From 15f687f224d4f214163c288e1fd58542b5b68d6f Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Thu, 10 Sep 2026 14:31:53 -0500 Subject: [PATCH 1/9] Use a placeholder for redirect-uri to allow env var override --- uaa-server/README.md | 13 +++++-------- uaa-server/uaa.yml | 6 +----- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index 9c89f2d..61af232 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -18,15 +18,12 @@ docker run -it -p 8080:8080 --name steeltoe-uaa -v $pwd/uaa.yml:/uaa/uaa.yml ste ## Customizing for your Cloud Foundry environment -These instructions will help you build and deploy a custom image to use as an identity provider for [Single Sign-On for VMware Tanzu Application Service](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/single-sign-on-for-tanzu/1-16/sso-tanzu/index.html): +These instructions will help you deploy this image to use as an identity provider for [Single Sign-On for VMware Tanzu Application Service](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/single-sign-on-for-tanzu/1-16/sso-tanzu/index.html): -1. Clone this repository. 1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/tanzu-platform-for-cloud-foundry/10-3/tpcf/t-uaa-uaa-concepts.html) -1. Change the `redirect-uri` entry for `ssotile` in [uaa.yml](uaa.yml#132) to match your identity zone. -1. (OPTIONAL) Customize the name of the image you're about to build by renaming the `uaa-server` directory -1. `.\build.ps1 uaa-server`. -1. Push the image to an image repository accessible from your Cloud Foundry environment. -1. Deploy the image with a command similar to this: - * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server` +1. Deploy the image, setting the `SSOTILE_REDIRECT_URI` environment variable to match your identity zone: + * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server -e SSOTILE_REDIRECT_URI=https://.login./**` 1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-16/sso/configure-external-id.html#config-ext-prov) * Use the `ssotile` credentials from uaa.yml + +If you need to customize anything beyond `redirect-uri`, edit [uaa.yml](uaa.yml) and build your own image with `.\build.ps1 uaa-server`. diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index 35b80fe..7e4b5ea 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -131,14 +131,10 @@ - openid - profile description: Credentials for use with UAA server in Cloud Foundry environment - - # CHANGE THIS VALUE TO MATCH YOUR ENVIRONMENT - redirect-uri: https://steeltoe.login.sys.dhaka.cf-app.com/** - + redirect-uri: ${SSOTILE_REDIRECT_URI} resource_ids: sampleapi.read scope: openid,profile,sampleapi.read secret: sso_secret - # --- --- # jwt: token: refresh: From 38724f77a261129ed0c985fba50ebaf3470b94f1 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Thu, 10 Sep 2026 14:39:48 -0500 Subject: [PATCH 2/9] add a default value for placeholder --- uaa-server/uaa.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index 7e4b5ea..f30d38b 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -131,7 +131,7 @@ - openid - profile description: Credentials for use with UAA server in Cloud Foundry environment - redirect-uri: ${SSOTILE_REDIRECT_URI} + redirect-uri: ${SSOTILE_REDIRECT_URI:http://localhost:8080} resource_ids: sampleapi.read scope: openid,profile,sampleapi.read secret: sso_secret From 82fdc409658714b826d7cca262f591a885c5adb9 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Thu, 10 Sep 2026 15:42:39 -0500 Subject: [PATCH 3/9] add an admin client --- uaa-server/uaa.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index f30d38b..267ae4d 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -84,6 +84,12 @@ # List of OAuth clients clients: + admin: + authorities: clients.read,clients.write,clients.secret,clients.admin,scim.read,scim.write,uaa.admin + authorized-grant-types: client_credentials + description: "Admin client for managing UAA via uaac" + scope: uaa.admin + secret: adminsecret # ----- ----- # admin-portal: app-launch-url: http://localhost:63757/Home/ From b996f9ba5a889cb203a2c48ecc01a8b330eb4925 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Thu, 10 Sep 2026 16:40:31 -0500 Subject: [PATCH 4/9] remove uaa.yml placeholder, recommend UAA_CONFIG_YAML --- uaa-server/README.md | 6 ++++-- uaa-server/uaa.yml | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index 61af232..beecec3 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -21,8 +21,10 @@ docker run -it -p 8080:8080 --name steeltoe-uaa -v $pwd/uaa.yml:/uaa/uaa.yml ste These instructions will help you deploy this image to use as an identity provider for [Single Sign-On for VMware Tanzu Application Service](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/single-sign-on-for-tanzu/1-16/sso-tanzu/index.html): 1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/tanzu-platform-for-cloud-foundry/10-3/tpcf/t-uaa-uaa-concepts.html) -1. Deploy