Refresh Keycloak OpenID Howto for latest Keycloak

Going back through the Howto, many of the Keycloak admin UI screens
have changed layout and prompts, making the guide less
straightforward to follow. Update it to match Keycloak 23 (latest at
time of writing).

It also appears that pyJWT 2.5.0 fixed the bug which caused it to
break on encountering unsupported keys, so the noted step for
disabling rsa-enc-generated should no longer be necessary (this has
also become somewhat harder to do in more recent Keycloak versions).

Newer Keycloak seems to get confused by trailing slashes on origins,
which causes problems for its CORS headers, so fix it and add a
parenthetical note as a reminder.

Change-Id: I585439d4718fafd7075a3ed31ebcd10139dc355a

doc/source/examples/keycloak/keycloak/zuul-demo-data.json

@@ -1317,7 +1317,6 @@
         "certificate" : [ "MIICoTCCAYkCBgGCJXQ99zANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAl6dXVsLWRlbW8wHhcNMjIwNzIyMTAyNzMxWhcNMzIwNzIyMTAyOTExWjAUMRIwEAYDVQQDDAl6dXVsLWRlbW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCNdTxTgnMOPbPn4v+QC4FkZrIGerBuxFpp+RBwN/Y7O2kRqo9m30ptC0rvH156/hWRd6lGXoWE2B+pN/CUtZ30JBmXl1eApcL/2RmjhaE2Ip9GkV19wVlNQsolZE6A913HynPe3D3JTjBkOsADnAajqoL2/tAy7gD8BFOkaOXmBGcQUOzAz064cap3ugDEKySfRc9Vs5VwBuzYo8HuM2inK4axSmjHe7G/v2wCMQxjrhj8Nr2WQFkGkKSHy/eFm0YBBO8Z/hVkvHx7TRTUGsqia4m4Ey9oIGufIUcYalXEX9/igUFxVVx4k7Ehqa5btkSlY/e4sypmGzk3TaMoQewzAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFIjuy2Aac1Y5jggKdRwZ8Xlg8S4B7RxmvNg15G8DX1m1PaAcb6aZ6lwDp78aEMxlpihn/G5mJ2MEmFL9Y95lJlCXlB0pHSGf4+vKJ6ZgZ9IUdP6tKyLsnCY+wR2Ag4444Upwd4yJGj3QBAArrdIezTOpEoPUn51j8KDJUXJXRkeJFE4Kgl5S3TmCGwvpCJQYfLjj9Lw60Evepi9fjaTjQxp16aDNHDvB/d+7VnJoZnj2ruU/N93FUaUgv4W2AAjcJj+9le8MGTIWLXezhCOgdDYRBMxTiBAwV+BbktXdQZiDvYyJp8tCxp0w9K3WNRgEX+2jS94+yYWMxKVVlHmtWA=" ],
         "active" : [ "false" ],
         "priority" : [ "100" ],
-        "enabled" : [ "false" ],
         "algorithm" : [ "RSA-OAEP" ]
       }
     }, {
@@ -1924,4 +1923,4 @@
   "clientPolicies" : {
     "policies" : [ ]
   }
-}
+}

doc/source/howtos/openid-with-keycloak.rst

@@ -1,8 +1,10 @@
 Configuring Keycloak Authentication
 ===================================
 
-This document explains how to configure Zuul and Keycloak in order to enable
-authentication in Zuul with Keycloak.
+This document explains how to configure Zuul and Keycloak in order to
+enable authentication in Zuul with Keycloak. It's written with Keycloak 23
+in mind, but should probably work for other versions with only minor
+adjustments.
 
 Prerequisites
 -------------
@@ -28,14 +30,28 @@ Create a client
 Choose the realm ``my_realm``, then click ``clients`` in the Configure panel.
 Click ``Create``.
 
-Name your client as you please. We will pick ``zuul`` for this example. Make sure
-to fill the following fields:
+Give your client whatever ID you please; we will pick ``zuul`` for this
+example. Also this example assumes your Zuul WebUI is served from a host
+referred to as zuul.example.org in DNS. Make sure to fill the following fields:
 
-* Client Protocol: ``openid-connect``
-* Access Type: ``public``
-* Implicit Flow Enabled: ``ON``
-* Valid Redirect URIs: ``https://zuul/*``
-* Web Origins: ``https://zuul/``
+* General settings (page 1):
+
+  * Client type: ``OpenID Connect`` (default)
+  * Client ID: ``zuul`` (or whatever else you want)
+
+* Capability config (page 2):
+
+  * Client authentication: ``Off`` (default)
+  * Authentication flow:
+
+    * Standard flow: ``On`` (default)
+    * Direct access grants: ``On`` (default)
+    * Implicit flow: ``On``
+
+* Login settings (page 3):
+
+  * Valid redirect URIs: ``https://zuul.example.org/*``
+  * Web origins: ``https://zuul.example.org`` (no trailing ``/`` here)
 
 Click "Save" when done.
 
@@ -52,39 +68,31 @@ Click ``Create``.
 Name your scope as you please. We will name it ``zuul_aud`` for this example.
 Make sure you fill the following fields:
 
-* Protocol: ``openid-connect``
-* Include in Token Scope: ``ON``
+* Name: ``zuul_aud``
+* Protocol: ``OpenID Connect`` (default)
+* Include in Token Scope: ``On`` (default)
 
 Click "Save" when done.
 
 On the Client Scopes page, click on ``zuul_aud`` to configure it; click on
-``Mappers`` then ``create``.
+``Mappers`` then ``Configure a new mapper`` and select ``Audience`` from the
+list it presents.
 
-Make sure to fill the following:
+On the resulting form, name the mapper whatever you want (our example will use
+``zuul_map``), and make sure to fill the following:
 
-* Mapper Type: ``Audience``
-* Included Client Audience: ``zuul``
-* Add to ID token: ``ON``
-* Add to access token: ``ON``
+* Name: ``zuul_map``
+* Included client audience: ``zuul``
+* Add to ID token: ``On``
+* Add to access token: ``On`` (default)
 
 Then save.
 
-Finally, go back to the clients list and pick the ``zuul`` client again. Click
-on ``Client Scopes``, and add the ``zuul_aud`` scope to the ``Assigned Default
-Client Scopes``.
-
-Configuring JWT signing algorithms
-..................................
-
-.. note::
-
-  Skip this step if you are using a keycloak version prior to 18.0.
-
-Due to current limitations with the pyJWT library, Zuul does not support every default
-signing algorithm used by Keycloak.
-
-Go to `my_realm->Settings->Keys`, then choose `rsa-enc-generated` (this should be mapped
-to "RSA-OAEP") if available. Then set `enabled` to false and save your changes.
+Finally, go back to the clients list and pick the ``zuul`` client again.
+Click on ``Client scopes`` and click the ``Add client scope`` button. Pick
+the checkbox next to the ``zuul_aud`` scope you created and click the
+``Add`` button choosing the ``Default`` option from the list that
+subsequently pops up.
 
 (Optional) Set up a social identity provider
 ............................................

requirements.txt

@@ -23,7 +23,7 @@ alembic
 cryptography>=39.0.0
 cachecontrol<0.12.7
 cachetools
-pyjwt>=2.0.0
+pyjwt>=2.5.0
 iso8601
 psutil
 google-re2>=1.1