Authenticating to Control Center with Kerberos

Open the Keycloak Administration console in your browser and log in as administrator.

Create the gridgain realm:

Create the control-center client:

On the Client Details page, define access settings for the client you have created. Use your actual Control Center host address and port number.

On the Credentials tab, copy Client secret, which is required to set up Control Center connection to Keycloak.

Click the OpenID endpoint configuration link on the Realm Settings page.

On the page that opens, define the following settings.

Create a new Control Center user:

Manually set up a password for cc-user:

Edit the Control Center’s application.yaml configuration. Use the values from p.5 and p.7 above. Replace [kc-url] with the actual Keycloak network address.

spring.security.oauth2.client:
  registration:
    keycloak:
      client-id: control-center
      client-secret: <secret>
      scope: openid, profile, roles
  provider:
    keycloak:
      authorization-uri: http://[kc-url]/realms/gridgain/protocol/openid-connect/auth
      token-uri: http://[kc-url]/realms/gridgain/protocol/openid-connect/token
      jwk-set-uri: http://[kc-url]/realms/gridgain/protocol/openid-connect/certs

Install Key Distribution Center and Kerberos Admin Service:

$ sudo apt install krb5-admin-server krb5-kdc

Create a realm:

$ sudo krb5_newrealm

Create a new principal to be used by Keycloack:

$ sudo kadmin.local -q 'addprinc -randkey HTTP/kdc.example.com@EXAMPLE.COM'

Generate the principal keytab file:

$ sudo kadmin.local -q 'ktadd -k /tmp/http.keytab HTTP/kdc.example.com@EXAMPLE.COM'

Place the http.keytab file on the Keycloack machine locally.

Create a principal and keytab to be used by Control Center:

$ sudo kadmin.local -q 'addprinc -randkey krb-user@EXAMPLE.COM'
$ sudo kadmin.local -q 'ktadd -k /tmp/krb-user.keytab krb-user@EXAMPLE.COM'

Select the gridgain realm and go to User Federation.

Add the Kerberos provider and click Save.

From the side menu, select Authentication.

Add Kerberos as an alternative step to the Browser flow.

Install the Kerberos client on the client side (if not already installed):

$ sudo apt install krb5-user

Authenticate to Kerberos as krb-user with the keytab you have created in p. 3.3:

$ kinit -kt /tmp/krb-user.keytab krb-user@EXAMPLE.COM

Check if the Kerberos tickets have been successfully granted by KDC:

$ klist

Ticket cache: FILE:/tmp/krb5cc_1000

Default principal: krb-user@EXAMPLE.COM

Valid starting       Expires              Service principal

10/16/2022 12:19:10  10/16/2022 22:19:10  krbtgt/EXAMPLE.COM@EXAMPLE.COM

renew until 10/17/2022 12:19:09

Launch your browser (Chrome in this tutorial) with SPNEGO enabled to allow Kerberos authentication with Keycloack:

$ /usr/bin/google-chrome-stable --auth-server-whitelist="*.example.com" --auth-negotiate-delegate-whitelist="*.example.com"

Open Control Center in the browser and select the Sign in to your account with OpenID option.