the image, setting the `SSOTILE_REDIRECT_URI` environment variable to match your identity zone: - * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server -e SSOTILE_REDIRECT_URI=https://.login./**` +1. Deploy the image, then set the `ssotile` client's `redirect-uri` to match your identity zone using the `UAA_CONFIG_YAML` environment variable (UAA merges this YAML on top of the file-based config at startup, so no rebuild is needed): + * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server --no-start` + * `cf set-env steeltoe-uaa UAA_CONFIG_YAML "oauth:\n clients:\n ssotile:\n redirect-uri: https://.login./**"` + * `cf start steeltoe-uaa` 1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-16/sso/configure-external-id.html#config-ext-prov) * Use the `ssotile` credentials from uaa.yml diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index 267ae4d..fe7f0ec 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -137,7 +137,7 @@ - openid - profile description: Credentials for use with UAA server in Cloud Foundry environment - redirect-uri: ${SSOTILE_REDIRECT_URI:http://localhost:8080} + redirect-uri: http://localhost:8080 resource_ids: sampleapi.read scope: openid,profile,sampleapi.read secret: sso_secret From 8a886bccba34661b9b13d6334b2c0e23e58c452c Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Thu, 10 Sep 2026 16:45:21 -0500 Subject: [PATCH 5/9] restore inadvertently-deleted comment --- uaa-server/uaa.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index fe7f0ec..4738b8f 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -141,6 +141,7 @@ resource_ids: sampleapi.read scope: openid,profile,sampleapi.read secret: sso_secret + # --- --- # jwt: token: refresh: From 406b4ba990ffa68bcdc54fb781486f8b15cc53c3 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Fri, 11 Sep 2026 09:05:37 -0500 Subject: [PATCH 6/9] update techdocs links --- uaa-server/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index beecec3..3aa781a 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -18,14 +18,14 @@ docker run -it -p 8080:8080 --name steeltoe-uaa -v $pwd/uaa.yml:/uaa/uaa.yml ste ## Customizing for your Cloud Foundry environment -These instructions will help you deploy this image to use as an identity provider for [Single Sign-On for VMware Tanzu Application Service](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/single-sign-on-for-tanzu/1-16/sso-tanzu/index.html): +These instructions will help you deploy this image to use as an identity provider for Tanzu [Single Sign-On](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/index.html): -1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/tanzu-platform-for-cloud-foundry/10-3/tpcf/t-uaa-uaa-concepts.html) +1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-4/eart/t-uaa-uaa-concepts.html#iz) 1. Deploy the image, then set the `ssotile` client's `redirect-uri` to match your identity zone using the `UAA_CONFIG_YAML` environment variable (UAA merges this YAML on top of the file-based config at startup, so no rebuild is needed): * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server --no-start` * `cf set-env steeltoe-uaa UAA_CONFIG_YAML "oauth:\n clients:\n ssotile:\n redirect-uri: https://.login./**"` * `cf start steeltoe-uaa` -1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-16/sso/configure-external-id.html#config-ext-prov) +1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov) * Use the `ssotile` credentials from uaa.yml If you need to customize anything beyond `redirect-uri`, edit [uaa.yml](uaa.yml) and build your own image with `.\build.ps1 uaa-server`. From 20a329b2704fc2f51db93d85f28da20c937f3c47 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Fri, 11 Sep 2026 11:24:20 -0500 Subject: [PATCH 7/9] drop admin client, bump to latest uaa - update readme to account for non-wildcard redirect-uri --- uaa-server/README.md | 9 +++++---- uaa-server/metadata/IMAGE_VERSION | 2 +- uaa-server/uaa.yml | 6 ------ 3 files changed, 6 insertions(+), 11 deletions(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index 3aa781a..132cf1a 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -20,12 +20,13 @@ docker run -it -p 8080:8080 --name steeltoe-uaa -v $pwd/uaa.yml:/uaa/uaa.yml ste These instructions will help you deploy this image to use as an identity provider for Tanzu [Single Sign-On](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/index.html): -1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-4/eart/t-uaa-uaa-concepts.html#iz) -1. Deploy the image, then set the `ssotile` client's `redirect-uri` to match your identity zone using the `UAA_CONFIG_YAML` environment variable (UAA merges this YAML on top of the file-based config at startup, so no rebuild is needed): +1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-4/eart/t-uaa-uaa-concepts.html#iz) and note its auth domain (e.g. `https://.login.