Recommended Versions for Installing Apicurio Registry with PostgreSQL Persistence and Security Based on Keycloak

[ramongaldon]

Hi,

We have successfully installed version 2.6 of Apicurio Registry with Postgree persistence and secured the UI using users defined in Keycloak. However, when enabling API security, we are receiving a 401 Unauthorized error for all requests. After reviewing the documentation, we did not find any missing properties, and we believe the issue might be that we are not using the most suitable product version for our goal of securing API operations using the 3 predefined roles (sr-admin, sr-developer, and sr-readonly).

Should we be using version 3.0? We've encountered issues with Postgree persistence when using a dockerized installation of this version, but with version 2.6.x it worked almost perfectly from the start. However, securing the API and ensuring that methods can only be invoked by users with the appropriate role is crucial for us.

Could you provide guidance on this?

[carlesarnal]

Hello,

I would normally advocate for using the newest vesion, specially if you're into the exploratory phase. As for the existing options, we do have examples for this, here for 3.0 and here for 2.6.x. Let me know if anything is not working so we can go through it.

[EricWittmann]

We have successfully installed version 2.6 of Apicurio Registry with Postgree persistence and secured the UI using users defined in Keycloak. However, when enabling API security, we are receiving a 401 Unauthorized error for all requests. After reviewing the documentation, we did not find any missing properties, and we believe the issue might be that we are not using the most suitable product version for our goal of securing API operations using the 3 predefined roles (sr-admin, sr-developer, and sr-readonly).

Can you provide examples of how you are accessing the Registry that results in the 401 errors? Are you calling the REST API directly? Using the UI? Maybe trying the SDK?

What type of authentication are you using when accessing the Registry ? Are you using BASIC auth in curl? Are you using a token? How are you getting the token? If you're using a token, can you decode it and see what roles are in it?

Should we be using version 3.0? We've encountered issues with Postgree persistence when using a dockerized installation of this version, but with version 2.6.x it worked almost perfectly from the start. However, securing the API and ensuring that methods can only be invoked by users with the appropriate role is crucial for us.

I definitely recommend 3.0 unless you need to be in production immediately, then maybe 2.6 is more stable and makes more sense. But I would really like to know what problems you are having with 3.0 + Postgresql. We have a dev server that we run in this configuration and haven't had any problems with it.

[SamMc75]

Hi! I tried secure the UI using users defined in Keycloak. Apicurio Registry 3.0.6, Apicurio Registry UI 3.0.6, Keycloak 25.0.2 . Apicurio and Keycloak works over nginx and https. My problem that after authentification in Apicurio UI over Keycloak I receive page with localhost:8080 and don't redirect on authentificate Apicurio UI page.
In my values Apicurio registry:
- name: QUARKUS_HTTP_PORT
value: "8081"
- name: CORS_ALLOWED_ORIGINS
value: ""
- name: QUARKUS_HTTP_CORS_ORIGINS
value: ""
- name: APICURIO_AUTH_ROLE-BASED-AUTHORIZATION
value: "true"
- name: QUARKUS_OIDC_TENANT_ENABLED
value: "true"
- name: LOG_LEVEL
value: "DEBUG"
- name: QUARKUS_OIDC_AUTH_SERVER_URL
value: "https://keycloak.mydomain.com/realms/registry"
- name: QUARKUS_OIDC_CLIENT_ID
value: registry-api
- name: APICURIO_UI_AUTH_OIDC_CLIENT_ID
value: apicurio-registry
- name: QUARKUS_OIDC_TLS_VERIFICATION
value: "none"
In my Keycloak in realm registry, client registry-api:
Root URL, Web origins, Admin URL = https://apicurio-registry-api.mydomain.com
Valid redirect URIs = https://apicurio-registry-api.mydomain.com/*

[carlesarnal]

You must set APICURIO_UI_AUTH_OIDC_REDIRECT_URI to the value of your UI host. Otherwise you'll get the default value, localhost.

[SamMc75]

Okay, thanks a lot. It helps me!

[SamMc75]

Unfortunately, I don't understand how I can assotiate user with Apicurio roles. After load apicurio-realm.json from github I see roles registry-admin and registry-user in registry-api client. Also I see Realm Roles sr-admin, sr-developer and sr-readonly. If I create group and assign it to registry-admin (or sr-admin) after login I redirect on page /explore with error "Error searching for artifacts." and 403 response in log.

[carlesarnal]

I have created a separate issue for that question since it's nor really related to this discussion.