Versions Compared

Old Version 4

changes.mady.by.user Munish Mahabiersing

Saved on

compared with

New Version Current

changes.mady.by.user Tijmen Daatselaar

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents
maxLevel2

By default Keycloak is installed and configured so that it can be used by Encore and the Studio server using the OIDC protocol.

Keycloak admin credentials

During the installation of Blueriq using the installer, a Keycloak user named admin is created for which a password has been specified during the installation as well.

Note

The admin user for Keycloak is a different user from the admin user for Encore and the Studio server. The Keycloak admin user is defined in the Master realm and used to manage the Keycloak server, while the Encore (and Studio server) admin user is defined in a Studio-specific realm and used to manage the Studio.

The default admin credentials for Keycloak can be found in the file [Installation_Folder]\Keycloak\bin\kc-service.xml

It is recommended to change the admin password after installation via the Keycloak admin console. To do change the admin password, take the following steps:

From the Blueriq start page, select User Management

Image RemovedImage Added

Log in to the Keycloak Admin console using the credentials found in [Installation_Folder]\Keycloak\bin\kc-service.xmluser named admin and the password as created during the installation.

Note

Accessing Keycloak is not possible in Internet Explorer

In the top right corner, select Manage account

Image RemovedImage Added


Select "Signing in" from the Account Security card.

Image RemovedImage Added


Select Update from the Basic Authentication section, and choose a new password.

Image RemovedImage Added


Click "Back to Security Admin Console" from the top left to go back to the Admin console, you may need to sign in again with the new password.

...

The default configuration is created when installing Blueriq. This configuration is contained within a Keycloak realm which is used by Encore and the Studio server. This section contains an overview of what the default configuration includes.

...

  • studio-server: Used by the Studio backend, this is a private client which as has admin access to the Studio
  • encore: Used by Encore, this is a public client which retrieves an access token on behalf of a user in order to communicate with the Studio backend

The secret for the studio-server client must also be provided to the Studio backend in [Installation_Folder]\Studio\Services\StudioService.exe.config in the oidc and oidccustom elements element. This is normally done during installation, but when generating a new secret in Keycloak this must be updated manually.

Client Scopes

A client scope studio  is included in the realm. When requesting an access token, this scope will activate mappers which add additional information to resulting access token. This information is required by the Studio backend in order to validate the token.

Groups & Roles

A group and role studio-admin  is are created by default , in during the standard Studio installation. The group studio-admin has the role studio-admin assigned to it, this group role is mapped to the default Administrator role in the Studio , which has admin access to the Studioserver.

Users

The following users are created by default, all of them are members of the studio-admin  group, and therefore have admin access to the studioStudio server.

  • admin: the admin user of the Studioadministrationpage: used by the administration pageEncore
  • runtime: used by the runtime development dashboard to retrieve projects.

Restoring the default configuration

...

When restoring the default configuration, the script will also update StudioService.exe.config to set the correct authority url  url for the newly created realm and the new client secret for the studio-server cllient.

Managing Users & Groups

Adding a group

Adding a user

User Federation: NTLM

...

client.

User Federation: NTLM/LDAP

Note

You may need to consult your administrator in order to fill in the following fields.

It is possible to link Keycloak to an Active Directory using User Federation. This will allow users to sign in using their AD credentials. To set this up:

  1. Select User Federation from the navigation panel. From the Add provider drop-down, select ldap.
    Image Added

  2. Select which vendor is used:
    Image Added


  3. Enter the connection url, including the ldap:// prefix. The following command line command may assist in determining the correct url: nslookup -type=all _ldap._tcp.Image Added


  4. Select which credentials Keycloak will use to query the AD, for example as CN=Keycloak,CN=Services,DC=company,DC=com.
    Image Added
  5. Test authentication to ensure the configuration works.
  6. As Edit Mode, choose READ_ONLY
    Image Added
  7. Select where in the LDAP tree Keycloak can find the Studio users that should be able to log in, for example CN=MyStudioUsers,DC=company,DC=com.Image Added
  8. Save your changes
  9. Sync all users in the top right corner:
    Image Added

User Federation: Kerberos

It is possible to link Keycloak to an Active Directory with the Kerberos protocol using User Federation. This will allow users to sign in using their AD credentials. To set this up:

  1. Select User Federation from the navigation panel and then select "Add Kerberos providers".
    Image Added
  2. Choose a UI display name
  3. Enter the Kerberos Realm
    Image Added
  4. Enter the principal for the server 
    Image Added
  5. Enter the location of the keytab file containing credentials of the given principal
    Image Added
  6. Set Allow Password Authentication to On:
    Image Added
  7. Set Edit Mode to READ_ONLY
    Image Added
  8. In order to test it, a AD user can try to sign in to the Account console for the Studio realm at http://<domain:port>/Keycloak/realms/<realm>/account