Fix SSO authentication on keycloak activation

packaging/setup/ovirt_engine_setup/keycloak/constants.py

@@ -134,61 +134,21 @@ class ApacheEnv(object):
 @osetupattrsclass
 class ConfigEnv(object):
 
-    @osetupattrs(
-        is_secret=True,
-        answerfile=True,
-        postinstallfile=True,
-    )
-    def KEYCLOAK_OVIRT_INTERNAL_CLIENT_SECRET(self):
-        return 'OVESETUP_KEYCLOAK/ovirtInternalClientSecret'
-
     @osetupattrs(
         answerfile=True,
     )
     def OVIRT_ENGINE_KEYCLOAK_DB_BACKUP_DIR(self):
         return 'OVESETUP_KEYCLOAK_CONFIG/keycloakDbBackupDir'
 
-    @osetupattrs(
-        answerfile=True,
-        postinstallfile=True,
-        is_secret=True,
-    )
-    def ADMIN_PASSWORD(self):
-        return 'OVESETUP_KEYCLOAK_CONFIG/adminPassword'
-
     @osetupattrs(
         postinstallfile=True,
     )
     def OVIRT_ADMIN_USER(self):
         return 'OVESETUP_KEYCLOAK_CONFIG/ovirtAdminUser'
 
-    @osetupattrs(
-        postinstallfile=True,
-    )
-    def OVIRT_ADMIN_USER_WITH_PROFILE(self):
-        return 'OVESETUP_KEYCLOAK_CONFIG/ovirtAdminUserWithProfile'
-
     KEYCLOAK_ADD_USER_SCRIPT = 'OVESETUP_KEYCLOAK_CONFIG/addUserKeycloakScript'
     KEYCLOAK_CLI_ADMIN_SCRIPT = 'OVESETUP_KEYCLOAK_CONFIG/kcadmScript'
     KEYCLOAK_WRAPPER_SCRIPT = 'OVESETUP_KEYCLOAK_CONFIG/kkWrapperScript'
-    KEYCLOAK_AUTH_URL = 'OVESETUP_KEYCLOAK_CONFIG/authUrl'
-    KEYCLOAK_TOKEN_URL = 'OVESETUP_KEYCLOAK_CONFIG/tokenUrl'
-    KEYCLOAK_USERINFO_URL = 'OVESETUP_KEYCLOAK_CONFIG/userinfoUrl'
-
-@util.export
-@util.codegen
-@osetupattrsclass
-class CoreEnv(object):
-
-    @osetupattrs(
-        answerfile=True,
-        postinstallfile=True,
-        summary=True,
-        reconfigurable=False,
-        description=_('Keycloak installation'),
-    )
-    def ENABLE(self):
-        return 'OVESETUP_KEYCLOAK_CORE/enable'
 
 @util.export
 @util.codegen

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/core/admin_user.py

@@ -59,8 +59,8 @@ def _setup(self):
             okkcons.Stages.KEYCLOAK_CREDENTIALS_SETUP,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE] and
-            self.environment[okkcons.DBEnv.NEW_DATABASE] and
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
+            not self.environment[oengcommcons.KeycloakEnv.CONFIGURED] and
             self.environment[
                 oenginecons.EngineDBEnv.JUST_RESTORED
             ] is not True and
@@ -70,7 +70,7 @@ def _setup(self):
         ),
     )
     def _create_admin(self):
-        password = self.environment[okkcons.ConfigEnv.ADMIN_PASSWORD]
+        password = self.environment[oengcommcons.KeycloakEnv.ADMIN_PASSWORD]
         if password:
             self.logger.info(_('Creating initial Keycloak admin user'))
             # TODO consider using transaction

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/core/misc.py

@@ -15,6 +15,7 @@
 
 from ovirt_engine import configfile
 from ovirt_engine_setup import constants as osetupcons
+from ovirt_engine_setup.engine_common import constants as oengcommcons
 from ovirt_engine_setup.keycloak import constants as okkcons
 
 
@@ -64,20 +65,26 @@ def _setup(self):
             optional=True,
         )
 
