Auth Layer Server using KeyCloak #42

AlfredoG87 · 2024-03-07T01:58:19Z

Description:
Added a subchart for deploying keycloak as an authentication server for the auth-layer to secure the admin API port for thegraph index node.

Used an existing helm chart maintened by Bitnami for deploying keycloak, and only added on top configurations specific to the needs of HederaTheGraph Auth server.

Related issue(s):

Fixes #

Notes for reviewer:

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

…or the auth-layer to secure the admin API port for thegraph index node. Signed-off-by: Alfredo Gutierrez <[email protected]>

Signed-off-by: Alfredo Gutierrez <[email protected]>

Nana-EC

LG
Non blocking comments as you can get the bulk in and modify

Nana-EC · 2024-03-25T14:42:09Z

charts/auth-layer-server/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: auth-layer-server
+appVersion: "19.1.0"


Q: is this right? I thought we usually match the appVersion with the version.
Maybe you're making a suggestion to not do this

yeah, since we are more or less mirroring the bitnami chart with some modified defaults, It seems like we should just also mirror the keycloak chart value for version and appVersion here?

yes, this is right and on purpose, since appVersion normally refers to the version of the app, in this case is version 19.1.0 of the Bitnami Chart, however I also see your point and either way it would work and be fine.

Nana-EC · 2024-03-25T14:43:17Z

charts/auth-layer-server/README.md

+    - Login with email is enabled
+
+## Prerequisites
+- Minikube or a Kubernetes cluster


nit: i like to provide links to the official sites for easy use by devs

Nana-EC · 2024-03-25T17:16:47Z

charts/auth-layer-server/README.md

+#### Groups and Roles
+
+**a. Subgraph Admin:**, has access to all the subgraphs admin endpoints. (`subgraph_create`, `subgraph_remove`, `subgraph_deploy`,`subgraph_pause` and `subgraph_resume`)
+**b. Subgraph Deployer:**, has access to: `subgraph_pause`, 'subgraph_resume' and 'subgraph_deploy' endpoints.


Suggested change

**b. Subgraph Deployer:**, has access to: `subgraph_pause`, 'subgraph_resume' and 'subgraph_deploy' endpoints.

**b. Subgraph Deployer:**, has access to: `subgraph_pause`, `subgraph_resume` and `subgraph_deploy` endpoints.

charts/auth-layer-server/templates/realm-configmap.yaml

Nana-EC · 2024-03-25T17:19:46Z

charts/auth-layer-server/templates/realm-configmap.yaml

+metadata:
+  name: keycloak-realm-config
+data:
+  realm.json: |


Q: this is a very large json value.
Maybe not for this PR but could this be split into more than one file and mounted or does it have to be one?
Not sure how this is readable.

Yes, indeed is a large json, this is the export file that KeyCloak produces when we Export a given Realm, for backup or sharing purposes.
Also not sure if we can split it, most likely not, that said, this file is not meant to be read or modify manually, is expected to be imported as is and then visualized on the GUI.

Should probably have such a comment somewhere then.

beeradb · 2024-03-25T19:11:41Z

charts/auth-layer-server/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: auth-layer-server
+appVersion: "19.1.0"


yeah, since we are more or less mirroring the bitnami chart with some modified defaults, It seems like we should just also mirror the keycloak chart value for version and appVersion here?

beeradb · 2024-03-25T19:24:39Z

charts/auth-layer-server/README.md

+- Realm preconfigured with the HTG (htg-auth-layer) client
+- Groups and Roles preconfigured for the HTG client
+- Custom claim mappers for the HTG client
+- Token expiration time set to 10 hours (plenty of time for a one day work session)


nit: if there are links to docs explaining these settings we're overriding/modifying that would be useful here.

yes there is an official documentation for keycloak that we can link here.

beeradb · 2024-03-25T19:31:37Z

charts/auth-layer-server/templates/realm-configmap.yaml

+metadata:
+  name: keycloak-realm-config
+data:
+  realm.json: |


nit: this file would probably be easier to work with if the json lived in its own file, and was included via the $files.Get template function

Thanks for the suggestion, however I am doing 1 replacement that could be potentially be used by a parent umbrella chart when deploying the server and the proxy altogether, so the same clientSecret can be shared and pre-set for the client "HederaTheGraph" that comes pre-configured on this realm export.

see line: 890

"secret": {{ include "auth.clientSecret" . | quote }},

Signed-off-by: Alfredo Gutierrez <[email protected]>

beeradb · 2024-03-26T14:34:32Z

charts/auth-layer-server/README.md

+
+To install the Authentication Layer Server, run the following commands:
+
+- Install the chart, using the custom values file provided in the `values.yaml` file


nit: you also need to run helm dependency build if this is the first time using the chart (and presumably again if dependencies change?).

beeradb · 2024-03-26T14:34:34Z

charts/auth-layer-server/README.md

+
+Define a custom password, use `auth.adminPassword` like this: 
+```bash
+helm install htg-auth-server . --set auth.adminPassword=yourpassword


This did not work for me - I installed via this command: helm install htg-auth-server . --set auth.adminPassword=secret.

