Authentication

Prerequisites

• A domain name must be configured for the Portal service to use SSO authentication. Identify the domain to be used for the Portal.
• Identify the tenant_id for the Azure tenant.
• Ensure the Azure CLI is installed on a local machine and sign in using az login.
• Run the provided shell script to create three app registrations and corresponding enterprise applications. Record the script output, as it is required for subsequent steps.
  • cdrplatform-api-access
  • cdrplatform-portal-access
  • cdrplatform-portal-client

bash create-azure-app-registrations.sh cleanroom.glasswall.com

• The enterprise application ar-Halo-portal-client needs to be granted admin consent.

Portal authentication installation

The Glasswall Halo Portal supports SSO authentication using Azure Entra ID. Follow the steps below to configure the integration.

1. SSH into the virtual machine to run the commands below.

2. The cdrplatform-portal and cdrplatform-portal-access Helm charts are located in the /home/glasswall directory.

k get deploy portal  -o json | jq -r '.spec.template.spec.containers[0].image' | cut ->d":" -f2

3. Deploy portal with Azure AD configuration:

tenant_id=""
portal_domain=""
portal_client_id=""
portal_access_uri=""
image_tag=$(kubectl get deploy portal  -o json | jq -r '.spec.template.spec.containers[0].image' | cut -d":" -f2)
enabled_pages="SystemSettings,PolicySettings"
# if XML validation entitlement is enabled
enabled_pages="SystemSettings,PolicySettings,ValidationSettings"
# if ICAP server is enabled
enabled_pages="SystemSettings,PolicySettings,IcapSettings,IcapRequests,IcapReporting"
# if Storage monitoring is enabled
enabled_pages="SystemSettings,PolicySettings,IcapSettings,IcapRequests,IcapReporting,SharePointMonitoring,OneDriveMonitoring"
helm upgrade --install cdrplatform-portal cdrplatform-portal \
  --set image.repository=glasswallacr.azurecr.io/cdrplatform-portal \
  --set image.tag="${image_tag:?}" \
  --set image.pullPolicy=IfNotPresent \
  --set ingress.tls.enabled=true \
  --set ingress.tls.domain=${portal_domain:?} \
  --set ingress.tls.secretName=tls-secret \
  --set cloud_provider=local \
  --set resources.requests.cpu=500m \
  --set resources.requests.memory=500Mi \
  --set resources.limits.cpu=500m \
  --set resources.limits.memory=500Mi \
  --set securityContext.seccompProfile.type=RuntimeDefault \
  --set configuration.BackendScope="${portal_access_uri}/PortalUserScope" \
  --set configuration.BackendUrl="https://${portal_domain}" \
  --set configuration.EnabledPages="${enabled_pages}" \
  --set configuration.OIDC.ProviderOptions.Authority="https://login.microsoftonline.com/${tenant_id:?}/v2.0" \
  --set configuration.OIDC.ProviderOptions.RedirectUri="https://${portal_domain}/authentication/login-callback" \
  --set configuration.OIDC.ProviderOptions.ClientId="${portal_client_id}" \
  --set configuration.OIDC.ProviderOptions.PostLogoutRedirectUri="https://${portal_domain}/authentication/logout-callback" \
  --atomic
>```

4. Deploy portal access with Azure Entra ID configuration:

>```sh
tenant_id=""
portal_domain=""
portal_access_uri=""
image_tag=$(kubectl get deploy portal-access  -o json | jq -r '.spec.template.spec.containers[0].image' | cut -d":" -f2)
helm upgrade --install cdrplatform-portal-access cdrplatform-portal-access \
  --set image.repository=glasswallacr.azurecr.io/cdrplatform-portal-access \
  --set image.tag="${image_tag:?}" \
  --set image.pullPolicy=IfNotPresent \
  --set ingress.tls.enabled=true \
  --set ingress.tls.domain=${portal_domain:?} \
  --set ingress.tls.secretName=tls-secret \
  --set cloud_provider=local \
  --set resources.requests.cpu=1 \
  --set resources.requests.memory=2Gi \
  --set resources.limits.cpu=1 \
  --set resources.limits.memory=2Gi \
  --set securityContext.seccompProfile.type=RuntimeDefault \
  --set configuration.AuthenticationScheme=Bearer \
  --set configuration.Authentication__Schemes__Bearer__ValidAudiences__0="${portal_access_uri}" \
  --set configuration.Authentication__Schemes__Bearer__ValidIssuer=https://sts.windows.net/${tenant_id:?}/ \
  --set configuration.Authentication__Schemes__Bearer__Authority=https://login.microsoftonline.com/${tenant_id:?}/v2.0/ \
  --atomic
>```

5. Open the Portal domain in a browser and select **Login with SSO** in the lower left corner.

6. Follow the login process via Azure Entra ID and grant the app required permissions on behalf of the organisation for the first time.

