Chapter 5. Configuring OAuth authorization

This section describes how to connect Red Hat CodeReady Workspaces as an OAuth application to supported OAuth providers.

5.1. Configuring GitHub OAuth

OAuth for GitHub allows for automatic SSH key upload to GitHub.

Procedure

  • Set up the GitHub OAuth client. The Authorization callback URL is filled in the next steps.

    1. Go to the RH-SSO administration console and select the Identity Providers tab.
    2. Select the GitHub identity provider in the drop-down list.
    3. Paste the Redirect URI to the Authorization callback URL of the GitHub OAuth application.
    4. Fill the Client ID and Client Secret from the GitHub oauth app.
    5. Enable Store Tokens.

    6. Save the changes of the Github Identity provider and click Register application in the GitHub oauth app page.

      github keycloak setup

5.2. Configuring OpenShift OAuth

For users to interact with OpenShift, they must first authenticate to the OpenShift cluster. OpenShift OAuth is a process in which users prove themselves to a cluster through an API with obtained OAuth access tokens.

Authentication with the OpenShift connector plugin is a possible way for CodeReady Workspaces users to authenticate with an OpenShift cluster.

The following section describes the OpenShift OAuth configuration options and its use with a CodeReady Workspaces.

Prerequisites

  • The OpenShift command-line tool, oc is installed.

Procedure

To enable OpenShift OAuth automatically, deployed CodeReady Workspaces using the crwctl with the --os-oauth option. See the crwctl server:start specification chapter.

  • For CodeReady Workspaces deployed in single-user mode:

    1. Register CodeReady Workspaces OAuth client in OpenShift. See the Register an OAuth client in OpenShift chapter. 

      $ oc create -f <(echo '
kind: OAuthClient
apiVersion: oauth.openshift.io/v1
metadata:
 name: che
secret: "<random set of symbols>"
redirectURIs:
 - "<CodeReady Workspaces api url>/oauth/callback"
grantMethod: prompt
')

    2. Add the OpenShift SSL certificate to the CodeReady Workspaces Java trust store.

    3. Update the OpenShift deployment configuration. 

      CHE_OAUTH_OPENSHIFT_CLIENTID: <client-ID>
CHE_OAUTH_OPENSHIFT_CLIENTSECRET: <openshift-secret>
CHE_OAUTH_OPENSHIFT_OAUTH__ENDPOINT: <oauth-endpoint>
CHE_OAUTH_OPENSHIFT_VERIFY__TOKEN__URL: <verify-token-url>
      • <client-ID> a name specified in the OpenShift OAuthClient.
      • <openshift-secret> a secret specified in the OpenShift OAuthClient.

      • <oauth-endpoint> the URL of the OpenShift OAuth service:

        • For OpenShift 3 specify the OpenShift master URL.
        • For OpenShift 4 specify the oauth-openshift route.
      • <verify-token-url> request URL that is used to verify the token. <OpenShift master url>/api can be used for OpenShift 3 and 4.
      • See CodeReady Workspaces configMaps and their behavior.