Skip to main content

SSO management

Context​

For SSO (both internal and client) we use same Azure App Registration and track tenant id to understand the token origin. It works fine until we need to have a separate set of permissions for internal users for accessing dev and prod instances.

Proposed solution​

Split Empower SSO App Registration into:

  • Empower Client SSO for client sign-ins
    • Configure token to have optional groups claim with IDs
    • Keep only required by SSO permissions (delegated w/o admin consent):
      • openid
      • profile
      • email
      • User.Read
  • Empower Internal SSO for internal sign-ins
    • Configure token to have optional groups claim with IDs
    • Keep only required by SSO permissions (delegated w/o admin consent):
      • openid
      • profile
      • email
      • User.Read
    • Create App Registration roles from Django Admin json fixtures
      • name = json[*].name
      • value = json[*].id
    • Manual step Create AD Groups per project role (Dev, QA, Product, Delivery, SRE etc.)
    • Manual step Assign AD groups to required roles

👍 Pros

  • Clean client on-boarding to SSO with no consent requirements
  • Eliminates manual Django Admin password management and sharing
  • Provides sets of users can be assigned to manage Empower UI and Django Admins independently
  • SSO App Registrations will be fully owned by Terraform and have no excessive permission sets
  • Roles can be consumed directly by Django Admin w/o need of Keycloak brokering

❗️ Cons

  • Manual steps to assign roles are not well automatable
  • Changes in SSO are error prone and should be extremely well tested before releasing to production

Diagrams​

📘 Legend

  • Role structure - how Keycloak roles are constructed for Empower UI
  • Neo structure - exact Keycloak role layout and dependency on Empower SSO before these changes
  • Multi-SSO - exact Keycloak role layout and dependency on Empower Client SSO and Empower Internal SSO after these changes
  • Django Admin - sequenced interactions between components (setup and usage)

Pre-requisites​

  • Too large permission set on SSO App Registrations caused questions
  • Django Admin password sharing
  • Entire dev group has access to any instance (!)