Next we will detail how to activate certificate authentication in the advanced platform IM.

This functionality allows users to log in to the platform and applications developed on it using X509 client certificates, with the advantage of being able to continue using Oauth2 as a communications security standard.

Nginx Configuration

Legacy (Rancher 1.6)

Since nginx terminates the SSL connection, we you need to configure the certificate forwarding to Keycloak first.

...

location /auth {
		proxy_set_header X509-Cert $ssl_client_escaped_cert; 
		....	
}

Kubernetes (Rancher 2.6+)

As a requirement to set up an environment with kubernetes, you need to have k8s version 1.21+ for the Ingress Controller to support networking.k8s.io/v1 annotations.

Creation of the secret with the CAs

Firstly, you must create the secret that will contain the concatenated certificates of the CAs needed to validate the client certificates that you want to authenticate.

Create a secret called platform-ca in the onesaitplatform namespace, for example, and about the secret key, call it ca.crt , leaving the certificate chain as the value.

...

Configuring the Ingress Controller

In the Ingress Controller, you must write the following annotations:

nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
nginx.ingress.kubernetes.io/auth-tls-secret: onesaitplatform/platform-ca
nginx.ingress.kubernetes.io/auth-tls-verify-client: optional
nginx.ingress.kubernetes.io/auth-tls-verify-depth: "2"

Image Added

Configuring the Config Map loadbalancer

Finally, you must add the following directive to the config map of your balancer, in order to propagate the HTTP header that the Ingress Controller injects with the certificate:

  proxy_set_header X509-Cert $http_ssl_client_cert;

...

Keycloak Configuration

Authentication flow

The first thing will be to modify the main authentication flow, 'Multitenant-browser-flow':

...

We add Add an execution, ‘X509 Onesait Platform’:

...

We mark Mark it as an alternative in the authentication flow, and put it in the third level:

...

Execution configuration

Now we you have to configure the execution for the certificate - user mapping.

We click Click on actions → config:

...

In this example, we you are going to configure it to accept DNIe as a source of electronic certificate.

We have to You must configure the following fields:

...

Import User after first log in: we will leave it marked so that it imports users after the first authentication.

User Identity Source: we will leave it at Match SubjectDN using RegEx, since we you will extract the user ID from there.

...

Email: a regular expression to extract the mail. In the case of the DNIe it does not apply. We leave Leave it empty since this field does not appear.

...

Import DN as extrafields: we will mark it if we you want to store the full DN extracted from the certificate in the “extra fields” of the platform users.

...

Default import Role: default role for importing users.

User mapping method: we will leave it as either Username or Email.

...

The rest of the options do not need to be configured.

Truststore

Lastly, we you will have to add the certificates of the issuers of the electronic certificates that our system will accept. In the case of the DNIe, we you have to add that of the Spanish National Police.

...

The keycloak’s keystore is located at /opt/jboss/keycloak/standalone/configuration/keystore.jks and the password is the same as the JVM JKS.

The keystore.jks with the most common CAs requested by clients is in the /onesait-cloud-platform/tools/keycloak/server directory. You can always add more and regenerate the keycloak server image.

Connect front/back to the authentication system

...