roryqi commented on code in PR #11730: URL: https://github.com/apache/gravitino/pull/11730#discussion_r3434786585
########## docs/security/how-to-authenticate.md: ########## @@ -653,3 +662,64 @@ For Gravitino Iceberg REST Service, the 'Accept: application/vnd.gravitino.v1+js ```shell curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer <access_token>" http://127.0.0.1:9001/iceberg/v1/config ``` + +### Enable Web UI OIDC login with Keycloak + +The `gravitino-client` registered above is a confidential client used for machine-to-machine flows +(client credentials and password grants). The browser Web UI cannot use a confidential client because +it cannot keep a client secret, so the Web UI OIDC login requires a separate public client. A typical +Keycloak deployment therefore uses two clients: + +| Client | Type | Used by | Keycloak settings | +|--------------------|--------------|---------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `gravitino-client` | Confidential | Engines and machine flows (CLI, connectors, service accounts) | *Client authentication* on, *Standard flow* and *Service accounts roles* enabled | +| `gravitino-ui` | Public | Browser Web UI OIDC login | *Client authentication* off, *Standard flow* enabled | + +To register the public client for the Web UI: + +* Click *Clients* in the `gravitinorealm` realm, then *Create client*. +* Fill in *Client type*: `OpenID Connect`, *Client ID*: `gravitino-ui`, then click *Next*. +* Turn *Client authentication* **off** (this makes it a public client) and enable *Standard flow*. Click *Next*. +* Set *Valid redirect URIs* to `https://your-gravitino-server/ui/oauth/callback`. +* Set *Web origins* to `https://your-gravitino-server`. +* Click *Save*. Review Comment: Good catch. Added a step to set *Valid post logout redirect URIs* to `https://your-gravitino-server/*` before saving, so logout can redirect back to the Web UI. ########## docs/security/how-to-authenticate.md: ########## @@ -653,3 +662,64 @@ For Gravitino Iceberg REST Service, the 'Accept: application/vnd.gravitino.v1+js ```shell curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer <access_token>" http://127.0.0.1:9001/iceberg/v1/config ``` + +### Enable Web UI OIDC login with Keycloak + +The `gravitino-client` registered above is a confidential client used for machine-to-machine flows +(client credentials and password grants). The browser Web UI cannot use a confidential client because +it cannot keep a client secret, so the Web UI OIDC login requires a separate public client. A typical +Keycloak deployment therefore uses two clients: + +| Client | Type | Used by | Keycloak settings | +|--------------------|--------------|---------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `gravitino-client` | Confidential | Engines and machine flows (CLI, connectors, service accounts) | *Client authentication* on, *Standard flow* and *Service accounts roles* enabled | +| `gravitino-ui` | Public | Browser Web UI OIDC login | *Client authentication* off, *Standard flow* enabled | + +To register the public client for the Web UI: + +* Click *Clients* in the `gravitinorealm` realm, then *Create client*. +* Fill in *Client type*: `OpenID Connect`, *Client ID*: `gravitino-ui`, then click *Next*. +* Turn *Client authentication* **off** (this makes it a public client) and enable *Standard flow*. Click *Next*. +* Set *Valid redirect URIs* to `https://your-gravitino-server/ui/oauth/callback`. +* Set *Web origins* to `https://your-gravitino-server`. +* Click *Save*. + +Then point the Web UI OIDC settings at this public client in `conf/gravitino.conf`: + +```text +gravitino.authenticators = oauth +gravitino.authenticator.oauth.provider = oidc +gravitino.authenticator.oauth.clientId = gravitino-ui +gravitino.authenticator.oauth.authority = http://localhost:8080/realms/gravitinorealm +gravitino.authenticator.oauth.scope = openid profile email +gravitino.authenticator.oauth.jwksUri = http://localhost:8080/realms/gravitinorealm/protocol/openid-connect/certs +gravitino.authenticator.oauth.tokenValidatorClass = org.apache.gravitino.server.authentication.JwksTokenValidator +gravitino.authenticator.oauth.serviceAudience = account +gravitino.authenticator.oauth.principalFields = preferred_username,email,sub +``` Review Comment: Those static-key settings (`defaultSignKey`/`serverUri`/`tokenPath`) are only needed when using `StaticSignKeyValidator`. This Web UI example uses JWKS-based validation (`jwksUri` + `JwksTokenValidator`), where the server fetches Keycloak's public keys automatically, so they are not required. I added a paragraph after the config block clarifying this and noting the same server config validates both Web UI and machine tokens. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
