard Flow Enabled: switch to ON.
   • Root URL: type your 3scale admin portal URL. This should be the URL address that you use to log in into your developer portal, e.g.: https://yourdomain.3scale.net or your custom URL.

   • Valid Redirect URLs: type your developer portal again by /* like this: https://yourdomain.3scale.net/*.

     All the other parameters should be left empty or switched to OFF.

4. Get the client secret with the following steps:

   • Go to the Client you just created.
   • Click on Credentials tab.

   • Select Client Id and Secret in Client Authenticator field.

     

5. Configure the email_verified mapper. 3scale requires that the email_verified claim of the user data is set to true. In order to map the "Email Verified" user attribute to the email_verified claim:

   • Go to the Mappers tab of the client.

   • Click Add Builtin.

     

   • Select the email verified option, and click Add selected to save the changes.

     

     If you manage the users in the Red Hat Single Sign-On local database, make sure that the Email Verified attribute of the user is set to ON.

     If you use User Federation, in the client created previously for 3scale SSO integration, you can configure a hardcoded claim by setting the token name to email_verified and the claim value to true.

6. Optionally, configure the org_name mapper.
   When a user signs up in 3scale, the user is requested to fill in the signup form with the Organization Name value. In order to make the signup via Red Hat Single Sign-On transparent for the user by not requiring to fill in the signup form on the developer portal, you need to configure an additional org_name mapper:

   • Go to the Mappers tab of the client.
   • Click Create.

   • Fill the mapper parameters as follows:

     • Name: type any desired name, e.g. org_name.
     • Consent Required: switch to OFF.
     • Mapper Type: select User Attribute.
     • User Attribute: type org_name.
     • Token Claim Name: type org_name.
     • Claim JSON Type: select String.
     • Add to ID token: switch to ON.
     • Add to access token: switch to ON.
     • Add to userinfo: switch to ON.
     • Multivalued: switch to OFF.

   • Click Save.

     

     If the users in Red Hat Single Sign-On have the attribute org_name, 3scale will be able to create an account automatically. If not, then the user will be asked to indicate Organization Name before the account can be created. Alternatively, a mapper of type Hardcoded claim can be created to set the organization name to a hardcoded value for all users signing in with the Red Hat Single Sign-On account.

7. To test the integration, you need to add a user. To achieve this, navigate to Users, click Add user, and fill the required fields. Note that when you create an User in Red Hat Single Sign-On the Email Verified attribute (email_verified) should be set to ON, otherwise the user will not be activated in 3scale.

1. In Red Hat Single Sign-On, after configuring GitHub in Identity providers, go to the tab called Mappers and click Create.

   
2. Give it a name so you can identify it.
3. In Mapper Type select Attribute Importer.
4. In Social Profile JSON Field Path add company, which is the name of the attribute on GitHub.

5. In User Attribute Name add org_name, that is how we called the attribute in Red Hat Single Sign-On.

   Note

   Red Hat Single Sign-On requires first and last name as well as email as mandatory fields. 3scale requires email address, username, and organization name. So in addition to configuring a mapper for the organization name, and for your users to be able to skip both sign up forms, make sure that:

   • In the IdP account, they have their first name and last name set.
   • In the IdP account, their email address is accessible. E.g. In GitHub, if you set up your email address as private, it won’t be shared.

Procedure

1. In the 3scale Admin Portal, select Audience > Developer Portal > SSO Integrations.
2. Click Red Hat Single Sign-On.
3. Specify the details of the RH-SSO client that you have configured in Section 5.4.2, “Configuring RH SSO to authenticate the Developer Portal”: client, client secret and realm.
4. To save your changes, click Create Red Hat Single Sign-On