Enterprise Chef 11.2.0 includes oc-id, the OAuth2 service that powers id.opscode.com. After upgrading to this release, Chef customers can run their own Supermarket service behind a firewall.
1: Add the following setting to your /etc/opscode/private-chef.rb configuration file and then run ‘private-chef-ctl reconfigure’:
oc\_id['administrators'] = ["boiardie"]
This must be an Array of Enterprise Chef users who are authorized to manage the oc-id service. An extended list of oc-id related options for private-chef.rb is available on the docs site.
2: Log in to your Enterprise Chef server’s oc-id management portal at https://mychefserver/id and you will be directed to the oc-id authentication page. Log in as an administrative user as defined in step 1, and you will be displayed
a screen showing that you don’t have any authorized applications:
3: Change your URL to https://mychefserver/id/oauth/applications (sorry, there’s no button or link to do this yet) and you’ll see a screen to add/manage applications:
NOTE: Applications in this context refers to OAuth2 client systems that will authenticate against the oc-id service (like Supermarket).
4: Click the New Application button and fill in the application name and Redirect url:
NOTE: the Redirect URL must contain the oauth2 callback URL, which is /auth/chef\_oauth2/callback for supermarket.
NOTE2: If your users access the supermarket server by different URLs please note those here.
5: After you click Submit you will be shown the Application Id and Secret strings which you must supply to Supermarket. Copy these down, but don’t worry about losing them. You can always retrieve them from the /id/oauth/applications URL of your Chef server.
Currently Supermarket does not have an Omnibus package and must be configured using the supermarket cookbook. These instructions will use test-kitchen to setup your Supermarket instance in Vagrant.
1: Download the supermarket cookbook, double-check the settings in the .kitchen.yml; particularly the private_network IP address:
git clone https://github.com/opscode-cookbooks/supermarket.git supermarket-cookbook
2: Edit the chef\_oauth2 section of the data\_bags/apps/supermarket\_prod.json file. Note that the url field is the URL of your Chef server without a URI.
"chef\_oauth2": {
"app\_id": "14dfcf186221781cff51eedd5ac1616761b31e8947e51f28232537313c5c9c40",
"secret": "a49402219627cfa6318d58b13e90aca164aad2e263fb8f05b766e01f97450c1d",
"verify\_ssl": false,
"url": "https://mychefserver.example.com"
},
3: Fire up your supermarket instance
kitchen test --destroy=never default-ubuntu-1204
4: Once running navigate to http://33.33.33.10 and log in to your new Supermarket instance. You will see a request to authorize the application. This only needs to happen once.
5: Success! You should be logged in to your Supermarket server as the requested user.