`) + * Pick an all-lowercase, dash-separated identity provider name for this connection (e.g. `steeltoe-uaa`) — you'll use this same value in both of the next two steps +1. Deploy the image, setting the `ssotile` client's `redirect-uri` to `/login/callback/`. UAA always uses this fixed path for external OAuth/OIDC providers, and (as of UAA 78.15.0+) matches redirect URIs exactly, so wildcards like a trailing `/**` won't match: * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server --no-start` - * `cf set-env steeltoe-uaa UAA_CONFIG_YAML "oauth:\n clients:\n ssotile:\n redirect-uri: https://.login./**"` + * `cf set-env steeltoe-uaa UAA_CONFIG_YAML "oauth:\n clients:\n ssotile:\n redirect-uri: https://.login./login/callback/ssotile"` * `cf start steeltoe-uaa` -1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov) +1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov), using the same name from step 2 for **Identity Provider Name** * Use the `ssotile` credentials from uaa.yml If you need to customize anything beyond `redirect-uri`, edit [uaa.yml](uaa.yml) and build your own image with `.\build.ps1 uaa-server`. diff --git a/uaa-server/metadata/IMAGE_VERSION b/uaa-server/metadata/IMAGE_VERSION index 2617fcb..8de147a 100644 --- a/uaa-server/metadata/IMAGE_VERSION +++ b/uaa-server/metadata/IMAGE_VERSION @@ -1 +1 @@ -78.3.0 +79.7.0 diff --git a/uaa-server/uaa.yml b/uaa-server/uaa.yml index 4738b8f..9668d7a 100644 --- a/uaa-server/uaa.yml +++ b/uaa-server/uaa.yml @@ -84,12 +84,6 @@ # List of OAuth clients clients: - admin: - authorities: clients.read,clients.write,clients.secret,clients.admin,scim.read,scim.write,uaa.admin - authorized-grant-types: client_credentials - description: "Admin client for managing UAA via uaac" - scope: uaa.admin - secret: adminsecret # ----- ----- # admin-portal: app-launch-url: http://localhost:63757/Home/ From 75f6b181e5c76602a48734a125b0ab1c64135948 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Fri, 11 Sep 2026 11:43:21 -0500 Subject: [PATCH 8/9] switch to yaml flow style --- uaa-server/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index 132cf1a..b7c94f2 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -24,7 +24,7 @@ These instructions will help you deploy this image to use as an identity provide * Pick an all-lowercase, dash-separated identity provider name for this connection (e.g. `steeltoe-uaa`) — you'll use this same value in both of the next two steps 1. Deploy the image, setting the `ssotile` client's `redirect-uri` to `/login/callback/`. UAA always uses this fixed path for external OAuth/OIDC providers, and (as of UAA 78.15.0+) matches redirect URIs exactly, so wildcards like a trailing `/**` won't match: * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server --no-start` - * `cf set-env steeltoe-uaa UAA_CONFIG_YAML "oauth:\n clients:\n ssotile:\n redirect-uri: https://.login./login/callback/ssotile"` + * `cf set-env steeltoe-uaa UAA_CONFIG_YAML '{oauth: {clients: {ssotile: {redirect-uri: "https://.login./login/callback/steeltoe-uaa"}}}}'` * `cf start steeltoe-uaa` 1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov), using the same name from step 2 for **Identity Provider Name** * Use the `ssotile` credentials from uaa.yml From 7e2ca3eb851ec47c0702284db012290f8f1d2876 Mon Sep 17 00:00:00 2001 From: Tim Hess Date: Fri, 11 Sep 2026 14:02:58 -0500 Subject: [PATCH 9/9] uaa-server needs at least 685MB to start, some foundations may have 512MB as the default --- uaa-server/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uaa-server/README.md b/uaa-server/README.md index b7c94f2..a58849a 100644 --- a/uaa-server/README.md +++ b/uaa-server/README.md @@ -23,7 +23,7 @@ These instructions will help you deploy this image to use as an identity provide 1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-4/eart/t-uaa-uaa-concepts.html#iz) and note its auth domain (e.g. `https://.login.`) * Pick an all-lowercase, dash-separated identity provider name for this connection (e.g. `steeltoe-uaa`) — you'll use this same value in both of the next two steps 1. Deploy the image, setting the `ssotile` client's `redirect-uri` to `/login/callback/`. UAA always uses this fixed path for external OAuth/OIDC providers, and (as of UAA 78.15.0+) matches redirect URIs exactly, so wildcards like a trailing `/**` won't match: - * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server --no-start` + * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server -m 1G --no-start` * `cf set-env steeltoe-uaa UAA_CONFIG_YAML '{oauth: {clients: {ssotile: {redirect-uri: "https://.login./login/callback/steeltoe-uaa"}}}}'` * `cf start steeltoe-uaa` 1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov), using the same name from step 2 for **Identity Provider Name**