Stack Overflow
Stack Overflow

Questions tagged [fiware-keyrock]

FIWARE Keyrock is the reference implementation of the Identity Manager (IdM) Generic Enabler specification. It is based on Openstack Horizon and Keystone.

Keyrock is responsible for authentication and authorization processes, together with PEP Proxy. An application or a user, that wants to access a protected service, authenticates with Keyrock IdM and gets an OAuth2 token. With this token, the application/user requests something to the protected service, reaching the PEP Proxy. The PEP Proxy gets the received token and validates it with Keyrock IdM. Once the token is valid, the application/user gets successful access to the protected service; otherwise, the access is denied.

Currently, the main concepts of Keyrock are:

  • Users
    • Have a registered account in Keyrock.
    • Can manage organizations and register applications.
  • Organizations
    • Are group of users that share resources of an application (roles and permissions).
    • Users can be members or owners (manage the organization).
  • Applications
    • It has the client role in the OAuth 2.0 architecture and will request protected user data. More information can be found in OAuth section.
    • Are able to authenticate users using their Oauth credentials (id and secret) which unequivocally identify the application.
    • Define roles and permissions to manage authorization of users and organizations.
    • Can register Pep Proxy to protect backends.
    • Can register IoT Agents.

More information: https://fiware-idm.readthedocs.io/en/latest/

35 questions
0
votes
1 answer

Keyrock doesn't recognize super-admin user

I'm making a project for a course in uni. I'm running a keyrock container in docker and I use a .http file to make direct request for X-Auth-Token with the default super-admin user. The request: ###get X-Auth-Token directly in keyrock GET…
Νικόλας Καστρινάκης
  • 5
  • 2
0
votes
1 answer

Calling external APIs through fiware orion context broker to validate using keyrock

I am a student working on a project and exploring viability of using fiware for that. So far I've learnt that to call external APIs we can use registrations for an entity to fetch dynamic data. Here is the situation: In my project, I am calling…
Mahi
  • 1,164
  • 17
  • 24
0
votes
0 answers

Getting user's organizations from Keyrock

I'm looking for a way to get organizations of a user logged in using Keyrock's OAuth2. I have Keyrock set up using docker-compose. I've created an organization and assigned users to it, using API. But, when a user logs in, both the JWT token and the…
amroz
  • 41
  • 1
  • 7
0
votes
1 answer

Orion APIs authorization through Keycloak

After testing authentication in Orion with keycloak (Orion APIs authentication through Keycloak) with kong-pep-plugin, I'm interested in the authorization too; in particular, I want to give specific permissions (on path and verb) to users/groups…
pasquy73
  • 563
  • 3
  • 13
0
votes
0 answers

Control the OAuth2.0 access code lifetime for keyrock (FIWARE generic enabler) using docker-compose

I am creating a docker-compose.yml file to define the services for a system I am developing and I am using keyrock for identity management of the users of that system. Everything works as it should, however, when a login is successful, the default…
Rui Fernandes
  • 1
0
votes
1 answer

FIWARE Orion-LD access control rules by entity type

Is it possible to configure access-control rules for Orion-LD based on the entity type? Or, alternatively, on the presence of some attributes in the entities? A similar question was asked here: Get a list of all resources accessible to users in…
cnoelle
  • 56
  • 4
0
votes
1 answer

Check Request Headers using XACML in Fiware platform

I'm trying to integrate AuthzForce with Keyrock for advanced PDP and wanted to know how custom headers check rule can be made in XACML policies. As per my understanding and documentation, they've specified that with AuthzForce its possible to check…
guru
  • 3
  • 1
0
votes
1 answer

Must i register one application for every pep proxy on Keyrock Idm?

Guess that we have multiple Fiware Generic Enablers deployed in Docker. I would like to protect those services with one pep proxy for each one. Is it ok to register my app and deploy multiple pep proxies with the same credentials give by Idm…
Kostas Tsakos
  • 169
  • 10
0
votes
1 answer

Docker Swarm Keyrock Mysql subnetwork connection

IMPORTANT: I need to deploy it using Docker Swarm (no docker-compose). I have created a docker-compose file in order to deploy my FIWARE stack. That stack includes keyrock and a Mysql BD that are connected using the following subnet and assigning…
asolleiro
  • 81
  • 5
0
votes
1 answer

Docker-compose keyrock mysql subnet configuration

I have created a docker-compose file in order to deploy my FIWARE stack. That stack includes keyrock and a Mysql BD that are connected using the following subnet: networks: default: ipam: config: - subnet:…
asolleiro
  • 81
  • 5
0
votes
1 answer

DELETE request for organizations does not require auth token

I've noticed when you are about to delete an organization the suggested request in docu is this one (subsection DELETE AN ORGANIZATION inside ORGANIZATION CRUD ACTIONS): curl -iX DELETE \ …
jfernandz
  • 185
  • 1
  • 10
0
votes
1 answer

Curl request for implicit grant type on fiware keyrock?

I wanted to fire a curl request for implicit grant type on fiware idm. I have gone through the official docs of fiware idm- https://fiware-idm.readthedocs.io/en/latest/oauth/oauth_documentation/index.html Implicit grant type exists in fiware idm,…
Swati
  • 1
  • 1
0
votes
1 answer

How can I give permissions based on entity type?

I'm trying to set permissions based on the types of entities Orion is going to save. As the permissions are associated to "endpoints" I had tried to set as endpoint /entities?type=Truck (for example). The problem is that it tells me (Keyrock through…
Cristina V
  • 117
  • 7
0
votes
1 answer

Unable to Integrate keyrock with nginx, css and js files not loading

I wanted to access keyrock idm using nginx reverse proxy. But while doing so, nginx is unable to load the css and js files. location /idm/{ proxy_pass https://keyrock-host:keyrock-port/; proxy_set_header X-Forwarded-Host …
Timshrok
  • 97
  • 1
  • 1
  • 12
0
votes
1 answer

Single Sign on Keyrock-Grafana doesn't work

I'm trying to use Keyrock to offer Single Sign-on on different platforms. Specifically, I want to offer that service in Grafana. I've seen the configuration to be changed in Grafana and my docker-compose is like this: version: "3.1" services: …
Cristina V
  • 117
  • 7
1
2
3