Enabling SAML in a Kubernetes installation

Enabling the SAML integration requires:

1. A Kubernetes secret containing a PKCS12 keystore for the authentication server to use. This can be the same deephaven-tls secret used by Envoy. Note that the SAML ACS is hosted behind Envoy, so the certificate from the PKCS12 keystore is only seen by Envoy itself -- the TLS connection from clients will terminate at Envoy, as with the UI.
2. Container images built to contain the SAML plugin jars.
3. Updating the Deephaven configuration to use SAML.

Steps 1 & 2 must be performed manually. Step 3 is handled by setting the appropriate Helm values.

Creating PKCS12 Keystore

The PKCS12 keystore and its base64-encoded passphrase must be loaded from Kubernetes secrets.

First, create a secret containing the keystore passphrase. In this case, the secret will include both the plaintext and base64-encoded passphrase. The authentication server requires the base64-encoded version, but the plaintext version can be used (e.g., by cert-manager) when creating the keystore.

The example below adds a keystore passphrase to a Kubernetes secret.

Next, add a secret containing the PKCS12 keystore. If using cert-manager, this can be done automatically by adding YAML for a certificate from cert-manager. Below is an example that requests a certificate from cert-manager called cert-dhe-k8s-test. The actual certificate files (PEM-encoded tls.key and tls.crt files) will be stored in the deephaven-tls secret. A PKCS12 keystore will also be created, which will take its passphrase from the passphrase field of the saml-pkcs12-pw-secret created above. This certificate has multiple dnsNames so that it can be used by both Envoy (for connections to the DH UI) and the authentication server (for the SAML ACS).

The certificate YAML can be added with kubectl apply:

Once the certificate has been generated, the deephaven-tls secret will contain tls.crt, tls.key and keystore.p12 files:

Alternatively, you can manually create a Kubernetes secret containing an appropriate keystore.p12 file.

Building images with the SAML plugin

To include the plugin jars in the image, put the plugin tar file in the deephaven_base image directory and update the Dockerfile to include the plugin:

Be sure to set the saml_plugin_tar argument in your docker build/podman build command, e.g.:

SAML Helm values

The following Helm values are used to configure SAML:

To enable SAML in the config, set the following values when installing the Helm release: