Skip to content

Commit d661fd5

Browse files
RedjiJBRedjiJB
committed
feat: Phase 4 Lab 04 — SSO Integration (Keycloak + OpenLDAP)
1 parent c074fb6 commit d661fd5

3 files changed

Lines changed: 375 additions & 55 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,4 +183,47 @@ run: bash tests/labs/test-lab-20-01.sh
183183

184184
- name: Cleanup
185185
if: always()
186-
run: docker compose -f docker/docker-compose.advanced.yml down -v
186+
run: docker compose -f docker/docker-compose.advanced.yml down -v
187+
188+
lab-04-smoke:
189+
name: Lab 04 -- Graylog SSO Integration (Keycloak OIDC + OpenLDAP)
190+
runs-on: ubuntu-latest
191+
needs: validate
192+
continue-on-error: true
193+
steps:
194+
- uses: actions/checkout@v4
195+
196+
- name: Install tools
197+
run: sudo apt-get install -y curl netcat-openbsd ldap-utils
198+
199+
- name: Validate SSO compose
200+
run: docker compose -f docker/docker-compose.sso.yml config -q && echo "SSO compose valid"
201+
202+
- name: Start SSO stack
203+
run: docker compose -f docker/docker-compose.sso.yml up -d
204+
205+
- name: Wait for MongoDB
206+
run: timeout 60 bash -c 'until docker exec graylog-s04-mongo mongosh --eval "db.adminCommand(\"ping\")" >/dev/null 2>&1; do sleep 5; done'
207+
208+
- name: Wait for Elasticsearch
209+
run: timeout 120 bash -c 'until docker exec graylog-s04-es curl -sf http://localhost:9200/_cluster/health | grep -q "green\|yellow"; do sleep 10; done'
210+
211+
- name: Wait for OpenLDAP
212+
run: timeout 120 bash -c 'until docker exec graylog-s04-ldap ldapsearch -x -H ldap://localhost -b dc=lab,dc=local -D cn=admin,dc=lab,dc=local -w LdapLab04! cn=admin >/dev/null 2>&1; do sleep 5; done'
213+
214+
- name: Wait for Keycloak
215+
run: timeout 300 bash -c 'until curl -sf http://localhost:8534/realms/master; do sleep 10; done'
216+
217+
- name: Wait for Graylog
218+
run: timeout 300 bash -c 'until curl -sf http://localhost:9030/api | grep -qi "cluster_id\|version"; do sleep 15; done'
219+
220+
- name: Run Lab 20-04 test script
221+
run: bash tests/labs/test-lab-20-04.sh --no-cleanup
222+
223+
- name: Collect logs on failure
224+
if: failure()
225+
run: docker compose -f docker/docker-compose.sso.yml logs
226+
227+
- name: Cleanup
228+
if: always()
229+
run: docker compose -f docker/docker-compose.sso.yml down -v

