具有SAML，Keycloak和Nextcloud的SSO [英] SSO with SAML, Keycloak and Nextcloud

查看：542
本文介绍了具有SAML，Keycloak和Nextcloud的SSO的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我正在尝试将Keycloak设置为IdP(身份提供商)并将Nextcloud设置为服务.我想设置Keycloak以显示SSO(单点登录)页面.

I am trying to setup Keycloak as a IdP (Identity Provider) and Nextcloud as a service. I want to setup Keycloak as to present a SSO (single-sign-on) page.

我正在运行具有Intel兼容CPU的Linux服务器.什么是正确的配置?

I am running a Linux-Server with a Intel compatible CPU. What is the correct configuration?

  • Keycloak will be running as https://kc.domain.com
  • Nextcloud will be running as https://nc.domain.com

推荐答案

前提条件

要使用此答案，您需要将domain.com替换为您拥有的实际域.另外，将email@domain.com替换为您的工作电子邮件地址.

Prerequisite

To use this answer you will need to replace domain.com with a actual domain you own. Also replace email@domain.com with your working e-mail address.

假定您已安装并正在运行docker和docker-compose.

It is assumed you have docker and docker-compose installed and running.

除了使用keycloak和nextcloud之外，我还使用:

In addition to keycloak and nextcloud I use:

  • nginx 作为反向代理
  • letsencyrpt 生成子域的SSL证书.
  • nginx as a reverse-proxy
  • letsencyrpt to generate the SSL-certificates for the sub-domains.

我正在使用docker和docker-compose设置所有必需的服务. docker-compose.yml的外观如下:

I'm setting up all the needed service with docker and docker-compose. This is how the docker-compose.yml looks like this:

version: '2'

  nginx-proxy:
    image: jwilder/nginx-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/etc/nginx/vhost.d"
      - "./proxy-default.conf:/etc/nginx/conf.d/my-proxy.default.conf:ro"
      - "/usr/share/nginx/html"
      - "/var/run/docker.sock:/tmp/docker.sock:ro"
      - "./le-cert:/etc/nginx/certs:ro"
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"

  letsencrypt-nginx-proxy-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: unless-stopped
    depends_on:
      - nginx-proxy
    container_name: le-proxy-companion
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./le-cert:/etc/nginx/certs:rw"
    volumes_from:
      - nginx-proxy

  keycloak:
    image: jboss/keycloak
    links:
      - keycloak-postgres:postgres
    ports:
      - 8080:8080
    volumes:
      - ./keycloak:/opt/jboss/keycloak
    environment:
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
      - "PROXY_ADDRESS_FORWARDING=true"
      - VIRTUAL_PORT=8080
      - VIRTUAL_HOST=kc.domain.com
      - LETSENCRYPT_HOST=kc.domain.com
      - LETSENCRYPT_EMAIL=email@domain.com

  keycloak-postgres:
    image: postgres
    environment:
      - POSTGRES_DB=keycloak
      - POSTGRES_USER=keycloak
      - POSTGRES_PASSWORD=keycloak

  nextcloud:
    image: hoellen/nextcloud
    environment:
      - UPLOAD_MAX_SIZE=10G
      - APC_SHM_SIZE=128M
      - OPCACHE_MEM_SIZE=128
      - CRON_PERIOD=15m
      - TZ=Europe/Berlin
      - DOMAIN=nc.domain.com
      - ADMIN_USER=admin
      - ADMIN_PASSWORD=admin
      - DB_TYPE=mysql
      - DB_NAME=nextcloud
      - DB_USER=nextcloud
      - DB_PASSWORD=nextcloud
      - DB_HOST=nc-db
    volumes:
      - ./nc/nc-data:/data
      - ./nc/nc-config:/config
      - ./nc/nc-apps:/apps2
      - ./nc/nc-themes:/nextcloud/themes
    environment:
      - VIRTUAL_HOST=nc.domain.com
      - LETSENCRYPT_HOST=nc.domain.com
      - LETSENCRYPT_EMAIL=email@domain.com

  nc-db:
    image: mariadb
    volumes:
      - ./nc/nc-db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=nextcloud
      - MYSQL_PASSWORD=nextcloud
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

我将docker-files放在文件夹docker中，在该文件夹中有一个项目特定的文件夹.在这里keycloak.使用以下方法创建它们:

I put my docker-files in a folder docker and within this folder a project-specific folder. Here keycloak. Create them with:

mkdir -p ~/docker/keycloak

使用首选编辑器在此文件夹中创建docker-compose.yml-文件.通过以下方式启动服务:

Create the docker-compose.yml-File with your preferred editor in this folder. Start the services with:

cd ~/docker/keycloak
docker-compose up -d

请稍等片刻，让服务下载并启动.检查是否一切都在运行:

Wait a moment to let the services download and start. Check if everything is running with:

docker-compose ps

如果服务未运行.发出第二个docker-compose up -d并再次检查.

If a service isn't running. Issue a second docker-compose up -d and check again.

打开浏览器，然后转到 https://kc.domain.com .点击管理控制台.按照docker-compose.yml中的指定，用户名和密码为admin.

Open a browser and go to https://kc.domain.com . Click on Administration Console. As specified in your docker-compose.yml, Username and Password is admin.

在页面的左上角，您需要创建一个新的 Realm .单击Add.输入 my-realm 作为名称.点击Save.

On the top-left of the page you need to create a new Realm. Click Add. Enter my-realm as name. Click Save.

单击Keys-选项卡.查看RSA条目.我们将需要复制该行的证书.单击Certificate，然后将内容复制粘贴到文本编辑器中，以备后用.

Click on the Keys-tab. Look at the RSA-entry. We will need to copy the Certificate of that line. Click on Certificate and copy-paste the content to a text editor for later use.

打开终端并发出:

openssl req  -nodes -new -x509  -keyout private.key -out public.cert

这将创建两个文件:private.key和public.cert，稍后我们将需要它们用于nextcloud服务.

This creates two files: private.key and public.cert which we will need later for the nextcloud service.

打开浏览器，然后转到 https://nc.domain.com .按照docker-compose.yml中的指定，用户名和密码为admin.

Open a browser and go to https://nc.domain.com . As specified in your docker-compose.yml, Username and Password is admin.

您需要激活默认情况下禁用的SSO & Saml Authenticate.

You need to activate the SSO & Saml Authenticate which is disabled by default.

重要从此处开始，在测试通过并运行设置之前，不要关闭当前的浏览器窗口.如果您在一切正常之前关闭浏览器，则可能无法再在nextcloud中更改设置.在这种情况下，您将需要停止nextcloud-和nextcloud-db-container，删除它们各自的文件夹，重新创建它们，然后重新开始.

Important From here on don't close your current browser window until the setup is tested and running. If you close the browser before everything works you probably not be able to change your settings in nextcloud anymore. In such a case you will need to stop the nextcloud- and nextcloud-db-container, delete their respective folders, recreate them and start all over again.

单击右上角的齿轮符号，然后单击+ Apps-符号.现在在左侧看到带有条目Security的菜单栏.点击它.现在，您将看到所有已实现安全性的应用程序.单击SSO & SAML authentication应用程序下方的Activate按钮.

Click on top-right gear-symbol and the then on the + Apps-sign. On the left now see a Menu-bar with the entry Security. Click it. You now see all security realted apps. Click on the Activate button below the SSO & SAML authentication App.

再次单击右上角的齿轮符号，然后单击Admin.点击SSO & SAML authentication.

Click on top-right gear-symbol again and click on Admin. Click on SSO & SAML authentication.

使用以下值:

查看全文
相关文章
其他开发最新文章
热门教程
热门工具
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