Integrating Control Center with Okta OpenID Authentication Server

Senior Software Engineer

This tutorial walks you through the process of integrating Control Center with Okta OpenID. OpenID is an open-standard, decentralized authentication protocol. It enables users to authenticate to collaborating sites that use third-party services. Thus, it eliminates the need for webmasters to provide their own login systems and enables users to log in to multiple unrelated websites without providing a unique identifier and password for each site. GridGain Control Center supports this mechanism. Control Center can be configured to use third-party authentication servers such as Google and Okta. We chose Okta for this tutorial because Okta provides a development environment that is free and can be used for testing.

OpenID Authentication Cluster Configuration

First, create your own free development account:

Navigate to https://developer.okta.com/signup/
Complete the form
Verify that you are not a robot
Click SIGN UP

After logging in to the developer UI portal, create an authentication server:

Navigate to the Security menu
Select the API tab
Select Add Authorization Server
Specify a name, audience, and description for the server

After you create the server, you must create at least one access policy. If there is no access policy, all user login attempts fail. For this test, you can use the default policy, as shown below:

For other parts of the configuration, you can also use the defaults. Then, navigate to the Settings tab and click the Metadata URI link to get authentication cluster metadata.

Use the metadata later, to configure Control Center. The following is a metadata output example:

Now, create the OpenID application that is used to authenticate Control Center:

Navigate to the Applications menu
Select the Applications tab
Click Add Application
Click Create New App
In the Add Application box, select Native app
Be sure that the sign on method is OpenID Connect
Click Create
Optional: Set the application name and application logo
Set the following line to redirect URL field where you must set the Control Center host and port: http://[Control Center host]:[Control Center port]/api/v1/oauth2/login/okta
In the Client Credentials screen, for the Client authentication field, select Use Client Authentication
Copy the Client ID and Client secret values, because they will be used for Control Center configuration
Navigate to the Directory menu
Open the People tab
Click Add person to create a new user
Open your newly created application settings and edit the Assignments list to identify the people and groups who can access the Control Center UI:

You are now ready to use OpenID authentication to log in to Control Center.

Control Center Configuration

Now, configure Control Center:

Download and unzip the Control Center binaries.

Move to the root folder of the unzipped directory and create an application.yaml file:

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: ****************************
            client-secret: *****************************
        provider:
          okta:
            authorization-uri: https://dev-56993928.okta.com/oauth2/ausakcamyQ0beMG3H5d6/v1/authorize
            token-uri: https://dev-56993928.okta.com/oauth2/ausakcamyQ0beMG3H5d6/v1/token
            jwk-set-uri: https://dev-56993928.okta.com/oauth2/ausakcamyQ0beMG3H5d6/v1/keys

Find Okta client id and client-secret in the settings of the Okta application that you created recently. Find authorization-uri, token-uri, and jwk-set-uri in the metadata that you obtained earlier.

Start Control Center by using the control-center.sh script
Navigate to the Control Center UI and click the SIGN IN button:
Verify that you are logged off of the Okta developer portal
In the box that is outlined in red, click the circle to display the Okta login page:
In the login box, type in your Okta credentials and click Sign In

Now, you are logged in to Okta:

© 2022 GridGain Systems, Inc. All Rights Reserved. Privacy Policy | Legal Notices. GridGain® is a registered trademark of GridGain Systems, Inc.
Apache, Apache Ignite, the Apache feather and the Apache Ignite logo are either registered trademarks or trademarks of The Apache Software Foundation.

Last updated on Jul 18, 2022