Wallaroo Authentication Configuration Guides

• 1: Wallaroo SSO for Amazon Web Services
• 2: Wallaroo SSO for Microsoft Azure
• 3: Wallaroo SSO for Google Cloud Platform
• 4: Wallaroo SSO Configuration for Seamless Redirect

1 - Wallaroo SSO for Amazon Web Services

Organizations can use Amazon Web Services (AWS) as an identity provider for single sign-on (SSO) logins for users with Wallaroo Enterprise.

To enable AWS as an authentication provider to a Wallaroo instance:

• Create the Wallaroo AWS SAML Identity Provider
• Create the AWS Credentials
• Add the AWS Credentials to Wallaroo
• Verify the Login

Prerequisites

• Administrative access to the Wallaroo instance
• Permissions in an AWS account to the IAM Identity Center. For more information, see AWS IAM Identity Center Prerequisites and considerations for specific environments

Create the Wallaroo AWS SAML Identity Provider

Using AWS as a single sign-on identity provider within Wallaroo requires access to the Wallaroo instance’s Keycloak service. This process will require both the IAM Identity Center and Wallaroo Keycloak service be available at the same time to copy information between the two. When starting this process, do not close the Wallaroo Keycloak browser window or the AWS IAM Identity Center without completing all of the steps until Verify the Login.

1. 1. From the Wallaroo instance, login to the Keycloak service. This will commonly be $PREFIX.keycloak.$SUFFIX. For example, playful-wombat-5555.keycloak.wallaroo.example.

2. Select Administration Console.

3. From the left navigation panel, select Identity Providers.

4. Select Add provider and select SAML v2.0.

   

5. Enter the following:

   1. Alias ID: This will be the internal ID of the identity provider. It also sets the Redirect URI used in later steps.
   2. Display Name: The name displayed for users to use in authenticating.

6. Save the following information:

   1. Redirect URI: This is determined by the Wallaroo DNS Prefix, Wallaroo DNS Suffix, and the Alias ID in the format $PREFIX.keycloak.$SUFFIX/auth/realms/master/broker/$ALIASID/endpoint. For example, playful-wombat-5555.keycloak.wallaroo.example/auth/realms/master/broker/aws/endpoint.
   2. Service Provider Entry ID: This is in the format $PREFIX.keycloak.$SUFFIX/auth/realms/master. For example: playful-wombat-5555.keycloak.wallaroo.example/auth/realms/master.

Create the AWS Credentials

The next step is creating the AWS credentials, and requires access to the organization’s Amazon IAM Identity Center.

1. From the AWS console, select the IAM Identity Center.

   

2. From the IAM Identity Center Dashboard, select Applications then Add application.

   

3. Select Custom application->Add custom SAML 2.0 application, then select Next.

   

4. Enter the following:

   1. Display name: AWS or something similar depending on your organization’s requirements.
   2. Application metadata:
      1. Application ACS URL: Enter the Redirect URI from [Create the Wallaroo AWS SAML Identity Provider].(#create-the-wallaroo-aws-saml-identity-provider).
      2. Application SAML audience: Enter the Service Provider Entry ID from [Create the Wallaroo AWS SAML Identity Provider].

5. Select the IAM Identity Center SAML metadata file and copy the URL. Store this for the step [Add AWS Credentials to Wallaroo](#add-aws-credentials-to-wallaroo(#add-aws-credentials-to-wallaroo).

6. Select Submit.

7. From the new application, select Actions->Edit attribute mappings.

   

8. Enter the following:

   

   1. Subject (default entry): Set to ${user:email}, with the Format emailAddress.
   2. Select Add new attribute mapping and set it to email, mapped to ${user:email}, with the Format emailAddress.

9. Select Save Changes to complete mapping the attributes.

10. From the IAM Identity Center Dashboard, select Users. From here, add or select the users or groups that will have access to the Wallaroo instance then select Assign Users.

    

Add AWS Credentials to Wallaroo

Return to the Wallaroo Keycloak service and the new Identity Provider from Create the Wallaroo AWS SAML Identity Provider.

1. In Import External IDP Config->Import from URL, enter the IAM Identity Center SAML metadata file saved from Create the AWS Credentials in the field Service Provider Entity ID.

2. Select Import.

   

3. Once the AWS SAMl settings are imported, select Save to store the identity provider.

Verify the Login

Once complete, log out of the Wallaroo instance and go back into the login screen. With the usual username and password screen should also be a AWS link at the bottom or whatever name was set for the identity provider. Select that link to login.

