Keycloak PostgreSQL OpenLDAP mod_auth_openidcでSSO全手順

# yum update -y
# yum install -y java-1.8.0-openjdk-devel
# yum install -y wget
→既に入っていた。
# yum install -y zip
→既に入っていた。

# groupadd -r keycloak
# useradd -m -d /var/lib/keycloak -s /sbin/nologin -r -g keycloak keycloak

# mkdir -p /opt/keycloak
# wget https://github.com/keycloak/keycloak/releases/download/15.0.2/keycloak-15.0.2.zip -P /opt/keycloak
# unzip /opt/keycloak/keycloak-15.0.2.zip -d /opt/keycloak
# ln -s /opt/keycloak/keycloak-15.0.2 /opt/keycloak/current
# chown keycloak: -R /opt/keycloak
# chmod 700 /opt/keycloak/current/standalone

# cat > /etc/systemd/system/keycloak.service <<EOF
[Unit]
Description=Keycloak
After=network.target

[Service]
Type=idle
User=keycloak
Group=keycloak
ExecStart=/opt/keycloak/current/bin/standalone.sh -b 192.168.12.10
TimeoutStartSec=600
TimeoutStopSec=600

[Install]
WantedBy=multi-user.target
EOF

# systemctl daemon-reload
# systemctl enable keycloak
# systemctl start keycloak

# hostnamectl set-hostname kctest.constoso.com
# vi /etc/hosts

192.168.12.10 kctest.constoso.com

# wget http://ftp.riken.jp/Linux/centos/7/os/x86_64/Packages/openssl-1.0.2k-19.el7.x86_64.rpm

# rpm2cpio openssl-1.0.2k-19.el7.x86_64.rpm | cpio -id ./etc/pki/tls/misc/CA
# find etc
etc
etc/pki
etc/pki/tls
etc/pki/tls/misc
etc/pki/tls/misc/CA

# mv -i etc/pki/tls/misc/CA /etc/pki/tls/misc/

# cd /etc/pki/tls/misc/
# ./CA -newca
CA certificate filename (or enter to create)
エンター

Making CA certificate ...
Generating a RSA private key
.........................................................................................................+++++
.....+++++
writing new private key to '/etc/pki/CA/private/./cakey.pem'
Enter PEM pass phrase:secret
Verifying - Enter PEM pass phrase:secret
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Aichi
Locality Name (eg, city) [Default City]:Toyota
Organization Name (eg, company) [Default Company Ltd]:ITC
Organizational Unit Name (eg, section) []:エンター
Common Name (eg, your name or your server's hostname) []:kctestca.contoso.com
Email Address []:admin@kctestca.contoso.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:エンター
An optional company name []:エンター
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem:secret
Check that the request matches the signature
Signature ok
・・・（略）・・・
Write out database with 1 new entries
Data Base Updated

# keytool -genkey -alias kctest -keyalg RSA -keystore keycloak.jks -validity 10950
Enter keystore password:secret
Re-enter new password:secret
What is your first and last name?
  [Unknown]:  kctest.constoso.com
What is the name of your organizational unit?
  [Unknown]:  エンター
What is the name of your organization?
  [Unknown]:  ITC
What is the name of your City or Locality?
  [Unknown]:  Toyota
What is the name of your State or Province?
  [Unknown]:  Aichi
What is the two-letter country code for this unit?
  [Unknown]:  JP
Is CN=kctest.constoso.com, OU=Unknown, O=ITC, L=Toyota, ST=Aichi, C=JP correct?
  [no]:  yes

Enter key password for <kctest>
        (RETURN if same as keystore password):secret
Re-enter new password:secret

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore keycloak.jks -destkeystore keycloak.jks -deststoretype pkcs12".

# keytool -certreq -alias kctest -keystore keycloak.jks > keycloak.careq
Enter keystore password:  secret

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore keycloak.jks -destkeystore keycloak.jks -deststoretype pkcs12".

# echo subjectAltName=DNS:kctest.constoso.com > san.ext
# openssl ca -in keycloak.careq -out keycloak.crt -days 3650 -cert /etc/pki/CA/cacert.pem -keyfile /etc/pki/CA/private/cakey.pem -extfile san.ext
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:secret
Check that the request matches the signature
Signature ok
The stateOrProvinceName field is different between
CA certificate (Aichi) and the request (Aichi)

# openssl ca -in keycloak.careq -out keycloak.crt -days 3650 -cert /etc/pki/CA/cacert.pem -keyfile /etc/pki/CA/private/cakey.pem -extfile san.ext -policy policy_anything
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:secret
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            28:69:0e:9f:73:15:d2:00:8e:40:ed:a2:bd:65:40:0c:6f:f7:4e:95
        Validity
            Not Before: Nov 28 10:07:07 2021 GMT
            Not After : Nov 26 10:07:07 2031 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Aichi
            localityName              = Toyota
            organizationName          = ITC
            organizationalUnitName    = Unknown
            commonName                = kctest.constoso.com
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:kctest.constoso.com
Certificate is to be certified until Nov 26 10:07:07 2031 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

# keytool -import -keystore keycloak.jks -file /etc/pki/CA/cacert.pem -alias root
Enter keystore password:secret
Owner: EMAILADDRESS=admin@kctestca.contoso.com, CN=kctestca.contoso.com, O=ITC, ST=Aichi, C=JP
Issuer: EMAILADDRESS=admin@kctestca.contoso.com, CN=kctestca.contoso.com, O=ITC, ST=Aichi, C=JP
Serial number: 28690e9f7315d2008e40eda2bd65400c6ff74e94
Valid from: Sun Nov 28 01:58:48 PST 2021 until: Wed Nov 27 01:58:48 PST 2024
Certificate fingerprints:
         SHA1: CA:42:68:66:25:D2:59:49:37:30:C8:1D:07:11:72:67:4B:25:86:C6
         SHA256: E7:65:5C:D8:64:14:69:78:F2:0D:5F:04:89:C0:1F:E4:9F:BF:AE:3C:C6:92:33:26:48:3B:A2:65:30:02:B1:AC
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 2.5.29.35 Criticality=false
・・・（略）・・・
]

Trust this certificate? [no]:  yes
Certificate was added to keystore

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore keycloak.jks -destkeystore keycloak.jks -deststoretype pkcs12".

# keytool -import -alias kctest -keystore keycloak.jks -file keycloak.crt
Enter keystore password:secret
Certificate reply was installed in keystore

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore keycloak.jks -destkeystore keycloak.jks -deststoretype pkcs12".

# vi /opt/keycloak/current/standalone/configuration/standalone.xml

<management>
  <security-realms>
    ・・・（略）・・・
    <security-realm name="ApplicationRealm">
      <server-identities>
        <ssl>
            <!-- <keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/> -->
★          <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" alias="kctest" key-password="secret" generate-self-signed-certificate-host="kctest"/>
        </ssl>
      </server-identities>
      ・・・（略）・・・
    </security-realm>
  </security-realms>
  ...
</management>

<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
・・・（略）・・・
  <!-- <socket-binding name="https" port="${jboss.https.port:8443}"/> -->
★<socket-binding name="https" port="${jboss.https.port:443}"/>
・・・（略）・・・
</socket-binding-group>

# systemctl restart keycloak

standalone.sh[2932]: #033[0m#033[31m02:16:47,162 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
standalone.sh[2932]:    ("subsystem" => "undertow"),
standalone.sh[2932]:    ("server" => "default-server"),
standalone.sh[2932]:    ("https-listener" => "https")
standalone.sh[2932]: ]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.undertow.listener.https" => "WFLYUT0082: Could not start 'https' listener.
standalone.sh[2932]:    Caused by: java.net.SocketException: Permission denied"}}
standalone.sh[2932]: #033[0m#033[0m02:16:47,218 INFO  [org.jboss.as.server] (ServerService Thread Pool -- 43) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")
standalone.sh[2932]: #033[0m#033[0m02:16:47,232 INFO  [org.jboss.as.controller] (Controller Boot Thread) WFLYCTL0183: Service status report
standalone.sh[2932]: WFLYCTL0186:   Services which failed to start:      service org.wildfly.undertow.listener.https: WFLYUT0082: Could not start 'https' listener.

# sysctl -w net.ipv4.ip_unprivileged_port_start=443
net.ipv4.ip_unprivileged_port_start = 443
# cat /proc/sys/net/ipv4/ip_unprivileged_port_start
443

# vi /etc/sysctl.d/99-rootless.conf

net.ipv4.ip_unprivileged_port_start=443

# sysctl --system
# systemctl restart keycloak
# ss -ant | grep :443
LISTEN 0      128    192.168.12.10:443        0.0.0.0:*

# firewall-cmd --add-port=443/tcp --zone=public --permanent
# firewall-cmd --reload

# dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm
# dnf -qy module disable postgresql
# dnf install -y postgresql13-server
# /usr/pgsql-13/bin/postgresql-13-setup initdb
# systemctl enable postgresql-13
# systemctl start postgresql-13

# su - postgres
$ psql -d postgres
postgres=# CREATE USER keycloak WITH PASSWORD 'PASSWORD' CREATEDB;
CREATE ROLE
postgres=# CREATE DATABASE keycloak OWNER keycloak;
CREATE DATABASE
postgres=# \q
$ exit

# mkdir -p /opt/drivers/jdbc
# wget https://jdbc.postgresql.org/download/postgresql-42.3.1.jar -P /opt/drivers/jdbc

# /opt/keycloak/current/bin/jboss-cli.sh
You are disconnected at the moment. Type 'connect' to connect to the server or 'help' for the list of supported commands.
[disconnected /]  module add --name=org.postgresql  --dependencies=javax.api,javax.transaction.api --resources="/opt/drivers/jdbc/postgresql-42.3.1.jar"

