SSO Support for Imported Frameworks

Describes SSO support for imported frameworks integrated with native authentication and applications configured with authentication proxy.

Native Authentication Integrated Applications

Add the placeholders like %%OIDC_ISSUER%% and %%LDAP_XXXX%% in values.yaml file. HPE Ezmeral Unified Analytics Software automatically susbtitutes these placeholders with suitable values.

Authentication Proxy Configured Applications

Configure SSO with AuthorizationPolicy:

  1. Configure the istio security AuthorizationPolicy before importing the application.

    Example of AuthorizationPolicy: 
    apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .Release.Name }}-auth-policy
  namespace: {{ .Values.ezua.authorizationPolicy.namespace }}
spec:
  action: CUSTOM
  provider:
    name: {{ .Values.ezua.authorizationPolicy.providerName }}
  rules:
    - to:
        - operation:
            hosts:
            - {{ .Values.ezua.virtualService.endpoint }}
  selector:
    {{- with .Values.ezua.authorizationPolicy.matchLabels }}
    matchLabels:
      {{- toYaml . | nindent 6 }}
    {{- end }}
  2. Configure the values.yaml file of your application chart as follows:
    ezua:
  oidc:
    client_id: "${OIDC_CLIENT_ID}"
    client_secret: "${OIDC_CLIENT_SECRET}"
    domain: "${OIDC_DOMAIN}"
    
  domainName: "${DOMAIN_NAME}"
  #Use next options in order to configure the application endpoint.
  #Example of a VirtualService is here:
  virtualService:
    endpoint: "test-app.${DOMAIN_NAME}"
    istioGateway: "istio-system/ezaf-gateway"

  authorizationPolicy:
    namespace: "istio-system"
    providerName: "oauth2-proxy"
    matchLabels:
      istio: "ingressgateway"