What are the Slack Archives?

It’s a history of our time together in the Slack Community! There’s a ton of knowledge in here, so feel free to search through the archives for a possible answer to your question.

Because this space is not active, you won’t be able to create a new post or comment here. If you have a question or want to start a discussion about something, head over to our categories and pick one to post in! You can always refer back to a post from Slack Archives if needed; just copy the link to use it as a reference..

Hi, I'm trying to configure Spryker to use our own oauth server (keycloak). I could not find any doc

UPDV9V3ST
UPDV9V3ST Posts: 21 🧑🏻‍🚀 - Cadet
edited January 2020 in Help

Hi,
I'm trying to configure Spryker to use our own oauth server (keycloak). I could not find any documentation on this issue. Has anyone done this before and can give me a hint?

Thanks a lot
Matthias

Comments

  • UKHD8KTMF
    UKHD8KTMF Posts: 393 🧑🏻‍🚀 - Cadet

    Hi Matthias can you describe what exactly is the use case? Are you getting user identity from external server?

  • UPDV9V3ST
    UPDV9V3ST Posts: 21 🧑🏻‍🚀 - Cadet

    Yes, we already have a keycloak server for handling identities.

  • UKHD8KTMF
    UKHD8KTMF Posts: 393 🧑🏻‍🚀 - Cadet

    Are you performing authentication or authorization or both? Or in simple words are you just checking identity while user data is still in Spryker?

  • UKHD8KTMF
    UKHD8KTMF Posts: 393 🧑🏻‍🚀 - Cadet

    What is your starting point? (How old is the project?)

  • UPDV9V3ST
    UPDV9V3ST Posts: 21 🧑🏻‍🚀 - Cadet

    User data would stay in Spryker. Project just started,

  • USZB5JN4W
    USZB5JN4W Posts: 112 🧑🏻‍🚀 - Cadet

    Hi,
    I did SSO with keycloak in Spryker. I’m not sure if this will work with newest Spryker, but I did it using Symfony’s Guard Authenticator.
    In version which I was using, Spryker used Silex authentication which is taken from Symfony, but I had to register GuardAuthenticationProvider, because it was not configured by default.

    Btw if you want to use Keycloak’s backchannel to log out users, take care of client_session_state parameter during logging in.

    If you need more help - write ;)

  • UPDV9V3ST
    UPDV9V3ST Posts: 21 🧑🏻‍🚀 - Cadet

    Sounds interesting. Can you elaborate a bit on that? How did you register GuardAuthenticationProvider? And how (and where) is the communication with keycloak working?

  • USZB5JN4W
    USZB5JN4W Posts: 112 🧑🏻‍🚀 - Cadet

    to register GuardAuthenticationProvider I created ServiceProvider which is registered in YvesBootstrap.
    In this custom Service provider, I added function to $app['security.authentication_listener.factory.guard'], which registers Guard classes:
    GuardAuthenticationProvider to $app['security.authentication_provider.' . $name . '.guard']
    and
    GuardAuthenticationListener to $app['security.authentication_listener.' . $name . '.guard']

    Rest of registration code is similar to registering default authenticators in Spryker (check Spryker code code)

    I also added fake routes there (also similar to core)

    After this I created another custom ServiceProvider to register SsoGuardAuthenticator to Guard system (you can check how agent authenticator is configured)

    communication with Keycloak is mostly in SsoGuardAuthenticator - it’s almost same as in Symfony - https://symfony.com/doc/current/security/guard_authentication.html

  • UKHD8KTMF
    UKHD8KTMF Posts: 393 🧑🏻‍🚀 - Cadet

    Ancient Spryker -> you have to write your own security provider
    Less ancient Spryker -> you can implement guard interface
    Recent Spryker -> you need to do a Security plugin

  • UPDV9V3ST
    UPDV9V3ST Posts: 21 🧑🏻‍🚀 - Cadet

    We have a recent Spryker. Is there a sample on how to write a Security Plugin?

  • UKHD8KTMF
    UKHD8KTMF Posts: 393 🧑🏻‍🚀 - Cadet

    You can take a look at existing ones: RememberMeSecurityPlugin, AgentPageSecurityPlugin, AgentPageSecurityPlugin

Categories