Create an user and setup is access rights

🟢 Beginner

user

osp-keycloak osp-web

This example shows how to create a user, assign them to a group, and restrict their access to specific dashboards using role-based access control. No downloadable configuration example is provided for this page — follow the steps below manually.

• Create a Keycloak group and map it to OnSphere access rights using the rights module.

• Create a user via the Keycloak admin console or the users.keycloak configuration file and assign them to the group.

• Define per-dashboard access.rights files to restrict visibility to specific groups.

• Verify that each user only sees the dashboards permitted for their group.

git merge origin/osp-web-configuration
git checkout origin/osp-keycloak-configuration .

Steps

1. Initial setup

git pull
git merge origin/osp-web-configuration

2. Create the group

With the configuration

1. Open the /modules/keycloak/keycloak-1/groups.keycloak file

2. Create the new group:

{
    "groups": [
        {
            "attributes": {},
            "clientRoles": {},
            "name": "collaborator",
            "path": "/collaborator",
            "realmRoles": [],
            "subGroups": []
        }
    ]
}

With the front-end

1. Connect to Keycloak

• With the administrator

2. Access the Keycloak administration console https://{stack_ip}:{stack_port}/auth/admin (for example https://stack-1.onsphere.local:5000/auth/admin)

3. Login to Keycloak administration console using administration user and password configured when the stack was deployed (see System security)

• With a user member of the administrator or user-management group

4. Access the OnSphere front-end https://{stack_ip}:{stack_port}/ (for example https://stack-1.onsphere.local:5000/)

5. On the side menu click on the Manage users button !

6. Go to the Groups tab under Manage category

7. Click on New

8. Enter the group name collaborator and click Save

3. Map the group to OnSphere

1. Open the /modules/rights/rights/rights.module file

2. Create the new mapping for the collaborators and admin:

{
    "messagingConfiguration": {
        "clientId": "osp-rights",
        "host": "rabbit"
    },
    "groups": [
        {
            "name": "all",
            "description": "Access all value",
            "externalLink": [
                "data-access",
                "configuration-management"
            ]
        },
        {
            "name": "collaborator",
            "description": "",
            "externalLink": [
                "collaborator"
            ]
        },
        {
            "name": "admin",
            "description": "",
            "externalLink": [
                "administrator"
            ]
        }
    ]
}

Warning

By default the externalLink used the name of the group as it’s identifier.

It is possible to change this behavior to use the full path by editing the realm.keycloak available on the osp-keycloak-advanced-configuration branch.

The protocolMappers named User groups need to be edited to change config.full.path to true. There are two of them by default.

4. Create the user

With the configuration

1. Open the /modules/keycloak/keycloak-1/users.keycloak file

2. Create the new user:

{
  "users": [
    {
      "enabled": true,
      "groups": [
        "/collaborator"
      ],
      "username": "example",
      "email": "example@localhost",
      "firstName": "example",
      "lastName": "example",
      "credentials": [
        {
          "initial": true,
          "temporary": true,
          "type": "password",
          "value": "mysuperpassword"
        }
      ],
      "attributes": {
        "authorizedKeys": [
          "ssh-key"
        ],
        "apiKey": "simple-api-key"
      }
    }
  ]
}

With the front-end

1. Connect to Keycloak

• With the administrator

2. Access the Keycloak administration console https://{stack_ip}:{stack_port}/auth/admin (for example https://stack-1.onsphere.local:5000/auth/admin)

3. Login to Keycloak administration console using administration user and password configured when the stack was deployed (see System security)

• With a user member of the administrator or user-management group

4. Access the OnSphere front-end https://{stack_ip}:{stack_port}/ (for example https://stack-1.onsphere.local:5000/)

5. On the side menu click on the Manage users button !

   

6. Go to the Users tab under Manage category

7. Click on Add user

8. Enter a username and click Save

9. Go to the Credentials tab

10. Define a password for the user and click Set Password

11. Go to the Groups tab

12. In the Available groups panel, select the group collaborator and click Join

5. Create the dashboard and the access file

_root/examples/dashboard/admin/dashboard.view_

{
    "configuration": [
    ],
    "layout": {
        "lg": []
    }
}

_root/examples/dashboard/admin/dashboard.web_

{
    "moduleId": "modules.web.web-1",
    "title": "Admin dashboard",
    "description": "Admin dashboard",
    "tags": ["Admin"]
}

_root/examples/dashboard/admin/access.rights_

{
    "moduleId": "modules.rights.rights",
    "write": {
        "override": [
            "admin"
        ]
    },
    "read": {
        "override": [
            "admin"
        ]
    }
}

_root/examples/dashboard/collaborator/dashboard.view_

{
    "configuration": [
    ],
    "layout": {
        "lg": []
    }
}

_root/examples/dashboard/collaborator/dashboard.web_

{
    "moduleId": "modules.web.web-1",
    "title": "collaborator dashboard",
    "description": "collaborator dashboard",
    "tags": ["collaborator"]
}

_root/examples/dashboard/collaborator/access.rights_

{
    "moduleId": "modules.rights.rights",
    "write": {
        "override": [
            "collaborator"
        ]
    },
    "read": {
        "override": [
            "collaborator"
        ]
    }
}

6. Push the new configuration

git add .
git commit -m "Creating new user with access"
git pull
git push

7. Connect on OnSphere with the new user