-
     @plugin.event(
         stage=plugin.Stages.STAGE_INIT,
     )
     def _init(self):
+        self.environment.setdefault(
+            oengcommcons.KeycloakEnv.ENABLE,
+            None
+        )
+        self.environment.setdefault(
+            oengcommcons.KeycloakEnv.CONFIGURED,
+            False
+        )
+
         config = configfile.ConfigFile([
             okkcons.FileLocations.OVIRT_ENGINE_SERVICE_CONFIG_KEYCLOAK,
         ])
-
         if config.get('KEYCLOAK_BUNDLED') is not None:
-            self.environment.setdefault(okkcons.CoreEnv.ENABLE,
-                                        config.getboolean('KEYCLOAK_BUNDLED'))
-        else:
-            self.environment.setdefault(okkcons.CoreEnv.ENABLE, None)
+            self.environment[
+                oengcommcons.KeycloakEnv.CONFIGURED
+            ] = config.getboolean('KEYCLOAK_BUNDLED')
 
 
 # vim: expandtab tabstop=4 shiftwidth=4

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/core/ovirt_internal.py

@@ -75,8 +75,8 @@ def _setup(self):
             oengcommcons.Stages.CORE_ENGINE_START,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE] and
-            self.environment[okkcons.DBEnv.NEW_DATABASE] and
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
+            not self.environment[oengcommcons.KeycloakEnv.CONFIGURED] and
             self.environment[
                 oenginecons.EngineDBEnv.JUST_RESTORED
             ] is not True and
@@ -86,7 +86,9 @@ def _setup(self):
         ),
     )
     def _setup_ovirt(self):
-        password = self.environment.get(okkcons.ConfigEnv.ADMIN_PASSWORD)
+        password = self.environment.get(
+            oengcommcons.KeycloakEnv.ADMIN_PASSWORD
+        )
         if password:
             self.logger.info('Start with setting up Keycloak for Ovirt Engine')
 
@@ -236,11 +238,13 @@ def _setup_realm(self):
 
     def _setup_client(self):
         cid = self._get_client_id(
-            client_id_name=okkcons.Const.KEYCLOAK_INTERNAL_CLIENT_NAME
+            client_id_name=self.environment[
+                oengcommcons.KeycloakEnv.KEYCLOAK_OVIRT_INTERNAL_CLIENT_ID
+            ]
         )
         envs = self.KCADM_ENV.copy()
         envs['CLIENT_SECRET'] = self.environment[
-            okkcons.ConfigEnv
+            oengcommcons.KeycloakEnv
                 .KEYCLOAK_OVIRT_INTERNAL_CLIENT_SECRET
         ]
         envs['KK_TOOL']=self.environment[
@@ -258,7 +262,9 @@ def _setup_client(self):
                     '-r', okkcons.Const.KEYCLOAK_INTERNAL_REALM,
                     '-s', 'enabled=true',
                     '-s', 'clientId={}'.format(
-                        okkcons.Const.KEYCLOAK_INTERNAL_CLIENT_NAME
+                        self.environment[
+                            oengcommcons.KeycloakEnv.KEYCLOAK_OVIRT_INTERNAL_CLIENT_ID
+                        ]
                     ),
                     '-s', 'clientAuthenticatorType=client-secret',
                     '-i',
@@ -699,8 +705,8 @@ def _results(rc, out):
             osetupcons.Stages.DIALOG_TITLES_S_SUMMARY,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE] and
-            self.environment[okkcons.DBEnv.NEW_DATABASE]
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
+            not self.environment[oengcommcons.KeycloakEnv.CONFIGURED]
         )
     )
     def _closeup(self):

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/db/config.py

@@ -19,6 +19,7 @@
 
 from ovirt_engine_setup import constants as osetupcons
 from ovirt_engine_setup.engine import constants as oenginecons
+from ovirt_engine_setup.engine_common import constants as oengcommcons
 from ovirt_engine_setup.keycloak import constants as okkcons
 
 
@@ -45,11 +46,10 @@ def _init(self):
     @plugin.event(
         stage=plugin.Stages.STAGE_VALIDATION,
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE]
+            self.environment[oengcommcons.KeycloakEnv.ENABLE]
         )
     )
     def _validation(self):
-        # not okkcons.DBEnv.NEW_DATABASE ??
         path = self.environment[
             okkcons.ConfigEnv.OVIRT_ENGINE_KEYCLOAK_DB_BACKUP_DIR
         ]

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/db/connection.py

@@ -23,6 +23,7 @@
 from ovirt_engine_setup import constants as osetupcons
 from ovirt_engine_setup.engine import constants as oenginecons
 from ovirt_engine_setup.keycloak import constants as okkcons
+from ovirt_engine_setup.engine_common import constants as oengcommcons
 from ovirt_engine_setup.engine_common import database
 