Login to the IAM Application created in Create the AWS Credentials. The first time a user logs in they will be required to add their first and last name. After this, logins will happen as long as the user is logged into the AWS IAM application without submitting any further information.

2 - Wallaroo SSO for Microsoft Azure

Organizations can use Microsoft Azure as an identity provider for single sign-on (SSO) logins for users with Wallaroo Enterprise.

To enable Microsoft Azure as an authentication provider to a Wallaroo Enterprise instance:

• Create the Azure Credentials
• Add Azure Credentials to Wallaroo
• Verify the Login

Create the Azure Credentials

The first step is to create the Azure credentials in Microsoft Azure.

By the end, the following information must be saved for use in the step Add Azure Credentials to Wallaroo:

• Application (client) ID
• Client secret Value
• OpenID Connect metadata document

Create the New App

1. Login into the Microsoft Azure account with an account with permissions to create application registrations.

2. Select App registrations from the Azure Services menu, or search for App Registrations from the search bar.

   

3. From the App registrations screen, select either an existing application, or select + New registration. This example will show creating a new registration.

   

4. From the Register an application screen, set the following:

   1. Name: The name of the application.

   2. Supported account types: To restrict only to accounts in the organization directory, select Accounts in this organizational directory only.

   3. Redirect URI: Set the type to Web and the URI. The URI will be based on the Wallaroo instance and the name of the Keycloak Identity Provider set in the step Add Azure Credentials to Wallaroo. This will be a link back to the Keycloak endpoint URL in your Wallaroo instance in the format https://$PREFIX.keycloak.$SUFFIX/auth/realms/master/broker/$IDENTITYNAME/endpoint.

      For example, if the Wallaroo prefix is silky-lions-3657, the name of the Wallaroo Keycloak Identity Provider is azure, and the suffix is wallaroo.ai, then the Keycloak endpoint URL would be silky-lions-3657.keycloak.wallaroo.ai/auth/realms/master/broker/azure/endpoint. For more information see the DNS Integration Guide.

      Once complete, select Register.

      

Store the Application ID

1. From the Overview screen, store the following in a secure location:

   1. Application (client) ID: This will be used in the Add Azure Credentials to Wallaroo step.

      

2. From the Overview screen, select Redirect URIs. Set the following:

   1. Verify the Redirect URI matches the Wallaroo instance endpoint.
   2. Under Implicit grant and hybrid flows, set the following:
      1. Access tokens: Enabled
      2. ID tokens: Enabled

3. From the Overview screen, from the left sidebar select API permissions. Select +Add a permission.

   

   1. Select Microsoft Graph, then Delegated Permissions.

      

   2. Set email, openid, profile to Enabled then select Add permissions.

Create Client Secret

1. From the Overview screen, select Add a certificate or secret.

   

2. Select Client secrets, then +New client secret.

   

   1. Set the following, then select Add.

      

      1. Description: Set the description of the client secret.
      2. Expires: Set the expiration for the client secret. Defaults to 6 months from creation.

   2. Store the following in a secure location:

      1. Client secret Value: This will be used in the Add Azure Credentials to Wallaroo step.

Store Metadata Document

1. From the left navigation panel, select Overview, then Endpoints.

   

   1. Store the following in a secure location:

      1. OpenID Connect metadata document: This will be used in the Add Azure Credentials to Wallaroo step.

         

Add Azure Credentials to Wallaroo

With the Azure credentials saved from the Create the Azure Credentials step, they can now be added into the Wallaroo Keycloak service.

1. Login to the Wallaroo Keycloak service with a Wallaroo admin account from the URL in the format https://$PREFIX.keycloak.$SUFFIX.

   For example, if the Wallaroo prefix is silky-lions-3657, the name of the Wallaroo Keycloak Identity Provider is azure, and the suffix is wallaroo.ai, then the Keycloak endpoint URL would be silky-lions-3657.keycloak.wallaroo.ai. For more information see the DNS Integration Guide.

2. Select Administration Console, then from the left navigation panel select Identity Providers.

   

3. From the right Add provider… drop down menu select OpenID Connect v1.0.

   

4. From the Add identity provider screen, add the following:

   

   1. alias: The name of the the Identity Provider. IMPORTANT NOTE: This will determine the Redirect URI value that is used in the Create the Azure Credentials step. Verify that the Redirect URI in both steps are the same.
   2. Display Name: The name that will be shown on the Wallaroo instance login screen.
   3. Client Authentication: Set to Client secret sent as post.
   4. Client Authentication: Set with the Application (client) ID created in the Create the Azure Credentials step.
   5. Client Secret: Set with the Client secret Value created in the Create the Azure Credentials step.
   6. Default Scopes: Set to openid email profile - one space between each word.
   7. Scroll to the bottom of the page and in Import from URL, add the OpenID Connect metadata document created in the Create the Azure Credentials step. Select Import to set the Identity Provider settings.

