This PR builds on top of the two previous ones: #57535 and #58402. It inroduces the new service oauth2-proxy (the open source project) which provides OIDC support out of the box. In combination with the mgmt-gateway this service provides a seamless SSO to access all the Ceph managment backend services (Ceph Dashboard and monitoring stack).

Changes included in this PR:

• Introducing oauth2-proxy new service
• Add support for Grafana seamless SSO login (based on oauth2)
• Change how we get fqdn for hosts (use inventory information)
• Refactoring of Grafana daemon configuration code

Following diagram depicts the new architecture:

Following are the steps to setup working environment in this case using dex idp for testing purpose

1) Run keycloak server using the following command

create a new realm and configure a user with 'admin' role following the steps from the docs

podman run --replace -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 8080:8080 --name keycloak -v /opt/keycloak:/opt/keycloak/data/h2 quay.io/keycloak/keycloak:25.0.2 start-dev

Alternatively, users can use dex as idp with the following config file:

issuer: http://<ip-of-dex-node>:5556/dex

storage:
  type: sqlite3
  config:
    file: /var/dex/dex.db

web:
  http: 0.0.0.0:5556

expiry:
  deviceRequests: 5h
  signingKeys: 6h
  idTokens: 24h
  authRequests: 24h

logger:
  level: info
  format: text

oauth2:
  responseTypes: [code]
  skipApprovalScreen: false
  alwaysShowLoginScreen: false

enablePasswordDB: true

staticClients:
  - id: oauth2-proxy
    redirectURIs:
      - 'https://<ip-of-mgmt-gw-node>/oauth2/callback'
    name: 'oauth2-proxy'
    secret: proxy

connectors:
  - type: mockCallback
    id: mock
    name: Example

staticPasswords:
  - email: "admin@example.com"
    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
    username: "admin"
    userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

run dex server:

podman run --rm -p 5556:5556 -p 5555:5555 -v /<path-to-your-config.yaml:/etc/dex/config.docker.yaml --name dex-container ghcr.io/dexidp/dex

2) Configure mgmt-gateway service

ceph orch apply mgmt-gateway --enable_auth=true

Wait for all the services to get reconfigured (it takes less than 1min)

3) Configure oauth2-proxy service

service_type: oauth2-proxy
placement:
  hosts:
    - ceph-node-1
spec:
  https_address: "0.0.0.0:4180"
  provider_display_name: "My OIDC Provider"
  client_id: "oauth2-proxy"
  client_secret: "proxy"
  oidc_issuer_url: "http://<your-ip>:5556/dex"

Following is an example of spec file for Keycloak client, in this case keycloak is running on the node with the ip 192.168.100.1:

service_type: oauth2-proxy
placement:
  hosts:
    - ceph-node-2
spec:
  https_address: "0.0.0.0:4180"
  provider_display_name: "My OIDC Provider"
  client_id: "oauth2-proxy"
  client_secret: "vwCLTITb2rtem583523uXcuSNItDsz1I"
  cookie_secret: "kbAEM9opAmuHskQvt0AW8oeJRaOM2BYy5Loba0kZ0SQ="
  oidc_issuer_url: "http://192.168.100.1:8080/realms/ceph"
  whitelist_domains:
    - 192.168.100.1:8080

Deploy the service:

ceph orch apply -i auth2-proxy.yaml

Wait for all the services to get reconfigured (it takes less than 1min)

4) Open a browser and visit https://<mgmt-gw-node-ip>

Contribution Guidelines

• To sign and title your commits, please refer to Submitting Patches to Ceph.

• If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

• When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

• Tracker (select at least one)
  • References tracker ticket
  • Very recent bug; references commit where it was introduced
  • New feature (ticket optional)
  • Doc update (no ticket needed)
  • Code cleanup (no ticket needed)
• Component impact
  • Affects Dashboard, opened tracker ticket
  • Affects Orchestrator, opened tracker ticket
  • No impact that needs to be tracked
• Documentation (select at least one)
  • Updates relevant documentation
  • No doc update is appropriate
• Tests (select at least one)
  • Includes unit test(s)
  • Includes integration test(s)
  • Includes bug reproducer
  • No tests