Opstella Keycloak Single Sign-On Initialisation

For Single Sign-On function of Opstella, certain configuration on Opstella Keycloak must be done beforehand.

This requires you to initialise credentials based on OpenID Connect Protocol. (Client ID, Client Secret)

💡 You need to use Keycloak to create the credentials and then, setup and connect for each of Third-Party Tools/Instruments (DevSecOps Tools, Observlity Tools) while either upon installing or after installation.

Including other various configurations for Single Sign-On to properly function. (This manual will guide you through)

Create Keycloak Clients Creation Overview

The following is the list of Keycloak Clients that initialise with credentials based on OpenID Connect Protocol (Client ID, Client Secret), with certain customisation that unique to each of Keycloak Client.

Tool/Instrument	Client Name	Require Client Authentication	Valid redirect URIs	Valid Post logout redirect URIs	Web origins/Home URL
ArgoCD	argocd	✅ Yes	*	*	* / Leave Empty
DefectDojo	defectdojo	✅ Yes	https://defectdojo.${BASE_DOMAIN}/*	https://defectdojo.${BASE_DOMAIN}/*	https://defectdojo.${BASE_DOMAIN}
SonarQube	sonarqube	✅ Yes	https://sonarqube.${BASE_DOMAIN}/*	https://sonarqube.${BASE_DOMAIN}/*	https://sonarqube.${BASE_DOMAIN}
GitLab	gitlab	✅ Yes	https://gitlab.${BASE_DOMAIN}/*	https://gitlab.${BASE_DOMAIN}/*	https://gitlab.${BASE_DOMAIN}
Harbor	harbor	✅ Yes	https://harbor.${BASE_DOMAIN}/*	https://harbor.${BASE_DOMAIN}/*	https://harbor.${BASE_DOMAIN}
Grafana	grafana	✅ Yes	https://grafana.${BASE_DOMAIN}/*	https://grafana.${BASE_DOMAIN}/*	https://grafana.${BASE_DOMAIN}
Kubernetes API	kubernetes	✅ Yes	*	*	* / Leave Empty
Vault	vault	✅ Yes	https://vault.${BASE_DOMAIN}/*	https://vault.${BASE_DOMAIN}/*	https://vault.${BASE_DOMAIN}
Opstella	opstella	❌ No	https://opstella.${BASE_DOMAIN}/*	https://opstella.${BASE_DOMAIN}/*	https://opstella.${BASE_DOMAIN}

Finally your Clients in Client List of Keycloak should looks like this.

Keycloak Clients Creation

Caution

The Keycloak Clients Creation here is repetitive, instructions providing here are steps for ONE client.

It is meant for you to REPEAT the steps FOR EACH of Keycloak Client. Please change the configuration value accordingly.

For example with DefectDojo:

1. Sign-in to Keycloak with Admin Local Account (admin)

2. Be sure to do it on your dedicated Keycloak Realm. foobar-opstella

   

3. Go to Clients Panel > Click Create client

   

4. General settings section, Input the Client Name follow to the table in Overview section.

   <Client Name> in the picture is the placeholder from the table column Client Name.

   Please change the configuration value accordingly with the correct value from the same column in the table.

   For example:

   • Tool/Instrument: DefectDojo
   • Client Name: defectdojo

   Client Name

   

   Actual Value

   

   Click Next

5. Check if Require Client Authentication and configure the Capability config section as follow.

   Require Client Authentication is ✅ Yes

   

   Require Client Authentication is ❌ No

   

   Click Next

6. Input the appropriate URLs for Valid redirect URIs, Valid Post logout redirect URIs, Web origins/Home URL

   Standard Configuration

   

   * / Leave Empty

   Configure as the picture.

   Click Save