Adapt Clevermicro System for SSO Authenticated Users #12

New issue

Open

opened 2025-04-22 23:54:34 +00:00 by abed.alrahman · 1 comment

abed.alrahman commented

2025-04-22 23:54:34 +00:00

Member

Ref epic: #13

Goal: Ensure that users authenticating via the newly configured external SSO providers (Google, etc.) are handled consistently and correctly by the downstream Clevermicro components, particularly auth-service and services relying on injected user metadata.

Description:
This ticket will implement the changes for different Clevermicro components to support the SSO login. For example, mapping the profiles so that the third-party SSO accounts, our system can still get info like email, name, etc. We also need to ensure the token issued by the auth-service is consistent (the token should not require extra processing if logged in by SSO). Sub-tickets might be created as needed.

Prerequisites:

Keycloak is successfully configured with the required SSO Identity Providers.
Auth-service is handling authentication and injecting user metadata headers.
Downstream microservices rely on these injected headers.

What needs to be done:

Verify/Refine Profile Mapping:
    Review the Identity Provider mappers configured in Keycloak (Ticket 1). Ensure that essential user attributes (email, first name, last name) are consistently mapped from all external providers to the standard Keycloak user attributes. Add or adjust mappers if necessary.
Verify Token Consistency:
    Test the tokens generated by Keycloak for users logged in via SSO. Ensure they contain the same essential claims (e.g., sub, email, preferred_username, group/role claims via mappers) as tokens for locally registered users. Adjust Keycloak client scopes or token mappers if needed.
Test auth-service Integration:
    Verify that the /auth (forward auth) endpoint correctly validates tokens for SSO users.
    Verify that the /verify endpoint works correctly for SSO users.
    Confirm that the user metadata injection (e.g., X-User-Email, X-User-Groups) correctly extracts and injects information for SSO users based on the mapped attributes.
Review Account Linking:
    Examine Keycloak's default behavior ("First Broker Login" flow) when an SSO login uses an email that might already exist as a local account (or vice versa). Decide if the default linking strategy is acceptable or if customization is needed (e.g., prompting the user).
Verify Group/Permission Compatibility:
    Test adding SSO-authenticated users to Keycloak groups (representing tenants/organizations).
    Ensure downstream services relying on injected headers (like X-User-Groups) for permission checks behave correctly when the user has logged in via SSO.
Documentation: Document any findings or necessary configuration adjustments related to handling SSO users within the Clevermicro system.

Deliverables:

Confirmation that the auth-service and downstream services handle SSO-authenticated users consistently regarding token validation, metadata injection, and group memberships.
Potentially updated Keycloak Identity Provider mapper configurations.
Documentation of any specific considerations for SSO users within the Clevermicro system.

Ref epic: [#13](https://git.cleverthis.com/clevermicro/user-management/issues/13) Goal: Ensure that users authenticating via the newly configured external SSO providers (Google, etc.) are handled consistently and correctly by the downstream Clevermicro components, particularly auth-service and services relying on injected user metadata. Description: This ticket will implement the changes for different Clevermicro components to support the SSO login. For example, mapping the profiles so that the third-party SSO accounts, our system can still get info like email, name, etc. We also need to ensure the token issued by the auth-service is consistent (the token should not require extra processing if logged in by SSO). Sub-tickets might be created as needed. Prerequisites: Keycloak is successfully configured with the required SSO Identity Providers. Auth-service is handling authentication and injecting user metadata headers. Downstream microservices rely on these injected headers. What needs to be done: Verify/Refine Profile Mapping: Review the Identity Provider mappers configured in Keycloak (Ticket 1). Ensure that essential user attributes (email, first name, last name) are consistently mapped from all external providers to the standard Keycloak user attributes. Add or adjust mappers if necessary. Verify Token Consistency: Test the tokens generated by Keycloak for users logged in via SSO. Ensure they contain the same essential claims (e.g., sub, email, preferred_username, group/role claims via mappers) as tokens for locally registered users. Adjust Keycloak client scopes or token mappers if needed. Test auth-service Integration: Verify that the /auth (forward auth) endpoint correctly validates tokens for SSO users. Verify that the /verify endpoint works correctly for SSO users. Confirm that the user metadata injection (e.g., X-User-Email, X-User-Groups) correctly extracts and injects information for SSO users based on the mapped attributes. Review Account Linking: Examine Keycloak's default behavior ("First Broker Login" flow) when an SSO login uses an email that might already exist as a local account (or vice versa). Decide if the default linking strategy is acceptable or if customization is needed (e.g., prompting the user). Verify Group/Permission Compatibility: Test adding SSO-authenticated users to Keycloak groups (representing tenants/organizations). Ensure downstream services relying on injected headers (like X-User-Groups) for permission checks behave correctly when the user has logged in via SSO. Documentation: Document any findings or necessary configuration adjustments related to handling SSO users within the Clevermicro system. Deliverables: Confirmation that the auth-service and downstream services handle SSO-authenticated users consistently regarding token validation, metadata injection, and group memberships. Potentially updated Keycloak Identity Provider mapper configurations. Documentation of any specific considerations for SSO users within the Clevermicro system.

Rows
Columns