Karaf as an Identity Provider

Apache Karaf includes a simple authentication service that is also used to access the Karaf console.

When the BPC is started for the first time (or on every startup if it does not exist), a backend Connection for Karaf as an IdP is automatically created. This Connection has the module name Karaf (default) and the ID idp_karaf.

Access to the Karaf console always occurs via the Karaf Identity Provider (IdP), regardless of the BPC configuration. Therefore, only the users.properties and keys.properties configuration of Karaf is relevant for authentication at the Karaf console.

Configuration

A new backend Connection of type “ identity_provider ” is created. The following values must be set there:

Setting (Key) Group Value Description

Setting (Key)	Group	Value	Description
Module_Name (`module_name`)	module	idp-karaf	Assign a descriptive and unique name
IdentityProvider (`identityProvider`)	config	karaf	Set Karaf as the Identity Provider

Module_Name
(module_name)

module

idp-karaf

Assign a descriptive and unique name

IdentityProvider
(identityProvider)

config

karaf

Set Karaf as the Identity Provider

Data Source (JAAS File)

User authentication and management for access to the Karaf console is handled via Java Authentication and Authorization Service (JAAS) files. These files—specifically users.properties and keys.properties —allow you to define users and specify their access permissions. Authentication can be configured using either password hashes or public/private key methods.

Using users.properties for Karaf Access

Users are managed via the file <BPC-INSTALL-DIR>/karaf/etc/users.properties.
Passwords are stored as hashes in the file in the format {CRYPT}Passwort-Hash{CRYPT}. The plaintext password cannot be reconstructed from the password hash.

To change the password, replace {CRYPT}Passwort-Hash{CRYPT} entirely with a plaintext password. Be sure to also remove the {CRYPT} elements (see also the following examples). The new password takes effect immediately after the file is saved and is then automatically replaced by a hash.

users.properties File with password hashes

bpcadmin = {CRYPT}XYZ{CRYPT},bpcadmin
virtimo = {CRYPT}XYZ{CRYPT},_g_:admingroup,bpcNoFrontend
_g_\:admingroup = group,admin,manager,viewer,systembundles,ssh

users.properties File with plaintext passwords

bpcadmin = einSehrSicheresPasswort123,bpcadmin
virtimo = einAnderesSehrSicheresPasswort123,_g_:admingroup,bpcNoFrontend
_g_\:admingroup = group,admin,manager,viewer,systembundles,ssh

If the file syntax is not followed, authentication will fail and result in a IDENTITY_PROVIDER_NOT_FOUND error.

Using keys.properties for Karaf Access

In addition to users.properties, keys.properties can also be used to authenticate users with SSH keys. This file specifies which users have access via SSH keys, providing additional security.
See Karaf SSH Access.

Using

See Creating, Configuring, and Using an Identity Provider.

Keywords: