Custom Realm and shiro.ini

[Roger Parkinson]

Hi there,

I'm trying to implement a custom realm for Shiro so that I can use KeyCloak as my user store. I've cloned the Okta code and adjusted it. It works under unit test so now I'm up to testing it under KillBill.

First problem is that I've found my changes to shiro.ini have no effect. I added this:

[main]

myRealm = nz.co.billrush.KeyCloakCustomRealm

securityManager.realms = $myRealm 

credentialsMatcher = org.killbill.billing.util.security.shiro.KillbillCredentialsMatcher

myRealm.credentialsMatcher = $credentialsMatcher

I copied my shiro.ini into an extended image using

COPY --chown=tomcat:tomcat target/config/shiro.ini /var/lib/killbill

but it has no effect. It doesn't try loading my custom realm.

So I tried changing the admin password (should have tried that before now :)) and that doesn't change either. I can see the file when I attach to the running docker image and it is my file, it just isn't being used.

While I'm here I should say I'm also copying tmy jar file to /var/lib/tomcat/lib and, again, it lands there okay. I can't see if it's working yet because of the above problem, but is this the right localtion?

Thanks

Roger

[Roger Parkinson]

In addition to the copy I set KILLBILL_SECURITY_SHIRO_RESOURCE_PATH=file:/var/lib/killbill/shiro.ini
I thought that was the default is actually classpath:shiro.ini. Anyway that solved locating the shiro.ini

But I still have the second question: how do I copy my files into the image so that tomcat picks them up. I don't want to build the image from scratch because then I have a maintenance headache.

Is there a known trick to doing this?

Thanks

[Pierre-Alexandre Meyer]

Hi Roger,

You would need to tweak the image, either by exploding the war manually (put the jar in WEB-INF/lib) and/or by adding a custom Ansible playbook.

Alternatively, if the implementation is lightweight, we could consider adding it into the core (in which case, feel free to open a PR and we can move the discussion over to GitHub).

Cheers,

--
You received this message because you are subscribed to the Google Groups "Kill Bill users mailing-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to killbilling-us...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/killbilling-users/ac30cbea-6839-457a-91a0-52be565c8a2an%40googlegroups.com.

--

Pierre

[a...@caravelo.com]

Hello all,

sorry for reviving this thread, but I think it is something interesting. I see that now Kill Bill offers integrations with Okta and Auth0, so I'm wondering if there is a specific reason for implementing those integration as separate, instead of just implementing a plain OpenId Connect one, which would cover all those providers (including Keycloak).

Regards

--

Alessio Gaeta

[step...@kill-bill.org]

Thanks for pointing that out, we have not looked into too much details at OpenId Connect, perhaps this is indeed a good path forward.

[Jacob Spizziri]

Hi all,

I'm late to the party too. However, I'm super interested in KillBill but would really need OpenID Connect support before being able to integrate it with our existing stack. Are there any further thoughts on this? Feasibility, architecture, etc? I'm only about 4hrs into reading the KillBill docs so I'm not proficient enough in the arch at this point to make any sort of assessment. In general, I think standardized SSO support would be a great feature to have in KillBill, and OIDC is a great standard to do that with.

[Pierre-Alexandre Meyer]

Hi Jacob,

Agreed, this sounds like a great addition. From an architecture perspective, I can't think of any red flag. We've just never had the time/resources to focus on it (most of our Enterprise users rely on Auth0 or tools like oauth2-proxy/JWT).

To view this discussion on the web visit https://groups.google.com/d/msgid/killbilling-users/1a62865f-ea59-4c95-a536-10ae5ad343e7n%40googlegroups.com.

--

Pierre

[sh...@methodmaker.co.nz]

Hi Pierre,

The Bill Rush team could help with the OIDC SSO keycloak work if it would help. 

Rgs

Shaun

[Rogelio Delgado]

Hello to all!

Is there any update or news on this topic? I'm interested in the Keycloack / OpenID connect support.

[Ahmed Elwan]

Hi all,

Any updates about OpenID Connect support?