   

5. Once complete, select Save to store the identity provider settings.

Once the Azure Identity Provider settings are complete, log out of the Keycloak service.

Verify the Login

After completing Add Azure Credentials to Wallaroo, the login can be verified through the following steps. This process will need to be completed the first time a user logs into the Wallaroo instance after the Azure Identity Provider settings are added.

1. Go to the Wallaroo instance login page. The Azure Identity Provider will be displayed under the username and password request based on the Displey Name set in the Add Azure Credentials to Wallaroo step.

2. Select the Azure Identity Provider to login.

   

3. For the first login, grant permission to the application. You may be required to select which Microsoft Azure account is being used to authenticate.

   

Once complete, the new user will be added to the Wallaroo instance.

3 - Wallaroo SSO for Google Cloud Platform

Organizations can use Google Cloud Platform (GCP) as an identity provider for single sign-on (SSO) logins for users with Wallaroo Enterprise.

To enable Google Cloud Platform (GCP) as an authentication provider to a Wallaroo instance:

• Create the GCP Credentials
• Add GCP Credentials to Wallaroo
• Verify the Login

Create GCP Credentials

To create the GCP credentials a Wallaroo instance uses to authenticate users:

1. Log into Google Cloud Platform (GCP) console.

2. From the left side menu, select APIs and Services -> Credentials.

   

3. Select + CREATE CREDENTIALS->Oauth client ID.

   

4. Set Application type to Web application.

5. Set the following options:

   1. Name: The name for this OAuth Client ID.

   2. Authorized redirect URIs: This will be a link back to the Keycloak endpoint URL in your Wallaroo instance in the format https://$PREFIX.keycloak.$SUFFIX/auth/realms/master/broker/google/endpoint.

      For example, if the Wallaroo prefix is silky-lions-3657 and the suffix is wallaroo.ai, then the Keycloak endpoint URL would be silky-lions-3657.keycloak.wallaroo.ai/auth/realms/master/broker/google/endpoint. For more information see the DNS Integration Guide.

6. When the Oauth client is created, the Client ID and the Client Secret will be displayed. Store these for the next steps.

   

Add GCP Credentials to Wallaroo

With the Client ID and Client Secret from Google, we can now add this to the Wallaroo instance Keycloak service.

1. From the Wallaroo instance, login to the Keycloak service. This will commonly be $PREFIX.keycloak.$SUFFIX. For example, playful-wombat-5555.keycloak.wallaroo.ai.

2. Select Administration Console.

3. From the left navigation panel, select Identity Providers.

4. Select Add provider and select Google.

5. Enter the following:

   

   1. Redirect URI: Verify this is the same endpoint defined in Create GCP Credentials.
   2. Client ID: Use the Client id from Get GCP Credentials.
   3. Client Secret: Use the Client secret from Get GCP Credentials.
   4. Hosted Domain: The domain that the user’s will be logging in from. For example: wallaroo.ai.
   5. Enabled: On
   6. For the other settings, see the Keycloak Social Identity Providers documentation.

Verify the Login

Once complete, log out of the Wallaroo instance and go back into the login screen. With the usual username and password screen should also be a google link at the bottom or whatever name was set for the identity provider.

Select it, then select which Google user account to use. As long the domain matches the one listed in Add Google Credentials to Keycloak, the login will succeed. The first time a user logs in through Google, Keycloak will create a new local user account based on the Google credentials.

Troubleshooting

I get the error “This app’s request is invalid”

Double check the Google credentials from Get GCP Credentials and verify that the Authorized redirect URIs matches the one in Keycloak. This can be verified from logging into Keycloak, selecting Identity Providers, selecting the Google identity provider and Redirect URI from the top line.

4 - Wallaroo SSO Configuration for Seamless Redirect

By default, when organizations add identity providers to Wallaroo users have to select which identity provider or at least provide their username and passwords to login through the default Keycloak service.

The following instructions show how to set an identity provider as the default and configure Wallaroo so users who are already authenticated through a identity provider can seamlessly login to their Wallaroo instance without having to select any other options.

This process has two major steps:

• Set an Identity Provider as Default
• Set Update Profile on First Login to Off

Prerequisites

These instructions assume that an identity provider has been created for the Wallaroo instance.

