Class 9: Access on NGINX Plus - Authentication for Web Access

Note

Last Updated: 1/22/2024

Instructors at F5 AppWorld 2024:

• Sam Park <s.park@f5.com>
• Scott Huddy <s.huddy@f5.com>

UDF Lab Maintainers:

• Amir Rawdat <a.rawdat@f5.com>
• Scott Huddy <s.huddy@f5.com>

This lab will show how to enable single sign-on (SSO) for applications being proxied by NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with Keycloak as the identity provider (IdP), and NGINX Plus as the relying party. The lab will also cover the creation of an Instance Group of NGINX Plus servers, which will be load balanced using F5 BIG-IP DNS (GSLB), and introduce NGINX Instance Manager.

Expected time to complete: 1.5 hours

• Introduction
  • Lab Topology
  • Lab Components
  • Lab Setup
  • High-Level View of auth flow for the lab environment
• Let’s Get Started - Join the UDF Course
• Installing Prerequisites:
  • Install NGINX Plus njs module
  • Create a clone of the nginx-openid-connect GitHub repository
• Configuring the IdP Keycloak
  • Create a Keycloak client for NGINX Plus in the Keycloak GUI:
  • Creating a user in keycloak
• Configure NGINX Plus as the OpenID Connect relying party
• Testing the config
• Manage NGINX Plus with Instance Manager
  • Create the Nginx Plus Cluster in Instance Manager

Important

• The Lab MC will provide the necessary details to connect to lab environment
• All work for this lab will be performed exclusively from the UDF Webshell and Firefox Container
• No installation and only minimal interaction with your local system is required

Attention

• For anyone wishing to take this lab at a later date, the lab is hosted on the F5 UDF Environment, and is called “AppWorld 2024 - F5 NGINX Plus Access: Authentication for Web Access”

Please work with your F5 account team for access.