We're trying to secure the Solr 8.11 Dashboard. KeyCloak serves as an IDP in this case. All Querys (SELECT, UPDATE, etc.) should be accessible without any Login screen.
The Solr Security.xml looks like this:
{
"authentication":{
"class": "solr.JWTAuthPlugin",
"blockUnknown": false,
"scope": "openid",
"wellKnownUrl": "http://keycloak.fqdn.com:8080/auth/realms/My-Realm/.well-known/openid-configuration",
"clientId": "Solr-auth",
"rolesClaim": "roles"
},
"authorization":{
"class":"solr.ExternalRoleRuleBasedAuthorizationPlugin",
"permissions":[{"name":"core-admin-read",
"role":"profile"}]
}
}
This works so far but does not seem quite right. Notice how I had to specify "profile" as a Role. If I put "solr-admin" as a Role I get the following Error Message from Solr when logging in:
The principal JWTPrincipalWithUserRoles{username='******************************', token='*****', claims={exp=1651702368, iat=1651680768, auth_time=1651680768, jti=************************************, iss=http://keycloak.fqdn.com:8080/auth/realms/My-Realm, aud=account, sub=********************************, typ=Bearer, azp=Solr-auth, nonce==************************************,, session_state==************************************,, acr=1, allowed-origins=[http://solr.fqdn.com:9991], realm_access={roles=[MyCustomRole1,MyCustomRole2, MyCustomRole3, solr-admin, MyCustomRole4]}, resource_access={account={roles=[manage-account, manage-account-links, view-profile]}}, scope=openid profile email, email_verified=false, preferred_username=testuser, email=myemail#fqdn.com}, roles=[profile, email]} does not have the right role
My User (testuser) has been assigned to a few different Roles. (Like MyCustomRole1) I've also created the Role "solr-admin" and assigned my User to this role. But somehow the JWT Token has "roles=[profile, email]" in it. So I have to put profile or email into the Solr security.xml. Every KeyCloak User is a Member of both Roles.
Is there a way so that Solr allows a Login if the Security.xml has solr-admin instead of profile as the Role name?
Related
I'm following the Microsoft tutorial Create a user (local or social account). So I'm trying to create a user from HTTP call, for this I'm sending a similar payload to the tutorial:
{
"accountEnabled": true,
"creationType": "LocalAccount",
"displayName": "Alex Wu",
"passwordProfile": {
"password": "Test1234",
"forceChangePasswordNextLogin": false
},
"signInNames": [
{
"type": "userName",
"value": "AlexW"
},
{
"type": "emailAddress",
"value": "alexw#gmail.com"
}
],
"userIdentities": [
{
"issuer": "google.com",
"issuerUserId": "MATxTNg5MzYyMzMyMNY1Njc="
}
]
}
My question is how I can generate the issuerUserId as it is necessary for the Google supplier to recognize the user. I'm trying with a random value encode with base64 but when I run the user flow the user it's created again with a duplicate email. I suppose Google don't recognize the issuerUserId.
Update:
Base on Allen Wu answer:
issuerUserId is a unique user identifier for the issuer. You can set any valid string (don't be duplicate) for it.
I create this issuerUserId with a valid string: 12345678909823456789
As before, I create successfully the user and the source show as Google:
But when I want to log in the account with Google provider
The user is duplicated:
I assume instead of launch Sign in process Azure/Google don't recognize the account's issuerUserId and launch the Sign-up process, for that reason that's why I think issuerUserId might be created by Google.
Some notes:
I'm changed the emails for demo emails, but that is the current
behavior.
I'm only using Google authentication, I don't using email and password fields of the login, because the purpose of the app is only for Social Authentication (Google specifically)
I'm using Sign up and sign in (Recommended) user type flow.
If you have more thoughts about issuerUserId that can help me, let me know, I'll really appreciate.
It's not true.
Based on my test, the user flow won't create a new user which has a duplicate email. (the previous user is created via AAD Graph)
issuerUserId is a unique user identifier for the issuer. You can set any valid string (don't be duplicate) for it.
And Google / Facebook or any other social idp won't verify it, because this user is created in B2C. It's an B2C local account. ("creationType": "LocalAccount")
Create an B2C local account doesn't mean this user has been created in Google.
I guess that you add Google idp into the user flow and are trying to create a new user in Google rather than B2C.
You should click on the "Sign up now" in user flow to create the local account. Kindly check it.
Update:
As I have mentioned above, the user you created with Azure AD graph is an B2C local account. You should use the default sign in feature to log into that user. B2C will verify your credential.
But when you click on the "Google" to sign in, in fact the Google will verify your credential and will associate your Google account to a new B2C account. It's not a local account.
So they are two different accounts. You can verify this by changing the password of the B2C local account. After changing the password, you still need to use the old password to sign in with the "Google" option. But you will need to use the new password to sign in with the first user (B2C local account).
You can use GET https://graph.windows.net/myorganization/users?api-version to get the two users and find that the issuerUserId of them are different.
I have developed an Azure Workbench Application that has an administrator who can create other users(by giving name and email id) and assign them roles.
The new users are created by using a REST API call here. https://votemaadi-4bm4ew-api.azurewebsites.net/swagger/ui/index.html#!/Users/UsersPost
and I assign it a role.
