同步keycloak的group至openshift

延伸這一篇的內容:紀錄Openshift介接Keycloak與389 Directory Server,在LDAP內綁定user至group後,
發現LDAP的group並沒有被同步至keycloak和openshift。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
ldap:/ # dsidm localhost -b "dc=example,dc=com" organizationalunit create --ou Groups
Successfully created Groups
ldap:/ # dsidm localhost -b "dc=example,dc=com" organizationalunit list
example
People
Groups
ldap:/ # dsidm localhost -b "dc=example,dc=com" account list
dc=example,dc=com
ou=People,dc=example,dc=com
uid=jdoe,ou=People,dc=example,dc=com
uid=william,ou=People,dc=example,dc=com
ou=Groups,dc=example,dc=com
ldap:/ # dsidm localhost -b "dc=example,dc=com" group create
Enter value for cn : bu_1
Successfully created bu_1
ldap:/ # dsidm localhost -b "dc=example,dc=com" group create
Enter value for cn : bu_2
Successfully created bu_2
ldap:/ # dsidm localhost group add_member bu_1 uid=jdoe,ou=People,dc=example,dc=com
added member: uid=jdoe,ou=People,dc=example,dc=com
ldap:/ # dsidm localhost group add_member bu_2 uid=william,ou=People,dc=example,dc=com
added member: uid=william,ou=People,dc=example,dc=com
ldap:/ #

jdoe belongs to group bu_1
william belongs to group bu_2

有兩件事要處理

  1. LDAP的group同步至Keycloak
  2. Keycloak的group同步至Openshift

LDAP的group同步至keycloak

參考設定Keycloak v19串接Windows AD / LDAP - Jovepater,主要需設定User federation的Mapper,Mapper Type為group-ldap-mapperLDAP Groups DN需對應LDAP的實際值,這邊是ou=Groups,dc=example,dc=com

ldap_keycloak_1

ldap_keycloak_2

ldap_keycloak_3

設定完成後,手動同步
ldap_keycloak_4

成功的話會出現在Keycloak Groups的清單
ldap_keycloak_5

Keycloak的group同步至Openshift

這邊卡了一陣子,有找到官網的文件:Chapter 7. Configuring identity providers | Red Hat Product Documentation,但還是有點一頭霧水,只知道可能需要在openid的yaml內補上groups,其他部分不太確定要怎麼做,幸好2025年是生成式AI的時代,感謝Perpluxity

prompt如下

1
2
3
4
5
6
I have a openshift cluster and a keycloak. I use OAuth in openshift with openid connect related with keycloak.
keycloak has a realm which name is test-realm and there are two users and two groups. one of the user is foo_user and its group is bu_1

using openshift webconsole to login in with foo_user. there is user sync from keycloak but the group does not sync.

can you figure out what happen

Perpluxity的結果幫了很大的忙,了解除了Openshift端需要調整之外,原本的Identity Provider(Keycloak)也需要調整,也獲得一個關鍵的參考文章: Keycloak & Open Shift

有兩個主要修改

  1. 在Keycloak端的Client Scope新增Mapper,Mapper Type為Group Membership
  2. 在Openshift端的OAuth Configuration需加上claims的groups

Keycloak端新增Mapper

試了兩種方式,目前兩種都可以順利將Keycloak的group同步至Openshift

第一種是參考Perpluxity的結果,在特定Client內設定Client Scope的Mapper

keycloak_client_groups_1

keycloak_client_groups_2

keycloak_client_groups_3

keycloak_client_groups_4

這邊須注意Full group path要關閉,開啟的話登入會失敗

開或關的影響是在openid connect回傳的JWT ID Tokens內的groups內容,開啟的話例如: /bu_1,關閉的話僅保留 bu_1,沒有/,這部分會在下面驗證的段落看到實際例子
keycloak_client_groups_5

keycloak_client_groups_6

第二種參考這一篇Keycloak & Open Shift,在profile這個Client Scope內加入

keycloak_client_groups_by_profile_1

keycloak_client_groups_by_profile_2

同上,這邊須注意Full group path要關閉,開啟的話登入會失敗
keycloak_client_groups_by_profile_3

Openshift端加上claims的groups

keycloak_client_groups_7

官網範例如下,關鍵是claim的groups:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: oidcidp
mappingMethod: claim
type: OpenID
openID:
clientID: ...
clientSecret:
name: idp-secret
ca:
name: ca-config-map
extraScopes:
- email
- profile
extraAuthorizeParameters:
include_granted_scopes: "true"
claims:
preferredUsername:
- preferred_username
- email
name:
- nickname
- given_name
- name
email:
- custom_email_claim
- email
groups:
- groups
issuer: https://www.idp-issuer.com

Keycloak端和Openshift端都調整完成後,重新登入

成功啦! 感動涕零QQ
keycloak_group_in_openshift

Keycloak端新增Mapper後如何驗證JWT ID Token的內容

這部分也卡了一陣子,生成式AI這次沒有辦法幫上忙,最後是從Keycloak & Open Shift這篇提到的group is not coming in jwt token in keycloak 23.0.0 - Stack Overflow進而摸索出來

使用下列方式取得JWT ID Token的內容

1
2
3
curl -k --request POST \
--url "https://keycloak.foo.com:8443/realms/test-realm/protocol/openid-connect/token" \
--data "grant_type=password&client_id=admin-cli&username=jdoe&password=bar"

經過JWT decode後,觀察是否出現groups的key

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
{
"exp": 1745998219,
"iat": 1745997919,
"jti": "d69b4c67-9a94-48d0-ac7b-cd5ba1d80fb6",
"iss": "https://keycloak.foo.com:8443/realms/test-realm",
"sub": "59103cfb-73e3-400c-a558-ca3a1bcd903e",
"typ": "Bearer",
"azp": "admin-cli",
"session_state": "3ddcbeeb-69f4-4950-b33c-996ac0170b5b",
"acr": "1",
"scope": "profile email",
"sid": "3ddcbeeb-69f4-4950-b33c-996ac0170b5b",
"email_verified": false,
"name": "John Doe Doe",
"groups": [
"bu_1"
],
"preferred_username": "jdoe",
"given_name": "John Doe",
"family_name": "Doe"
}