Skip to content

Commit 05f9ef0

Browse files
Add idp-initiated with portal example
1 parent 78baaf3 commit 05f9ef0

18 files changed

+449
-19
lines changed

Makefile

+19-1
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,30 @@ start-uaa: ## Start uaa (remember to run make build-uaa if you have not done )
2121
start-keycloak: ## Start keycloak
2222
@./bin/keycloak/deploy
2323

24+
start-forward-proxy: ## Start forward-proxy
25+
@./bin/forward-proxy/deploy
26+
27+
start-portal: ## Start portal
28+
@./bin/portal/deploy
29+
30+
start-proxy: ## Start proxy
31+
@./bin/proxy/deploy
32+
2433
stop-uaa: ## Stop uaa
2534
@docker kill uaa
2635

2736
stop-keycloak: ## Stop keycloak
2837
@docker kill keycloak
2938

39+
stop-forward-proxy: ## Stop forward-proxy
40+
@docker kill forward-proxy
41+
42+
stop-portal: ## Stop portal
43+
@docker kill portal
44+
45+
stop-proxy: ## Stop proxy
46+
@docker kill proxy
47+
3048
stop-dev-keycloak: ## Stop dev keycloak
3149
@docker kill devkeycloak
3250
@docker rm devkeycloak
@@ -39,7 +57,7 @@ start-oauth2-proxy: ## Start oauth2-proxy
3957
@bin/oauth2-proxy/deploy
4058

4159
stop-oauth2-proxy: ## Stop oauth2-proxy
42-
@docker-compose -f conf/oauth2-proxy/compose.yml down
60+
@bin/oauth2-proxy/undeploy
4361

4462
start-rabbitmq: ## Run RabbitMQ Server
4563
@./bin/deploy-rabbit

README.md

+10-5
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,13 @@ When the example requires RabbitMQ with TLS enabled, the corresponding `conf` fo
5454

5555
* [Keycloak](https://www.rabbitmq.com/docs/oauth2-examples-keycloak)
5656
* [Auth0](https://www.rabbitmq.com/oauth2-examples-auth0)
57-
* [Microsoft Entra ID](https://www.rabbitmq.com/docs/oauth2-examples-entra-id) (formerly known as Azure Active Directory)
58-
* [OAuth2 Proxy](https://www.rabbitmq.com/docs/oauth2-examples-proxy)
59-
* [Okta](https://www.rabbitmq.com/docs/oauth2-examples-okta)
60-
* [Google](https://www.rabbitmq.com/docs/oauth2-examples-google) **NOT SUPPORTED**
61-
* [Multiple OAuth 2.0 servers and/or audiences](https://www.rabbitmq.com/docs/oauth2-examples-multiresource)
57+
* [Microsoft Entra ID](https://www.rabbitmq.com/docs/next/oauth2-examples-entra-id) (formerly known as Azure Active Directory)
58+
* [OAuth2 Proxy](https://www.rabbitmq.com/docs/next/oauth2-examples-proxy)
59+
* [Okta](https://www.rabbitmq.com/docs/next/oauth2-examples-okta)
60+
* [Google](https://www.rabbitmq.com/docs/next/oauth2-examples-google) **NOT SUPPORTED**
61+
* [Multiple OAuth 2.0 servers and/or audiences](https://www.rabbitmq.com/docs/next/oauth2-examples-multiresource)
62+
* [Identity Provider initiated logon with a web portal](https://www.rabbitmq.com/docs/next/oauth2-examples-idp-initiated)
63+
64+
### Commercial-only features
65+
66+
* [Explicit forward proxy](https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-rabbitmq-oci/4-0/tanzu-rabbitmq-oci-image/overview.html)

bin/deploy-rabbit

+19-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
#!/usr/bin/env bash
22

3-
#set -x
3+
if [[ ! -z "${DEBUG}" ]]; then
4+
set -x
5+
fi
46

57
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
68

@@ -9,7 +11,7 @@ source $SCRIPT/common
911
MODE=${MODE:-uaa}
1012
OAUTH_PROVIDER=${OAUTH_PROVIDER:-$MODE}
1113
ADVANCED=${ADVANCED:-advanced.config}
12-
IMAGE_TAG=${IMAGE_TAG:-4.0.2-management}
14+
IMAGE_TAG=${IMAGE_TAG:-4.0.7-management}
1315
IMAGE=${IMAGE:-rabbitmq}
1416
RABBITMQ_CONF=${RABBITMQ_CONF:-rabbitmq.conf}
1517