Set an Identity Provider as Default

To set a default identity provider for a Wallaroo instance for seamless access:

1. Access the Wallaroo Keycloak service through a browser as an administrator. The Keycloak service URL will be in the format $WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX. For example, if the Wallaroo prefix is wallaroo and the suffix example.com, then the Keycloak service URL would be wallaroo.keycloak.example.com. See the DNS Integration Guide for more details on Wallaroo services with DNS.

2. Select Administration Console, then log in with an administrator account. See the Wallaroo User Management guides for more information.

3. From the left navigation panel, select Authentication.

4. For the Auth Type Identity Provider Redirector row, select Actions -> Config.

   

5. Enter the following:

   1. Alias: The name for this configuration.
   2. Default Identity Provider: The identity provider to use by default. A list is available from Configure->Identity Providers. For this example, it is google. Verify that the name matches the name of the existing Identity Provider.

6. Select Save.

7. Save the ID! Save the Identity Provider Redirectory generated by Keycloak. This step is important in disabling the seamless redirect.

   

Set Update Profile on First Login to Off

This optional step prevents the Keycloak service from forcing the user to update an existing profile the first time they log in through a new identity provider. For more information, see the Keycloak Identity Broker First Login documentation.

To set the Identity Broker First Login to Off:

1. Access the Wallaroo Keycloak service through a browser as an administrator. The Keycloak service URL will be in the format $WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX. For example, if the Wallaroo prefix is wallaroo and the suffix example.com, then the Keycloak service URL would be wallaroo.keycloak.example.com. See the DNS Integration Guide for more details on Wallaroo services with DNS.

2. Select Administration Console, then log in with an administrator account. See the Wallaroo User Management guides for more information.

3. From the left navigation panel, select Authentication.

4. From the top drop-down list, select First Broker Login, then for the row labeled Review Profile(review profile config), select Actions->Config.

   

5. Set Update Profile on First Login to Off.

   

6. Select Save.

Disable Automatic Redirects

Disable Through Keycloak UI

To disable automatic redirects through the Keycloak UI:

1. 1. Access the Wallaroo Keycloak service through a browser as an administrator. The Keycloak service URL will be in the format $WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX. For example, if the Wallaroo prefix is wallaroo and the suffix example.com, then the Keycloak service URL would be wallaroo.keycloak.example.com. See the DNS Integration Guide for more details on Wallaroo services with DNS.

2. Select Administration Console, then log in with an administrator account. See the Wallaroo User Management guides for more information.

3. From the left navigation panel, select Authentication.

4. For the Auth Type Identity Provider Redirector row, set the Requirement to Disabled.

   

Seamless redirect is now disabled. Users will be able to either enter their username/password, or select the identity provider to use.

Disable through Kubernetes

This process allows users to disable the seamless redirect through through the Kubernetes administrative node. This process requires the following:

• The Identity Provider Redirector was saved from the step Set an Identity Provider as Default.
• kubectl is installed on the node administrating the Kubernetes environment hosting the Wallaroo instance.
• curl is installed.

These steps assume the Wallaroo instance was installed into the namespace wallaroo.

The following code will retrieve the Wallaroo Keycloak admin password,then makes a connection to the Wallaroo Keycloak service through curl, then delete the identity provider set as the Identity Provider Redirector.

The Keycloak service URL will be in the format $WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX. For example, if the Wallaroo prefix is wallaroo and the suffix example.com, then the Keycloak service URL would be wallaroo.keycloak.example.com. See the DNS Integration Guide for more details on Wallaroo services with DNS.

The variable IDENTITYUUID is the Identity Provider Redirector UUID.

Replace WALLAROOPREFIX, WALLAROOSUFFIX and IDENTITYUUID with the appropriate values for your Wallaroo instance.

WALLAROOPREFIX="wallaroo"
WALLAROOSUFFIX="example.com"
IDENTITYUUID="1234"
KEYCLOAK_PASSWORD=$(kubectl -n wallaroo get secret keycloak-admin-secret -o go-template='{{.data.KEYCLOAK_ADMIN_PASSWORD | base64decode }}')
TOKEN=$(curl -s "https://$WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX/auth/realms/master/protocol/openid-connect/token" -d "username=admin" -d "password=$KEYCLOAK_PASSWORD" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r .access_token)
curl -H "Authorization: Bearer $TOKEN" "https://$WALLAROOPREFIX.keycloak.$WALLAROOSUFFIX/auth/admin/realms/master/authentication/config/$IDENTITYUUID" -X DELETE

Seamless redirect is now disabled. Users will be able to either enter their username/password, or select the identity provider to use.