102 lines
4.7 KiB
Markdown
102 lines
4.7 KiB
Markdown
|
How to secure Fuse admin services
|
||
|
|
=================================
|
||
|
|
|
||
|
|
Fuse admin console authentication
|
||
|
|
---------------------------------
|
||
|
|
Fuse admin console is Hawt.io. See [Hawt.io documentation](http://hawt.io/docs/index.html) for more info about how to secure it with keycloak.
|
||
|
|
|
||
|
|
|
||
|
|
SSH authentication with keycloak credentials on JBoss Fuse 6.1
|
||
|
|
--------------------------------------------------------------
|
||
|
|
|
||
|
|
Keycloak mainly addresses usecases for authentication of web applications, however if your admin services (like fuse admin console) are protected
|
||
|
|
with Keycloak, it may be good to protect non-web services like SSH with Keycloak credentials too. It's possible to do it by using JAAS login module, which
|
||
|
|
allows to remotely connect to Keycloak and verify credentials based on [Direct access grants](http://docs.jboss.org/keycloak/docs/1.1.0.Beta2/userguide/html/direct-access-grants.html).
|
||
|
|
|
||
|
|
Example steps for enable SSH authentication:
|
||
|
|
|
||
|
|
1) Import 'demo' realm as mentioned in [Base steps](../README.md#base-steps) . It contains client `sh-jmx-admin-client`, which is used for SSH authentication.
|
||
|
|
Skip this step if you installed demo already.
|
||
|
|
|
||
|
|
2) Then you need to update/specify these 2 properties in file `$FUSE_HOME/etc/org.apache.karaf.shell.cfg`:
|
||
|
|
|
||
|
|
```
|
||
|
|
sshRealm=keycloak
|
||
|
|
sshRole=org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
```
|
||
|
|
|
||
|
|
3) Copy file from Keycloak fuse examples `examples/fuse/fuse-admin/keycloak-direct-access.json` to `$FUSE_HOME/etc/` directory.
|
||
|
|
This file contains configuration of the client application, which is used by JAAS DirectAccessGrantsLoginModule from `keycloak` JAAS realm for SSH authentication.
|
||
|
|
|
||
|
|
4) Start Fuse and install `keycloak` JAAS realm into Fuse. This could be done easily by installing `keycloak-jaas` feature, which has JAAS realm predefined
|
||
|
|
(you are able to override it by using your own `keycloak` JAAS realm with higher ranking). As long as you already installed `keycloak-fuse-example` feature as mentioned
|
||
|
|
in [examples readme](../README.md), you can skip this step as `keycloak-jaas` is installed already. Otherwise use those commands:
|
||
|
|
|
||
|
|
```
|
||
|
|
features:addurl mvn:org.keycloak/keycloak-osgi-features/1.1.0.Final/xml/features
|
||
|
|
features:install keycloak-jaas
|
||
|
|
```
|
||
|
|
|
||
|
|
5) Now let's type this from your terminal:
|
||
|
|
|
||
|
|
```
|
||
|
|
ssh -o PubkeyAuthentication=no -p 8101 admin@localhost
|
||
|
|
```
|
||
|
|
|
||
|
|
And login with password `password` . Note that other users from "demo" realm like bburke@redhat.com don't have SSH access as they don't have `admin` role.
|
||
|
|
|
||
|
|
|
||
|
|
JMX authentication with keycloak credentials on JBoss Fuse 6.1
|
||
|
|
--------------------------------------------------------------
|
||
|
|
|
||
|
|
This may be needed just in case if you really want to use jconsole or other external tool to perform remote connection to JMX through RMI. Otherwise it may
|
||
|
|
be better to use just hawt.io/jolokia as jolokia agent is installed in hawt.io by default.
|
||
|
|
|
||
|
|
1) In file `$FUSE_HOME/etc/org.apache.karaf.management.cfg` you can change these 2 properties:
|
||
|
|
|
||
|
|
```
|
||
|
|
jmxRealm=keycloak
|
||
|
|
jmxRole=org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
```
|
||
|
|
|
||
|
|
2) In jconsole you can fill URL like:
|
||
|
|
|
||
|
|
```
|
||
|
|
service:jmx:rmi://localhost:44444/jndi/rmi://localhost:1099/karaf-root
|
||
|
|
```
|
||
|
|
|
||
|
|
and credentials: admin/password
|
||
|
|
|
||
|
|
Note again that users without `admin` role are not able to login as they are not authorized. However users with access to Hawt.io admin console
|
||
|
|
may be still able to access MBeans remotely via HTTP (Hawtio). So make sure to protect Hawt.io web console with same roles like JMX through RMI to
|
||
|
|
really protect JMX mbeans.
|
||
|
|
|
||
|
|
|
||
|
|
JMX on JBoss Fuse 6.2 and Apache Karaf 3.0.2
|
||
|
|
--------------------------------------------
|
||
|
|
|
||
|
|
For JMX, the steps are similar like above, however there is more fine grained authorization for JMX access in Fuse 6.2. You still need to configure jmxRealm in
|
||
|
|
`$FUSE_HOME/etc/org.apache.karaf.management.cfg`, however jmxRole is not needed. So in config should be just this:
|
||
|
|
|
||
|
|
```
|
||
|
|
jmxRealm=keycloak
|
||
|
|
```
|
||
|
|
And then you need to configure authorization for all specific MBeans, which you want to access with authenticated user. For generic access
|
||
|
|
you can configure the most generic ACL in file `$FUSE_HOME/etc/jmx.acl.cfg` like this:
|
||
|
|
|
||
|
|
```
|
||
|
|
list* = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
get* = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
is* = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
set* = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
* = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
```
|
||
|
|
|
||
|
|
Then admin will have permissions to see all the attributes and trigger all JMX operations, which don't have their own ACL. You can configure
|
||
|
|
those specific ACLs too. For example if you want to allow operation `lookupAgents` in MBean `jolokia:type=Discovery` you can configure
|
||
|
|
in file `$FUSE_HOME/etc/jmx.acl.jolokia.Discovery.cfg` the property like this:
|
||
|
|
|
||
|
|
```
|
||
|
|
lookupAgents = org.keycloak.adapters.jaas.RolePrincipal:admin
|
||
|
|
```
|