Alternative authentication methods for agent

Alternative authentication methods

Resource Owner Password Credentials Grant Flow - Confidential client

For this flow a single user is setup in keycloak, and all agents will connect using the same user.

Keycloak client configuration

1. Open Keycloak user management.
2. Go to Clients.
3. Create a new client > agent_v2.
4. Select Access Type as confidential:

   

5. Expand Authentication Flow Overrides, Select direct grant as Direct Grant Flow.

   

6. Save the changes. A new tab Credentials will appear.
7. Under Client Authenticator select Client Id and Secret. The secret will be required by the agent to successfully retrieve the access token.

   

Adding a password for agent user

Preparing installerConfig.json

The agent must be installed with a properly setup installerConfig.json file.

We prepared a simple tool to make this process easier: GVClient.Tools.SetupHelper (1).zip

1. Start GVClient.Tools.SetupHelper.exe. A simple console application will show up.
2. Enter the address of the cluster, has to start with https://, the tool will strip all unnecessary data.
3. Use SSL
4. Enter the language
5. Pick visual style
6. Pick PasswordGrant as Keycloak Auth Type.
7. Enter the keycloak username
8. Enter the password of the user
9. Enter the keycloak client secret

The tool will show the generated json in the console and also save the file in the same directory from which it was run.

User authentication

For this flow each user can log in using their individual accounts.

Keycloak client configuration

1. Open Keycloak user management.
2. Go to Clients.
3. Create a new client → agent-user-authentication.
4. Set Valid redirect URIs to getvisibility-agent://* - this step is crucial as the agent has registered a custom scheme handler for this exact scheme. Whenever the browser is forwarded to getvisibility-agent://* the agent will be started by the system and the whole URI will be passed on to the agent.
5. Disable Client authentication.
6. Enable Standard flow.

   

   

Agent configuration

{
	"ServerAddress": "cluster_address.com",
	"ServerUseSsl": true,
	"Language": "en",
	"KeycloakClientId": "agent-user-authentication",
	"KeycloakAuthType": 2
}