And later i would want the user to login with his credentials into the webapp and carry out his necessary tasks.
However, I am unable to figure out the login credentials for the new user that's created. The API (POST /api/v1/users) takes in only an email id but doesn't take in any password.
This is how i have added the new user
POST to https://votemaadi-4bm4ew-api.azurewebsites.net/api/v1/users
Body contents:
{
"externalID": "sample",
"firstName": "sample",
"lastName": "sample",
"emailAddress": "sample#kumarshobhit98outlook.onmicrosoft.com"
}
and i get a 200 response
I would want to know how would the new user login to a URL like this?
https://login.microsoftonline.com/kumarshobhit98outlook.onmicrosoft.com/oauth2/authorize?response_type=id_token%20code&client_id=c80344c2-d7fc-41e1-adcc-dd33683a7f6b&redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Fshobhit&state=c0756113-6172-47f2-8afc-666f315c15b1&client-request-id=0de0f9e0-a2f4-4853-9bd2-7326f1f409d1&x-client-SKU=Js&x-client-Ver=1.0.17&nonce=3f993c47-3042-4669-bdce-02024f6c802f&response_mode=form_post
Blockchain Workbench users need to exist in the Azure AD tenant before you can assign them to applications and roles. To add users to Azure AD, you can follow this document.
The users will have a temporary password when you create them. If you forget it, you can reset the password on Azure portal.
We have ADB2C tenant with a Identity Provider setup to an Okta setup in another Organization via Open ID Connect.
We have a Admin UI to add users. I see that GraphAPI has a createUser which takes a json with Password and changePwdOnFirstUse setting. This is fine to add a direct member to ADB2C.
The problem I have is that, how can I add the User from the other Okta
Organization so that when this user logs in to my App (and is authenticated by Okta), can login to my App.
At present, after authentication from Okta, we see User not found Error.
I suppose, I cannot add this user via Graph API using same createUser method as this user password is not something we are supposed to manage.
How do I add this other Organization user to ADB2C, so that I do not see this "User not found" issue?
Thanks.
Using Azure AD Graph API, you can create an external account user, with the userIdentities property of the user object being set to the sub (subject) claim of Okta's ID token:
{
"accountEnabled": false,
"displayName": "John Smith",
"mailNickname": "john.smith",
"otherMails": [
"john.smith#company.com"
],
"userIdentities": [
{
"issuer": "{okta-id-token-iss-claim-value}",
"issuerUserId": "{okta-id-token-sub-claim-value}"
}
],
"userPrincipalName": "{guid}#{your-tenant-name}.onmicrosoft.com"
}
where issuerUserId must be set to the base64 encoding for the sub claim of Okta's ID token.
I have a few users added to my Azure AD account, I would like to get the roles and user information on these users by calling an Azure API from Postman in the form of claims. I tried calling the following URL with the parameters as :
https://login.microsoftonline.com/myTenantId/oauth2/token
Body:
grant_type : password,
client_id : client id,
client secret : client secret
I receive the access_token in the encoded format in the response, When I decode it on https://jwt.io/ I see the decoded data, but there's no user roles in the access_token.
I would like to get the user information and the roles in the form of claims in same response.
What approach would I need to take on this ?
If the role you mentioned refers to directory role, the answer is no, it won't be returned in the token. Just like juunas said, you can call graph api to get directory role information.
If the role you mentioned refers to application role, the answer is yes, you can get the role information in id_token. The prerequisite is that you have assigned some roles to the user.
Here are the detailed steps. You can also refer to this article.
edit the manifest to add some custom roles.
Something like this.
{
"allowedMemberTypes": [
"User"
],
"displayName": "Test",
"id": "c200e304-fff3-49f1-a4df-e406741ea680",
"isEnabled": true,
"description": "Bla bla",
"value": "test"
}
2.assign users to roles.
Click Enterprise applications->All applications->
Click your application->click Users and groups->click Add user
role assign.
Here is the request to get id_token.
You will find the roles in id_token.
I need to programmatically add user account to Azure API Catalog portal.
I use ApiManagementClient class from package Microsoft.Azure.Management.ApiManagement (3.4) and if collection Users does not have a user with a particular e-mail (Azure Active Directory has a user whose username is our company e-mail, for every user that we have in or internal Active Directory)
then I'd try to call Users.CreateAsync which will take a parameter of type UserCreateParameters that consists of Email, FirstName, LastName, State and Password.
The issue here is that my user has been added to the portal manually by administrator and my password was not required for that (as it is an AAD user)
but this method won't let me create a new user if I don't provide a password.
How can I add an AAD user to the API Catalog, from code and without knowing the password. Otherwise, I won't be able to add an API subscription for a user that has not been added to the portal, yet.
We are working a new nuget package, which has support for that. For now, you can use the rest api https://learn.microsoft.com/en-us/rest/api/apimanagement/user/createorupdate
But you would need to know the unique Id of the User in AAD System. The operation above will create a user which can log-in both using AAD or Basic Auth.
{
"properties": {
"firstName": "foo",
"lastName": "bar",
"email": "foobar#mytenant.onmicrosoft.com"
"identities" :[
"provider": "Aad",
"id": "<unique id in AAd Tenant>"
]
}
}