I was able to successfully retrieve the admin password from the secret, so maybe it's just not setting the correct variable?

Fixed, it was actually keycloak.auth.adminPassword=yourpassword

✅

beeradb · 2024-03-26T14:35:21Z

charts/auth-layer-server/README.md

+kubectl port-forward service/htg-auth-server-keycloak 8080:80
+```
+#### Login to the Admin Console
+Access console on the following URK: `http://localhost:8080/admin/master/console/#/HederaTheGraph`


nit: this might actually be better as a link. When following the readme I ended up just copying and pasting this URL.

beeradb · 2024-03-26T14:48:17Z

charts/auth-layer-server/README.md

+
+
+#### Verify a Token
+To verify a token, you can call the introspection endpoint of the Authentication Layer Server. The introspection endpoint is available at the following URL: `http://localhost:8080/auth/realms/HederaTheGraph/protocol/openid-connect/token/introspect`


nit: this also would probably be better as a link

This is not mean to be called by a browser, so the link does not makes too much sense.

Signed-off-by: Alfredo Gutierrez <[email protected]>

Added a subchart for deploying keycloak as an authentication server f…

a0dc895

…or the auth-layer to secure the admin API port for thegraph index node. Signed-off-by: Alfredo Gutierrez <[email protected]>

AlfredoG87 self-assigned this Mar 7, 2024

AlfredoG87 marked this pull request as draft March 7, 2024 01:58

AlfredoG87 added the New Feature A new feature, service, or documentation. Major changes that are not backwards compatible. label Mar 7, 2024

AlfredoG87 added this to the 0.2.0 milestone Mar 7, 2024

AlfredoG87 requested review from rustyShacklefurd and Nana-EC March 7, 2024 01:59

removing .lock file

5b8fca3

Signed-off-by: Alfredo Gutierrez <[email protected]>

AlfredoG87 marked this pull request as ready for review March 7, 2024 15:48

Nana-EC approved these changes Mar 25, 2024

View reviewed changes

beeradb reviewed Mar 25, 2024

View reviewed changes

AlfredoG87 added 2 commits March 25, 2024 15:07

Improvements on Documentation suggested by code reviews

2a15d3e

Signed-off-by: Alfredo Gutierrez <[email protected]>

Improvements on Documentation suggested by code reviews

82a3348

Signed-off-by: Alfredo Gutierrez <[email protected]>

beeradb reviewed Mar 26, 2024

View reviewed changes

Improvements on Documentation suggested by code reviews

83465b4

Signed-off-by: Alfredo Gutierrez <[email protected]>

AlfredoG87 merged commit db748f6 into main Mar 26, 2024
3 checks passed

AlfredoG87 deleted the auth-server-keycloak-chart branch March 26, 2024 21:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth Layer Server using KeyCloak #42

Auth Layer Server using KeyCloak #42

AlfredoG87 commented Mar 7, 2024 •

edited

Loading

Nana-EC left a comment

Nana-EC Mar 25, 2024

beeradb Mar 25, 2024 •

edited

Loading

AlfredoG87 Mar 25, 2024

Nana-EC Mar 25, 2024

AlfredoG87 Mar 25, 2024

Nana-EC Mar 25, 2024

AlfredoG87 Mar 25, 2024

Nana-EC Mar 25, 2024

AlfredoG87 Mar 25, 2024

Nana-EC Mar 26, 2024

beeradb Mar 25, 2024 •

edited

Loading

beeradb Mar 25, 2024

AlfredoG87 Mar 25, 2024

AlfredoG87 Mar 25, 2024

beeradb Mar 25, 2024

AlfredoG87 Mar 25, 2024

Nana-EC Mar 26, 2024

beeradb Mar 26, 2024

AlfredoG87 Mar 26, 2024

beeradb Mar 26, 2024

AlfredoG87 Mar 26, 2024

beeradb Mar 26, 2024

AlfredoG87 Mar 26, 2024

beeradb Mar 26, 2024

AlfredoG87 Mar 26, 2024

	b. Subgraph Deployer:, has access to: `subgraph_pause`, 'subgraph_resume' and 'subgraph_deploy' endpoints.
	b. Subgraph Deployer:, has access to: `subgraph_pause`, `subgraph_resume` and `subgraph_deploy` endpoints.


		To install the Authentication Layer Server, run the following commands:

		- Install the chart, using the custom values file provided in the `values.yaml` file



		#### Verify a Token
		To verify a token, you can call the introspection endpoint of the Authentication Layer Server. The introspection endpoint is available at the following URL: `http://localhost:8080/auth/realms/HederaTheGraph/protocol/openid-connect/token/introspect`

Auth Layer Server using KeyCloak #42

Auth Layer Server using KeyCloak #42

Conversation

AlfredoG87 commented Mar 7, 2024 • edited Loading

Nana-EC left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

beeradb Mar 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

beeradb Mar 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AlfredoG87 commented Mar 7, 2024 •

edited

Loading

beeradb Mar 25, 2024 •

edited

Loading

beeradb Mar 25, 2024 •

edited

Loading