lab04

Lab 4

API Security

Securing APIs with OpenID Connect and Red Hat Single Sign On

• Duration: 30 mins
• Audience: API Owners, Product Managers, Developers, Architects

Overview

Once you have APIs in your organization and have applications being written, you also want to be sure in many cases that thee various types of users of the APIs are correctly authenticated. In this lab you will discover how to set up the widely used OpenID connect pattern for Authentication.

Why Red Hat?

The Red Hat SSO product provides important functionality for managing identities at scale. In this lab you can see how it fits together with 3scale and OpenShift.

Skipping The Lab

We know sometime we don't have enough time to go over step by step on the labs. So here is a short video where you can see how to configure OpenID Connect for your service using Red Hat Single Sign On.

If you are planning to follow to the next lab, there is an already running OpenID Connect secured API proxy for the Location API Service in this endpoint:

https://location-service-sso.amp.apps.GUID.opentlc.com

Environment

URLs:

Check with your instruction the GUID number of your current workshop environment. Replace the actual number on all the URLs where you find GUID.

Example in case of GUID = cluster-lhm8v.lhm8v.sandbox430:

https://console-openshift-console.apps.GUID.opentlc.com

becomes =>

https://console-openshift-console.apps.cluster-lhm8v.lhm8v.sandbox430.opentlc.com

Credentials:

Your username is your asigned user number. For example, if you are assigned user number 1, your username is:

user1

The password to login is always the same:

openshift

Lab Instructions

Step 1: Get Red Hat Single Sign On Service Account Credentials

1. Open a browser window and navigate to:

   http://sso-rh-sso.apps.GUID.opentlc.com/auth/admin/userX/console/

   Remember to replace the GUID with your environment value and your user number.

2. Log into Red Hat Single Sign On using your designated user and password. Click on Sign In.

   

3. Select Clients from the left menu.

   

   A 3scale-admin client and service account was already created for you.

4. Click on the 3scale-admin link to view the details.

   

5. Click the Credentials tab.

   

6. Take notice of the service account Secret. Copy and save it or write it down as you will use it to configure 3scale.

   

Step 2: Add User to Realm

1. Click on the Users menu on the left side of the screen.

   

2. Click the Add user button.

   

3. Type apiuser as the Username.

   

4. Click on the Save button.

5. Click on the Credentials tab to reset the password. Type apipassword as the New Password and Password Confirmation. Turn OFF the Temporary to avoid the password reset at the next login.

   

6. Click on Reset Password.

7. Click on the Change password button in the pop-up dialog.

   

   Now you have a user to test your integration.

Step 3: Configure 3scale Integration

1. Open a browser window and navigate to:

   https://userX-admin.apps.bilbao-8ecb.open.redhat.com/

   Remember to replace the GUID with your environment value and your user number.

2. Accept the self-signed certificate if you haven't.

   

3. Log into 3scale using your designated user and password. Click on Sign In.

   

4. The first page you will land is the API Management Dashboard. Click on the API menu link.

   

5. This is the API Overview page. Here you can take an overview of all your services. Click on the Settings menu link and the Settings menu link.

   

6. Scroll down the page, under the Authentication section, select OpenID Connect Use OpenID Connect for any OAuth 2.0 flow.

   

7. In the OPENID CONNECT (OIDC) BASICS section, change the type in your previously noted client credentials with the URL of your Red Hat Single Sing On instance:

   http://3scale-admin:CLIENT_SECRET@sso-rh-sso.apps.GUID.opentlc.com/auth/realms/userX

   Remember to replace the GUID with your environment value, your user number and the CLIENT_SECRET you get in the Step 1.

   

8. Scroll down the page and click on the Update Product button.

   

9. Once it has been updated, you will notice that a warning appears under Configuration menu, click on the menu link.

   

10. Promote to Staging by clicking the Promote to Stanging APIcast button.

    

11. Promote to Production by clicking the Promote to Production button.

    

Step 4: Create a Test App

1. Go to Audience main menu link.

2. Click on Developer.

   

3. Click on the Applications link.

   

4. Click on Create Application link.

   

5. Select Basic plan from the combo box. Type the following information:

   • Name: Secure App
   • Description: OpenID Connect Secured Application

   

6. Finally, scroll down the page and click on the Create Application button.

   

7. Note the API Credentials. Write them down as you will need the Client ID and the Client Secret to test your integration.

   

Congratulations! You have now an application to test your OpenId Connect integration.

Steps Beyond

So, you want more? Login to the Red Hat Single Sign On admin console for your realm if you are not there already. Click on the Clients menu. Now you can check that 3scale zync component creates a new Client in SSO. This new Client has the same ID as the Client ID and Secret from the 3scale admin portal.

Test the integration

You can try to use Postman or OpenID Connet playground to test your integration. Remember to update the Redirect URL.

1. Download the postman client if you already don't have it:

   Postman

2. Create a new Request in postman click ****:

3. Add the following properties:

   • Request Name: Get Locations
   • Collection Name: Locations Collection

   

4. Click Save to locations button.

5. Select Authorization tab, then click Type and select Oauth 2.0

   

6. Configure a new Token:

   • Token Name: RHSSO
   • Gran Type: Authorization Code
   • Callback URL: https://openidconnect.net/callback
   • Auth URL: http://sso-rh-sso.apps.GUID.opentlc.com/auth/realms/userX/protocol/openid-connect/auth
   • Access Token URL: http://sso-rh-sso.apps.GUID.opentlc.com/auth/realms/userX/protocol/openid-connect/token
   • Client ID:
   • Client Secret:
   • Client Authentication: Send as Basic Auth header

   

7. Click in Get New Access token

8. Add username and password in the rhsso browser:

   

9. Click Log in button.

10. If successful, you will see a page with the generated token. Click Use Token button to add it to the request.

    

11. Add the url to test the service

    • URL : http://location-service-userX.apps.GUID.opentlc.com/locations

12. Click Send Blue button:

    

Summary

Now that you can secure your API using three-leg authentication with Red Hat Single Sign-On, you can leverage the current assets of your organization like current LDAP identities or even federate the authentication using other IdP services.

For more information about Single Sign-On, you can check its page.

You can now proceed to Lab 5

Notes and Further Reading

• Red Hat 3scale API Management
• Red Hat Single Sign On
• Setup OIDC with 3scale