# mkdir -p /opt/keycloak/current/org/postgresql/main
# cp /opt/drivers/jdbc/postgresql-42.3.1.jar /opt/keycloak/current/org/postgresql/main/
# vi /opt/keycloak/current/org/postgresql/main/module.xml

<?xml version='1.0' encoding='UTF-8'?>

<module xmlns="urn:jboss:module:1.1" name="org.postgresql">

    <resources>
        <resource-root path="postgresql-42.3.1.jar"/>
    </resources>

    <dependencies>
        <module name="javax.api"/>
        <module name="javax.transaction.api"/>
    </dependencies>
</module>

[disconnected /] connect
[standalone@localhost:9990 /] /subsystem=datasources/jdbc-driver=postgresql:add(driver-name=postgresql,driver-module-name=org.postgresql,driver-class-name=org.postgresql.Driver)
{"outcome" => "success"}

# vi /opt/keycloak/current/standalone/configuration/standalone.xml

    <drivers>
      <driver name="h2" module="com.h2database.h2">
        <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
      </driver>
★    <driver name="postgresql" module="org.postgresql">
★      <driver-class>org.postgresql.Driver</driver-class>
★    </driver>
    </drivers>
  </datasources>

[standalone@localhost:9990 /] /subsystem=datasources/data-source=KeycloakDS:remove
{
    "outcome" => "success",
    "response-headers" => {
        "operation-requires-reload" => true,
        "process-state" => "reload-required"
    }
}

      </security>
    </datasource>
★  <datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
★    <connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
★    <driver>h2</driver>
★    <security>
★      <user-name>sa</user-name>
★      <password>sa</password>
★    </security>
★  </datasource>
    <drivers>
      <driver name="h2" module="com.h2database.h2">

[standalone@localhost:9990 /] /subsystem=datasources/data-source=KeycloakDS:add(driver-name=postgresql,enabled=true,use-java-context=true,connection-url="jdbc:postgresql://localhost:5432/keycloak",jndi-name="java:jboss/datasources/KeycloakDS",user-name=keycloak,password="PASSWORD",max-pool-size=20)
{
    "outcome" => "success",
    "response-headers" => {
        "operation-requires-reload" => true,
        "process-state" => "reload-required"
    }
}
[standalone@localhost:9990 /] quit

      </security>
    </datasource>
★  <datasource jndi-name="java:/jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">
★    <connection-url>jdbc:postgresql://host:port/database</connection-url>
★    <driver>postgresql</driver>
★    <pool>
★      <max-pool-size>20</max-pool-size>
★    </pool>
★    <security>
★      <user-name>keycloak</user-name>
★      <password>PASSWORD</password>
★    </security>
★  </datasource>
    <drivers>
      <driver name="h2" module="com.h2database.h2">

# systemctl restart keycloak

# hostnamectl set-hostname ldap.example.com
# apt install -y slapd ldap-utils

# slappasswd
New password: password
Re-enter new password: password
{SSHA}X71E7EoclYHZtbknkruD7JlPl6aE98RH

# vi add.ldif

dn: ou=people,dc=example,dc=com
objectClass: organizationalUnit
ou: people

dn: uid=ldapuser1,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: Ldap
sn: User1
userPassword: {SSHA}X71E7EoclYHZtbknkruD7JlPl6aE98RH
loginShell: /bin/bash
homeDirectory: /home/ldapuser1
uidNumber: 3000
gidNumber: 3000
mail: ldapuser1@example.com

# ldapadd -x -D cn=admin,dc=example,dc=com -w "password" -f add.ldif
adding new entry "ou=people,dc=example,dc=com"

adding new entry "uid=ldapuser1,ou=people,dc=example,dc=com"

# /opt/keycloak/current/bin/add-user-keycloak.sh -r master -u admin -p password
Added 'admin' to '/opt/keycloak/current/standalone/configuration/keycloak-add-user.json', restart server to load user
# systemctl restart keycloak

# vi /etc/apache2/mods-available/auth_openidc.conf

OIDCRedirectURI https://192.168.11.9/redirect_uri
OIDCCryptoPassphrase password
OIDCProviderMetadataURL https://kctest.contoso.com/auth/realms/test/.well-known/openid-configuration
OIDCScope "openid"
OIDCSSLValidateServer Off
OIDCResponseType code
OIDCClientID keycloaktestapp
OIDCClientSecret da7e3f22-82f1-49e4-ad00-3dc9c0133329
OIDCPKCEMethod S256
OIDCSessionInactivityTimeout 300
OIDCHTMLErrorTemplate /etc/apache2/auth_openidc_error.html
OIDCDefaultLoggedOutURL https://192.168.11.9/loggedout.html
OIDCClaimPrefix OIDC_CLAIM_
OIDCRemoteUserClaim preferred_username
OIDCPassClaimsAs both
OIDCAuthNHeader X-Remote-User

# systemctl restart apache2