Can we configure SSO for Chef Supermarket? - Progress Community

Loading

Skip to Main Content

Can we configure SSO for Chef Supermarket?

This article addresses whether and how Single Sign-On (SSO) can be enabled for Chef Supermarket. While Supermarket itself does not have built-in SSO capabilities, it leverages the Chef Infra Server for user authentication. By configuring SSO on the Chef Infra Server, Supermarket can indirectly benefit from the centralized authentication provided by the Infra Server.

Aug 21, 2024
Knowledge

Title

Can we configure SSO for Chef Supermarket?

URL Name

Can-we-configure-SSO-for-Supermarket

Article Number

000263943

Environment

Chef Supermarket Chef Infra server Chef Automate with embedded Chef Infra server

Question/Problem Description

Can we configure SSO for Chef Supermarket?

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Enhancement Number

Cause

Resolution

Chef Supermarket does not have its SSO configuration. Instead, it relies on the Chef Infra server for user authentication, it leverages the users managed by the Chef Infra Server.

To authenticate users in Supermarket, you need to configure OAuth 2.0 via Chef Identity (oc-id) on the Chef Infra server or in Chef Automate embedded with Chef Infra server.

The Chef Infra server is set up to act as the authentication authority using OAuth 2.0. This means it manages the process of authenticating users and issuing tokens that other services (like Chef Supermarket) can use to verify a user's identity.

When users attempt to access Chef Supermarket, they are redirected to the Chef Infra server to authenticate. Once authenticated, the Chef Infra server issues an OAuth 2.0 token that the user can use to access Supermarket without needing to log in again.

Technical Configuration Notes:

Supermarket uses oc-id, a service on the Chef Infra Server, for OAuth2 authentication.
Ensure that the redirect URI in the Chef Infra Server’s oc-id configuration matches the domain name of the Supermarket instance.
Update the oc_id['applications'] section in the Chef Infra server’s configuration to reflect the correct redirect_uri for Supermarket.

Example Configuration:
On Chef Infra server, Update the /etc/opscode/chef-server.rb file:

oc_id['applications'] ||= {}
oc_id['applications']['supermarket'] = {
  'redirect_uri' => 'https://your-supermarket-domain.com/auth/chef_server/callback';
}

For environments where Chef Automate bundles the Chef-Server OC-ID component as an OAuth provider, update the file ocid-apps.toml :

[ocid.v1.sys.ocid.oauth_application_config]
    [[ocid.v1.sys.ocid.oauth_application_config.oauth_applications]]
        name = "supermarket"
        redirect_uri = "https://<YOUR SUPERMARKET FQDN>/auth/chef_oauth2/callback"

Hostname Considerations:

Ensure that the Supermarket domain matches the redirect_uri and the hostname in /etc/hosts.
Any mismatch between the Supermarket’s configured domain and the Chef Infra server’s redirect_uri can cause login issues.

For additional information, please visit below links:
https://docs.chef.io/supermarket/install_supermarket/#chef-identity
https://docs.chef.io/automate/supermarket_integration_with_automate/#register-supermarket-with-automate-embedded-chef-identity

Workaround

Notes

Keyword Phrase

Chef Supermarket SSO Integrating Chef Supermarket with Chef Infra server Integrating Chef supermarket with Chef Automate embedded with Chef Infra

Last Modified Date

8/21/2024 5:56 PM

Drop Files

Upload FilesOr drop files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

Can we configure SSO for Chef Supermarket? - Progress Community