// Module included in the following assemblies:
//
// assembly-installing-manual-steps.adoc

[id='deploying-auth-services-{context}']
= Deploying authentication services

{ProductName} requires at least one authentication service to be deployed. The authentication service
can be `none` (allow all), `standard` (Keycloak), or `external` (not managed by {ProductName}).

== Deploying the `none` authentication service

.Procedure

ifeval::["{cmdcli}" == "kubectl"]
. Create a certificate to use with the `none` authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap",subs="+quotes,attributes"]
----
mkdir -p none-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=none-authservice._{ProductNamespace}_.svc.cluster.local" -out none-authservice-cert/tls.crt -keyout none-authservice-cert/tls.key
----

. Create a secret with the `none` authentication service certificate:
+
[options="nowrap",subs="attributes"]
----
{cmdcli} create secret tls none-authservice-cert --cert=none-authservice-cert/tls.crt --key=none-authservice-cert/tls.key
----
endif::[]

. Create the `none` authentication service:
+
[options="nowrap",subs="attributes"]
----
{cmdcli} create -f ./install/components/none-authservice
----

== Deploying the `standard` authentication service

.Procedure

. (Optional) Replace namespace if you want to deploy to something other than `{ProductNamespace}`:
+
[options="nowrap",subs="+quotes,attributes"]
----
sed -i 's/{ProductNamespace}/_my-namespace_/' install/components/standard-authservice/\*RoleBinding*.yaml
----


ifeval::["{cmdcli}" == "kubectl"]
. Create a certificate to use with the `standard` authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap",subs="+quotes,attributes"]
----
mkdir -p standard-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=standard-authservice._{ProductNamespace}_.svc.cluster.local" -out standard-authservice-cert/tls.crt -keyout standard-authservice-cert/tls.key
----

. Create a secret with the `standard` authentication service certificate:
+
[options="nowrap",subs="attributes"]
----
{cmdcli} create secret tls standard-authservice-cert --cert=standard-authservice-cert/tls.crt --key=standard-authservice-cert/tls.key
----
endif::[]

. Create the `standard` authentication service:
+
[options="nowrap",subs="attributes"]
----
{cmdcli} create -f ./install/components/standard-authservice
----