## API Authentication

API authentication can be configured in 2 ways -
- Basic authentication
- Bearer authentication

### Basic authentication installation

1. SSH into the virtual machine to run the commands below.
2. The `cdrplatform-api-access` Helm chart is located in the `/home/glasswall` directory.
3. Configure credentials in the cluster by setting a `username` and `password` using the commands below. Multiple passwords can be specified by separating them with commas.

>```sh
>bash add_secrets.sh organisation0-id <username>
>bash add_secrets.sh organisation0-tokens <password>
>```

4. Deploy api-access with Basic authentication:

>```sh
image_tag="$(k get deploy api-access  -o json | jq -r '.spec.template.spec.containers[0].image' | cut -d":" -f2)"
enable_tls="true" or "false"
api_domain="" # ignore if enable_tls is false
helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
  --set image.tag="${image_tag:?}" \
  --set image.pullPolicy=IfNotPresent \
  --set image.repository="glasswallacr.azurecr.io/cdrplatform-api-access" \
  --set ingress.tls.enabled="${enable_tls:?}" \
  --set ingress.tls.domain="${api_domain}" \
  --set configuration.CLIENTS__Policy__BaseAddress="http://policy-api:8080" \
  --set configuration.CLIENTS__License__BaseAddress="http://license-management.license-management.svc.cluster.local:8080" \
  --set configuration.CLIENTS__AsyncApi__BaseAddress="http://async-api:8080" \
  --set configuration.AuthenticationScheme="Basic" \
  --set cloud_provider=local \
  --set resources.requests.cpu=1 \
  --set resources.requests.memory=3Gi \
  --set resources.limits.cpu=1 \
  --set resources.limits.memory=3Gi \
  --set securityContext.seccompProfile.type=RuntimeDefault \
  --atomic
>```

### Bearer authentication installation

1. Identify the `tenant_id` for the Azure tenant.
2. SSH into the virtual machine to run the commands below.
3. Ensure the `cdrplatform-api-access` Helm chart is available in the `/home/glasswall` directory.
4. Deploy the API Access service with Azure Entra ID configuration:

>```sh
tenant_id=""
api_valid_audience="api://cdrplatform-api-access"
image_tag=$(kubectl get deploy api-access  -o json | jq -r '.spec.template.spec.containers[0].image' | cut -d":" -f2)
enable_tls="true" or "false"
api_domain="" # ignore if enable_tls is false
helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
  --set image.tag="${image_tag}" \
  --set image.pullPolicy=IfNotPresent \
  --set image.repository="glasswallacr.azurecr.io/cdrplatform-api-access" \
  --set ingress.tls.enabled="${enable_tls}" \
  --set ingress.tls.domain="${api_domain}" \
  --set configuration.CLIENTS__Policy__BaseAddress="http://policy-api:8080" \
  --set configuration.CLIENTS__License__BaseAddress="http://license-management.license-management.svc.cluster.local:8080" \
  --set configuration.CLIENTS__AsyncApi__BaseAddress="http://async-api:8080" \
  --set configuration.AuthenticationScheme="Bearer" \
  --set configuration.Authentication__Schemes__Bearer__ValidAudiences__0="${api_valid_audience}" \
  --set configuration.Authentication__Schemes__Bearer__ValidIssuer=https://sts.windows.net/${tenant_id:?}/ \
  --set configuration.Authentication__Schemes__Bearer__Authority=https://login.microsoftonline.com/${tenant_id:?}/v2.0/ \
  --set cloud_provider=local \
  --set resources.requests.cpu=1 \
  --set resources.requests.memory=3Gi \
  --set resources.limits.cpu=1 \
  --set resources.limits.memory=3Gi \
  --set securityContext.seccompProfile.type=RuntimeDefault \
  --atomic
>```