 
@@ -106,7 +107,7 @@ def _init(self):
             okkcons.Stages.DB_CONNECTION_SETUP,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE]
+            self.environment[oengcommcons.KeycloakEnv.ENABLE]
         ),
     )
     def _commands(self):
@@ -123,7 +124,7 @@ def _commands(self):
             okkcons.Stages.CORE_ENABLE,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE] and
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
             (
                 self.environment[osetupcons.CoreEnv.ACTION]
                 != osetupcons.Const.ACTION_PROVISIONDB
@@ -163,7 +164,6 @@ def _setup_connection(self):
                     dbenvkeys=okkcons.Const.KEYCLOAK_DB_ENV_KEYS,
                 )
                 dbovirtutils.tryDatabaseConnect(dbenv)
-                self.logger.info("connected to keycloak db")
                 self.environment.update(dbenv)
                 self.environment[
                     okkcons.DBEnv.NEW_DATABASE

packaging/setup/plugins/ovirt-engine-common/ovirt-engine-keycloak/db/pgpass.py

@@ -18,6 +18,7 @@
 
 from ovirt_engine_setup import constants as osetupcons
 from ovirt_engine_setup.engine import constants as oenginecons
+from ovirt_engine_setup.engine_common import constants as oengcommcons
 from ovirt_engine_setup.engine_common import database
 from ovirt_engine_setup.keycloak import constants as okkcons
 
@@ -45,7 +46,7 @@ def _init(self):
             okkcons.Stages.CORE_ENABLE,
         ),
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE] and
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
             self.environment[okkcons.DBEnv.PASSWORD] is not None
         ),
     )

packaging/setup/plugins/ovirt-engine-setup/ovirt-engine-keycloak/apache/internalsso.py

@@ -40,11 +40,16 @@ def _init(self):
             okkcons.ApacheEnv.HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC,
             okkcons.FileLocations.HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC,
         )
+        self.environment.setdefault(
+            oengcommcons.KeycloakEnv.KEYCLOAK_OVIRT_INTERNAL_CLIENT_ID,
+            okkcons.Const.KEYCLOAK_INTERNAL_CLIENT_NAME,
+        )
 
     @plugin.event(
         stage=plugin.Stages.STAGE_MISC,
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE]
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
+            not self.environment[oengcommcons.KeycloakEnv.CONFIGURED]
         ),
         after=(
             okkcons.Stages.CLIENT_SECRET_GENERATED,
@@ -60,23 +65,28 @@ def _internalsso_openidc(self):
         )
 
         self.environment[oengcommcons.ApacheEnv.NEED_RESTART] = True
+        openidc_template = okkcons\
+            .FileLocations\
+            .HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC_TEMPLATE
         self.environment[otopicons.CoreEnv.MAIN_TRANSACTION].append(
             filetransaction.FileTransaction(
                 name=self.environment[
-                    okkcons.ApacheEnv.HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC
+                    okkcons.ApacheEnv
+                        .HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC
                 ],
                 mode=0o640,
                 enforcePermissions=True,
                 content=outil.processTemplate(
-                    template=(
-                        okkcons.FileLocations.HTTPD_CONF_OVIRT_ENGINE_INTERNAL_SSO_OPENIDC_TEMPLATE
-                    ),
+                    template=(openidc_template),
                     subst={
                         '@CLIENT_SECRET@': self.environment[
-                            okkcons.ConfigEnv.KEYCLOAK_OVIRT_INTERNAL_CLIENT_SECRET
+                            oengcommcons.KeycloakEnv
+                                .KEYCLOAK_OVIRT_INTERNAL_CLIENT_SECRET
+                        ],
+                        '@CLIENT_ID@':self.environment[
+                            oengcommcons.KeycloakEnv
+                                .KEYCLOAK_OVIRT_INTERNAL_CLIENT_ID
                         ],
-                        '@CLIENT_ID@':
-                            okkcons.Const.KEYCLOAK_INTERNAL_CLIENT_NAME,
                         '@OVIRT_REALM@':
                             okkcons.Const.KEYCLOAK_INTERNAL_REALM,
                         '@ENGINE_FQDN@': self.environment[

packaging/setup/plugins/ovirt-engine-setup/ovirt-engine-keycloak/apache/keycloakproxy.py

@@ -44,7 +44,8 @@ def _init(self):
     @plugin.event(
         stage=plugin.Stages.STAGE_MISC,
         condition=lambda self: (
-            self.environment[okkcons.CoreEnv.ENABLE]
+            self.environment[oengcommcons.KeycloakEnv.ENABLE] and
+            not self.environment[oengcommcons.KeycloakEnv.CONFIGURED]
         )
     )
     def _httpd_keycloak_misc(self):