‎docker/docker-compose.sso.yml‎

Lines changed: 172 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,185 @@
1-
# Lab 04 — SSO Integration: graylog with Keycloak OIDC authentication
2-
---
1+
# =============================================================================
2+
# IT-Stack: Graylog — Lab 04: SSO Integration
3+
# Module 20 · Phase 4 · Lab 04
4+
# =============================================================================
5+
# Services: MongoDB · Elasticsearch · OpenLDAP · Keycloak · Graylog
6+
# Ports: Web:9030 Keycloak:8534 LDAP:3899 Syslog:1517/UDP GELF:12204/UDP
7+
# Credentials:
8+
# Graylog: admin / GraylogLab04!
9+
# Keycloak: admin / Admin04!
10+
# LDAP admin: cn=admin,dc=lab,dc=local / LdapLab04!
11+
# What's new vs Lab 03:
12+
# + OpenLDAP directory for LDAP user federation
13+
# + Keycloak 24 dev-mode as OIDC IdP (it-stack realm)
14+
# + Graylog LDAP auth env vars (GRAYLOG_LDAP_*)
15+
# + Keycloak OIDC discovery endpoint tested in Lab 04
16+
# =============================================================================
17+
18+
name: it-stack-graylog-lab04
19+
320
services:
4-
graylog:
5-
image: graylog/graylog:5.2
6-
container_name: it-stack-graylog
21+
22+
# ── MongoDB ────────────────────────────────────────────────────────────────
23+
graylog-s04-mongo:
24+
image: mongo:6.0
25+
container_name: graylog-s04-mongo
26+
restart: unless-stopped
27+
volumes:
28+
- graylog-s04-mongo-data:/data/db
29+
healthcheck:
30+
test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
31+
interval: 10s
32+
timeout: 5s
33+
retries: 15
34+
networks:
35+
- graylog-s04-net
36+
deploy:
37+
resources:
38+
limits:
39+
memory: 512M
40+
cpus: "0.5"
41+
42+
# ── Elasticsearch (Graylog requires ES 7.x) ─────────────────────────────
43+
graylog-s04-es:
44+
image: docker.elastic.co/elasticsearch/elasticsearch:7.17.12
45+
container_name: graylog-s04-es
746
restart: unless-stopped
8-
ports:
9-
- "9000:$firstPort"
1047
environment:
11-
- IT_STACK_ENV=lab-04-sso
12-
- KEYCLOAK_URL=
13-
- KEYCLOAK_REALM=
14-
- KEYCLOAK_CLIENT_ID=graylog
15-
- KEYCLOAK_CLIENT_SECRET=
48+
discovery.type: single-node
49+
ES_JAVA_OPTS: "-Xms512m -Xmx512m"
50+
xpack.security.enabled: "false"
51+
volumes:
52+
- graylog-s04-es-data:/usr/share/elasticsearch/data
53+
healthcheck:
54+
test: ["CMD-SHELL", "curl -sf http://localhost:9200/_cluster/health || exit 1"]
55+
interval: 15s
56+
timeout: 10s
57+
retries: 20
58+
start_period: 40s
1659
networks:
17-
- it-stack-net
60+
- graylog-s04-net
61+
deploy:
62+
resources:
63+
limits:
64+
memory: 1G
65+
cpus: "1.0"
1866