@@ -39,8 +41,8 @@ function generate-final-conf-dir {
3941

4042
}
4143
function generate-tls-certs-if-required {
42-
if [[ -f "${CONF_DIR}/requires-tls" && ! -f "${CERTS_DIR}" ]]; then
43-
generate-ca-server-client-kpi rabbitmq $CERTS_DIR
44+
if [[ -f "${CONF_DIR}/requires-tls" && ! -f "${CERTS_DIR}/server_rabbitmq_certificate.pem" ]]; then
45+
generate-ca-server-client-kpi rabbitmq $CERTS_DIR
4446
fi
4547
}
4648

@@ -60,10 +62,21 @@ function deploy {
6062
EXTRA_MOUNTS="${EXTRA_MOUNTS} -v ${CONF_DIR}/${ADVANCED}:/etc/rabbitmq/advanced.config:ro "
6163
USED_CONFIG="${USED_CONFIG} ${CONF_DIR}/${ADVANCED}"
6264
fi
65+
66+
echo "Running RabbitMQ ($IMAGE:$IMAGE_TAG) with"
67+
echo " - Mode: ${MODE} "
68+
echo " - OauthProvider: ${OAUTH_PROVIDER}"
69+
echo " - configuration file(s): ${USED_CONFIG}"
70+
echo " - mounts: ${EXTRA_MOUNTS}"
71+
72+
PLATFORM_ARGS=""
73+
if [[ -n "${PLATFORM}" ]]; then
74+
PLATFORM_ARGS="--platform ${PLATFORM} "
75+
fi
6376

64-
echo "Running RabbitMQ ($IMAGE:$IMAGE_TAG) with Idp $MODE and configuration file(s) $USED_CONFIG"
6577
docker run -d --name rabbitmq \
66-
--net rabbitmq_net \
78+
--net ${RABBIT_NETWORK} \
79+
${PLATFORM_ARGS} \
6780
-p 15672:15672 \
6881
-p 5672:5672 \
6982
-p 5552:5552 \

bin/oauth2-proxy/deploy

+7-3
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,18 @@ CERTS_DIR=${CONF_DIR}/certs
88

99
source $SCRIPT/../common
1010

11-
ensure_docker_network
11+
cp -rf ${ROOT}/conf/keycloak/certs/* ${CERTS_DIR}
12+
13+
PROVIDER_NETWORK=${PROVIDER_NETWORK:-rabbitmq_net}
14+
ensure_docker_network ${PROVIDER_NETWORK}
15+
1216
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml down 2>/dev/null || echo "oauth2-proxy was not running"
1317
generate-ca-server-client-kpi oauth2-proxy $CERTS_DIR
1418

15-
echo "Running oauth2-proxy docker image ..."
19+
print "Running oauth2-proxy docker image ..."
1620

1721
export OAUTH2_PROXY_COOKIE_SECRET=`dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo`
18-
docker-compose -f $ROOT/conf/oauth2-proxy/compose.yml up -d
22+
docker compose -f $ROOT/conf/oauth2-proxy/compose.yml up -d
1923

2024
wait_for_message oauth2-proxy-oauth2-proxy-1 "Cookie settings"
2125
print "oauth2-proxy is running"

bin/oauth2-proxy/undeploy

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
5+
ROOT=$SCRIPT/../..
6+
CONF_DIR=${ROOT}/conf/oauth2-proxy
7+
CERTS_DIR=${CONF_DIR}/certs
8+
9+
10+
echo "Stopping oauth2-proxy ..."
11+
12+
docker compose -f $ROOT/conf/oauth2-proxy/compose.yml down
13+
14+

bin/portal/deploy

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/usr/bin/env bash
2+
3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
5+
if [[ ! -z "${DEBUG}" ]]; then
6+
set -x
7+
fi
8+
9+
ROOT=$SCRIPT/../..
10+
CONF_DIR=${ROOT}/conf/portal
11+
CERTS_DIR=${CONF_DIR}/certs
12+
13+
source $SCRIPT/../common
14+
15+
if [ ! -f ${ROOT}/conf/uaa/certs ]; then
16+
print "Deploy uaa first so that portal can reference its certificates"
17+
fi
18+
19+
print "Starting portal ..."
20+
21+
DOCKER_NETWORK=${DOCKER_NETWORK:-rabbitmq_net}
22+
ensure_docker_network ${DOCKER_NETWORK}
23+
kill_container_if_exist portal
24+
25+
image_tag=($(md5sum $CONF_DIR/package.json))
26+
if [[ $(docker images -q portal:$image_tag 2> /dev/null) == "" ]]; then
27+
docker build -t portal:$image_tag --target test $CONF_DIR
28+
fi
29+
30+
generate-ca-server-client-kpi portal $CERTS_DIR
31+
32+
begin "Running portal docker image portal:${image_tag} ..."
33+
34+
rm -f ${CONF_DIR}/certs/ca_certs.pem
35+
cat ${ROOT}/conf/uaa/certs/ca_uaa_certificate.pem ${CONF_DIR}/certs/ca_rabbitmq_certificate.pem \
36+
>> ${CONF_DIR}/certs/ca_certs.pem
37+
38+
if [[ -f ${ROOT}/conf/portal/certs/ca_proxy_certificate.pem ]]; then
39+
cat ${ROOT}/conf/portal/certs/ca_proxy_certificate.pem >> ${CONF_DIR}/certs/ca_certs.pem
40+
fi
41+
42+
docker run \
43+
--detach \
44+
--name portal \
45+
--net ${DOCKER_NETWORK} \
46+
--publish 3000:3000 \
47+
--env PORT=3000 \
48+
--env RABBITMQ_URL="https://localhost:15671" \
49+
--env UAA_URL="https://uaa:8443" \
50+
--env CLIENT_ID="rabbit_idp_user" \
51+
--env CLIENT_SECRET="rabbit_idp_user" \
52+
--env PROXIED_RABBITMQ_URL="https://proxy:9090" \
53+
--env NODE_EXTRA_CA_CERTS=/etc/portal/ca_certs.pem \
54+
-v ${CONF_DIR}/certs:/etc/portal \
55+
-v ${CONF_DIR}:/code/portal \
56+
portal:${image_tag} run portal
57+
58+
print "portal is running"

bin/proxy/deploy

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/usr/bin/env bash
2+
3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
5+
if [[ ! -z "${DEBUG}" ]]; then
6+
set -x
7+
fi
8+
9+
ROOT=$SCRIPT/../..
10+
CONF_DIR=${ROOT}/conf/portal
11+
CERTS_DIR=${CONF_DIR}/certs
12+
13+
source $SCRIPT/../common
14+
15+
if [ ! -f ${ROOT}/conf/uaa/certs ]; then
16+
print "Deploy uaa first so that portal can reference its certificates"
17+
fi
18+
19+
print "Starting proxy ..."
20+
21+
DOCKER_NETWORK=${DOCKER_NETWORK:-rabbitmq_net}
22+
ensure_docker_network ${DOCKER_NETWORK}
23+
kill_container_if_exist proxy
24+
25+
image_tag=($(md5sum $CONF_DIR/package.json))
26+
if [[ $(docker images -q portal:$image_tag 2> /dev/null) == "" ]]; then
27+
docker build -t portal:$image_tag --target test $CONF_DIR
28+
fi
29+
30+
generate-ca-server-client-kpi proxy $CERTS_DIR
31+
32+
begin "Running proxy docker image portal:${image_tag} ..."
33+
34+
rm -f ${CONF_DIR}/certs/ca_certs.pem
35+
cat ${ROOT}/conf/uaa/certs/ca_uaa_certificate.pem ${CONF_DIR}/certs/ca_rabbitmq_certificate.pem \
36+
>> ${CONF_DIR}/certs/ca_certs.pem
37+
38+
docker run \
39+
--detach \
40+
--name proxy \
41+
--net ${DOCKER_NETWORK} \
42+
--publish 9090:9090 \
43+
--env PORT=9090 \
44+
--env RABBITMQ_URL="https://rabbitmq:15671" \
45+
--env UAA_URL="https://uaa:8443" \
46+
--env CLIENT_ID="rabbit_idp_user" \
47+
--env CLIENT_SECRET="rabbit_idp_user" \
48+
--env NODE_EXTRA_CA_CERTS=/etc/proxy/ca_certs.pem \
49+
-v ${CONF_DIR}/certs:/etc/proxy \
50+
-v ${CONF_DIR}:/code/portal \
51+
portal:${image_tag} run proxy
52+
53+
print "proxy is running"

conf/oauth2-proxy/rabbitmq.conf

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
auth_backends.1 = rabbit_auth_backend_oauth2
22

33
log.default.level = debug
4+
log.console.level = debug
45

56
management.oauth_enabled = true
67
management.oauth_initiated_logon_type = idp_initiated
7-
management.oauth_provider_url = https://localhost:8442
8+
management.oauth_provider_url = https://oauth2-proxy:8442
89

