VMware Telco Cloud Service Assurance: Configuring Specific redirect URLs in Keycloak for UI

Products

• VMware
• VMware Telco Cloud Operations

Issue/Introduction

Symptoms:
How to configure Specific redirect URLs in Keycloak for VMware Telco Cloud Service Assurance UI?

Environment

VMware Telco Cloud Operations 1.x

Cause

By default, keycloak is configured to use * as the redirect URL in VMware Telco Cloud Service Assurance.

Resolution

To defend against such security attacks, configure keycloak to specific redirect logout URLs. The admin user can update this using the keycloak console to the required specific url of the Control Plane Node / DNS name.

Steps to follow:
1) Login to keycloak admin console at the following URI as admin
https://<VMwareTelcoCloudOperations_UI>/auth
2) Select NGINX realm on the left side drop down window.
3) Under clients section repeat the following steps for "nginx" and "operational-ui" clients.
4) On the settings tab configure the "Valid Redirect URIs" field to the required IP / DNS name.

Additional Information

Impact/Risks:
For authorization code flows, when redirect URIs are registered that are too general, it would be possible for a rogue client to impersonate a different client that has a broader scope of access. This could happen for instance if two clients live under the same domain. So, it's recommended to make the registered redirect URIs as specific as feasible.