19-
# Local Keycloak for SSO lab (replace with lab-id1 in real env)
20-
keycloak:
21-
image: quay.io/keycloak/keycloak:24
22-
container_name: it-stack-graylog-keycloak
67+
# ── OpenLDAP ───────────────────────────────────────────────────────────────
68+
graylog-s04-ldap:
69+
image: osixia/openldap:1.5.0
70+
container_name: graylog-s04-ldap
71+
restart: unless-stopped
72+
environment:
73+
LDAP_ORGANISATION: "IT-Stack Lab"
74+
LDAP_DOMAIN: lab.local
75+
LDAP_ADMIN_PASSWORD: LdapLab04!
76+
LDAP_CONFIG_PASSWORD: ConfigLab04!
77+
LDAP_BASE_DN: dc=lab,dc=local
78+
LDAP_READONLY_USER: "true"
79+
LDAP_READONLY_USER_USERNAME: readonly
80+
LDAP_READONLY_USER_PASSWORD: ReadOnly04!
81+
ports:
82+
- "3899:389"
83+
volumes:
84+
- graylog-s04-ldap-data:/var/lib/ldap
85+
- graylog-s04-ldap-config:/etc/ldap/slapd.d
86+
healthcheck:
87+
test: ["CMD-SHELL", "ldapsearch -x -H ldap://localhost -b dc=lab,dc=local -D cn=admin,dc=lab,dc=local -w LdapLab04! cn=admin > /dev/null 2>&1 || exit 1"]
88+
interval: 10s
89+
timeout: 5s
90+
retries: 15
91+
networks:
92+
- graylog-s04-net
93+
deploy:
94+
resources:
95+
limits:
96+
memory: 256M
97+
cpus: "0.25"
98+
99+
# ── Keycloak ───────────────────────────────────────────────────────────────
100+
graylog-s04-kc:
101+
image: quay.io/keycloak/keycloak:24.0.3
102+
container_name: graylog-s04-kc
103+
restart: unless-stopped
23104
command: start-dev
24105
environment:
25106
KEYCLOAK_ADMIN: admin
26-
KEYCLOAK_ADMIN_PASSWORD: admin
107+
KEYCLOAK_ADMIN_PASSWORD: Admin04!
108+
KC_HEALTH_ENABLED: "true"
109+
KC_DB: dev-file
110+
KC_HOSTNAME_STRICT: "false"
111+
KC_HOSTNAME_STRICT_HTTPS: "false"
112+
KC_HTTP_ENABLED: "true"
113+
ports:
114+
- "8534:8080"
115+
healthcheck:
116+
test: ["CMD-SHELL", "curl -sf http://localhost:8080/realms/master || exit 1"]
117+
interval: 15s
118+
timeout: 10s
119+
retries: 20
120+
start_period: 30s
121+
networks:
122+
- graylog-s04-net
123+
deploy:
124+
resources:
125+
limits:
126+
memory: 1G
127+
cpus: "1.0"
128+
129+
# ── Graylog ────────────────────────────────────────────────────────────────
130+
graylog-s04-app:
131+
image: graylog/graylog:5.2
132+
container_name: graylog-s04-app
133+
restart: unless-stopped
134+
depends_on:
135+
graylog-s04-mongo:
136+
condition: service_healthy
137+
graylog-s04-es:
138+
condition: service_healthy
139+
graylog-s04-ldap:
140+
condition: service_healthy
27141
ports:
28-
- "8080:8080"
142+
- "9030:9000"
143+
- "1517:1514/udp"
144+
- "12204:12201/udp"
145+
environment:
146+
GRAYLOG_PASSWORD_SECRET: GraylogPasswordSecret04Lab!
147+
GRAYLOG_ROOT_PASSWORD_SHA2: "9b1d86bc83a03c988d3edaf7f7f5c0ff4e1f6de580289d62ba7b7e37c7ea45dc"
148+
GRAYLOG_HTTP_EXTERNAL_URI: http://localhost:9030/
149+
GRAYLOG_ELASTICSEARCH_HOSTS: http://graylog-s04-es:9200
150+
GRAYLOG_MONGODB_URI: mongodb://graylog-s04-mongo/graylog
151+
# LDAP configuration
152+
GRAYLOG_LDAP_CONNECTION_URI: ldap://graylog-s04-ldap:389
153+
GRAYLOG_LDAP_BASE_DN: dc=lab,dc=local
154+
GRAYLOG_LDAP_SEARCH_BASE: dc=lab,dc=local
155+
GRAYLOG_LDAP_SEARCH_PATTERN: "(uid={0})"
156+
GRAYLOG_LDAP_DISPLAY_NAME_ATTRIBUTE: cn
157+
GRAYLOG_LDAP_SYSTEM_USERNAME: cn=admin,dc=lab,dc=local
158+
GRAYLOG_LDAP_SYSTEM_PASSWORD: LdapLab04!
159+
# Keycloak OIDC reference
160+
KEYCLOAK_URL: http://graylog-s04-kc:8080
161+
KEYCLOAK_REALM: it-stack
162+
KEYCLOAK_CLIENT_ID: graylog
163+
volumes:
164+
- graylog-s04-app-data:/usr/share/graylog/data
29165
networks:
30-
- it-stack-net
166+
- graylog-s04-net
167+
deploy:
168+
resources:
169+
limits:
170+
memory: 1G
171+
cpus: "1.0"
31172

173+
# ── Networks ───────────────────────────────────────────────────────────────────
32174
networks:
33-
it-stack-net:
175+
graylog-s04-net:
176+
name: graylog-s04-net
34177
driver: bridge
178+
179+
# ── Volumes ────────────────────────────────────────────────────────────────────
180+
volumes:
181+
graylog-s04-mongo-data:
182+
graylog-s04-es-data:
183+
graylog-s04-ldap-data:
184+
graylog-s04-ldap-config:
185+
graylog-s04-app-data:

0 commit comments

Comments
 (0)