danhuawang commented on code in PR #11730: URL: https://github.com/apache/gravitino/pull/11730#discussion_r3433731065
########## docs/security/how-to-authenticate.md: ########## @@ -653,3 +662,64 @@ For Gravitino Iceberg REST Service, the 'Accept: application/vnd.gravitino.v1+js ```shell curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer <access_token>" http://127.0.0.1:9001/iceberg/v1/config ``` + +### Enable Web UI OIDC login with Keycloak + +The `gravitino-client` registered above is a confidential client used for machine-to-machine flows +(client credentials and password grants). The browser Web UI cannot use a confidential client because +it cannot keep a client secret, so the Web UI OIDC login requires a separate public client. A typical +Keycloak deployment therefore uses two clients: + +| Client | Type | Used by | Keycloak settings | +|--------------------|--------------|---------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `gravitino-client` | Confidential | Engines and machine flows (CLI, connectors, service accounts) | *Client authentication* on, *Standard flow* and *Service accounts roles* enabled | +| `gravitino-ui` | Public | Browser Web UI OIDC login | *Client authentication* off, *Standard flow* enabled | + +To register the public client for the Web UI: + +* Click *Clients* in the `gravitinorealm` realm, then *Create client*. +* Fill in *Client type*: `OpenID Connect`, *Client ID*: `gravitino-ui`, then click *Next*. +* Turn *Client authentication* **off** (this makes it a public client) and enable *Standard flow*. Click *Next*. +* Set *Valid redirect URIs* to `https://your-gravitino-server/ui/oauth/callback`. +* Set *Web origins* to `https://your-gravitino-server`. +* Click *Save*. Review Comment: Set `Valid post logout redirect URIs` to `https://your-gravitino-server/*` for log out before saving. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