910
auth_oauth2.resource_server_id = rabbitmq
10-
auth_oauth2.issuer = https://keycloak:8443/realms/test
11-
auth_oauth2.end_session_endpoint = https://localhost:8442/oauth2/sign_out?rd=https://keycloak:8443/realms/test/protocol/openid-connect/logout
12-
auth_oauth2.https.cacertfile = /etc/keycloak/certs/ca_keycloak_certificate.pem
11+
auth_oauth2.jwks_uri = https://keycloak:8443/realms/test/protocol/openid-connect/certs
12+
auth_oauth2.end_session_endpoint = https://oauth2-proxy:8442/oauth2/sign_out?rd=https://keycloak:8443/realms/test/protocol/openid-connect/logout
13+
auth_oauth2.https.cacertfile = /etc/oauth2-proxy/certs/ca_keycloak_certificate.pem
1314
auth_oauth2.preferred_username_claims.1 = preferred_username
1415
auth_oauth2.verify_aud = false

conf/portal/Dockerfile

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# syntax=docker/dockerfile:1
2+
FROM atools/jdk-maven-node:mvn3-jdk11-node16 as base
3+
4+
WORKDIR /code
5+
6+
COPY package.json package.json
7+
8+
FROM base as test
9+
RUN npm install
10+
11+
ENTRYPOINT [ "npm" ]
12+
CMD [ "" ]

conf/portal/app.js

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
const express = require("express");
2+
const app = express();
3+
const fs = require('fs');
4+
const https = require('https');
5+
var path = require('path');
6+
const XMLHttpRequest = require('xmlhttprequest').XMLHttpRequest
7+
8+
const rabbitmq_url = process.env.RABBITMQ_URL;
9+
const proxied_rabbitmq_url = process.env.PROXIED_RABBITMQ_URL;
10+
const client_id = process.env.CLIENT_ID;
11+
const client_secret = process.env.CLIENT_SECRET;
12+
const uaa_url = process.env.UAA_URL;
13+
const port = process.env.PORT || 3000;
14+
15+
app.engine('.html', require('ejs').__express);
16+
app.set('views', path.join(__dirname, 'views'));
17+
app.set('view engine', 'html');
18+
19+
app.get('/', function(req, res){
20+
let id = default_if_blank(req.query.client_id, client_id)
21+
let secret = default_if_blank(req.query.client_secret, client_secret)
22+
if (id == 'undefined' || secret == 'undefined') {
23+
res.render('unauthenticated')
24+
}else {
25+
res.render('rabbitmq', {
26+
proxied_url: proxied_rabbitmq_url,
27+
url: rabbitmq_url.replace(/\/?$/, '/') + "login",
28+
name: rabbitmq_url + " for " + id,
29+
access_token: access_token(id, secret)
30+
})
31+
}
32+
})
33+
34+
app.get('/favicon.ico', (req, res) => res.status(204));
35+
36+
app.get('/logout', function(req, res) {
37+
const redirectUrl = uaa_url + '/logout.do?client_id=' + client_id + "&redirect=https://portal:3000"
38+
console.debug("Received /logout request -> redirect to " + redirectUrl)
39+
res.redirect(redirectUrl);
40+
})
41+
42+
https
43+
.createServer(
44+
{
45+
cert: fs.readFileSync('/etc/portal/server_portal_certificate.pem'),
46+
key: fs.readFileSync('/etc/portal/server_portal_key.pem')
47+
},
48+
app
49+
)
50+
.listen(port)
51+
52+
console.log('Express started on port ' + port);
53+
54+
function default_if_blank(value, defaultValue) {
55+
if (typeof value === "undefined" || value === null || value == "") {
56+
return defaultValue;
57+
} else {
58+
return value;
59+
}
60+
}
61+
62+
function access_token(id, secret) {
63+
const req = new XMLHttpRequest();
64+
const url = uaa_url + '/oauth/token';
65+
const params = 'client_id=' + id +
66+
'&client_secret=' + secret +
67+
'&grant_type=client_credentials' +
68+
'&token_format=jwt' +
69+
'&response_type=token';
70+
71+
console.debug("Sending " + url + " with params "+ params);
72+
73+
req.open('POST', url, false);
74+
req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
75+
req.setRequestHeader('Accept', 'application/json');
76+
req.send(params);
77+
if (req.status == 200) {
78+
const token = JSON.parse(req.responseText).access_token;
79+
console.log("Token => " + token)
80+
return token
81+
} else {
82+
throw new Error(req.status + " : " + " : " +
83+
req.response + " : " + req.responseText)
84+
}
85+
}

0 commit comments

Comments
 (0)