Procedure

1. To create an SBOM by using a container image.

   CycloneDX format

   syft IMAGE_PATH -o cyclonedx-json@1.5

   Copy code to clipboard

   $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5

   Copy code to clipboard

   SPDX format

   syft IMAGE_PATH -o spdx-json@2.3

   Copy code to clipboard

   $ syft registry:example.io/hello-world:latest -o spdx-json@2.3

   Copy code to clipboard

   Note

   Syft supports many types of container image sources. For the official supported source list, see Content from github.com is not included.Syft GitHub site for more details.

2. To create an SBOM by scanning the local file system.

   CycloneDX format

   syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
   syft file: FILE_PATH -o cyclonedx-json@1.5

   Copy code to clipboard

   $ syft dir:. -o cyclonedx-json@1.5
   $ syft file:/example-binary -o cyclonedx-json@1.5

   Copy code to clipboard

   SPDX format

   syft dir: DIRECTORY_PATH -o spdx-json@2.3
   syft file: FILE_PATH -o spdx-json@2.3

   Copy code to clipboard

   $ syft dir:. -o spdx-json@2.3
   $ syft file:/example-binary -o spdx-json@2.3

   Copy code to clipboard

Procedure

1. Open a web browser.
2. Go to the Trusted Profile Analyzer console URL for your running RHTPA instance.
3. Log in to the Trusted Profile Analyzer console with your credentials.
4. Click SBOMs from the navigation menu.
5. Click the Generate vulnerability report button.
6. You can drag and drop your SBOM file directly to this page, or click the Browse Files button, then choose the SBOM file you want to scan.
7. After RHTPA scans the SBOM file, you get a summary of the analysis, and any specific vulnerability information for the packages included in your SBOM file.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, click Search from the navigational menu.
3. In the search field enter your search query.
4. On the search results page, you can view SBOM documents, software packages, vulnerabilities, and advisories related to your search query. You can also filter these results by date range, SBOM format, and license expression.
5. For AIBOM documents that appear in the search results, they will have the label of kind=aibom. By selecting the AIBOM document from the search results, you can view the models associated with it on the Models tab.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, click Search from the navigational sidebar.
3. Find your SBOM from the list.
4. Click the options menu icon, and click Download License Export.
5. Extract the license information from the downloaded .zip file.

6. Open the comma-separated values (CSV) file to view it.

   Note

   The license reference CSV file only applies to SPDX-formatted SBOMs.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, expand SBOMs from the navigational menu, and click All SBOMs.
3. On the All SBOMs page, check the boxes next to the SBOM documents you want to group together, then click the Create group button.
4. You must enter a name for your new group in the Group name field.
5. Optional. If you have an existing group, you can create a parent-child relationship to this new group by selecting a parent group from the drop-down menu.
6. Optional. Expand the Advance section, and you can add labels for the new group.
7. Click the Create button to finish creating your new group.
8. You can manage your new group under the Groups navigational menu.

Procedure

1. From the RHTPA console home page, click either SBOMs or Advisories on the navigation menu.
2. On the row for the SBOM or advisory you want to edit labels for, click the overflow menu at the end of the row, and click Edit labels.

3. On the Edit labels page, you can add or remove labels.

   1. To add a new label, start typing the label name in the Label field, and click the Add button.
   2. To remove a label, look under the Labels of SBOM section, click the X on the label you want to remove.
4. When finished editing the labels for SBOMs or advisories, click the Save button.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, click SBOM or Advisories from the navigational menu.
3. Find your SBOM or advisory in the list, click the options menu icon, and click Delete.
4. A confirmation dialog is given, click the Delete button.
5. Verify that the SBOM or advisory is no longer displayed in the list.

Procedure

1. Create an API application registration.

   1. Go to the Content from portal.azure.com is not included.Azure portal and navigate to Microsoft Entra ID > App registrations > New registration.

   2. Fill out the following fields for your application registration:

      • Name : Add a descriptive name for your application registration, such as RHTPA API.
      • Supported account types : Choose the appropriate option, Single tenant or Multi-tenant, based on your requirements.
      • Redirect URI : Leave blank, as this is not required for the API.
   3. Click Register to create the application registration.
   4. After the application registration is created, make note of the Application (client) ID and Directory (tenant) ID values from the application overview page. You will need these values later.

2. Configure the application registration to expose an API.

   1. In the application registration overview page, navigate to Expose an API.
   2. Click Add next to Application ID URI, accept the default value, and click Save.

3. Define the scopes for client requests.

   1. In the Expose an API section, click Add a scope.

   2. Create a scope for creating documents using the following values:

      • Scope name : create:document
      • Who can consent? : Admins and users
      • Admin consent display name : Create documents in RHTPA
      • Admin consent description : Allows the application to create documents in RHTPA
      • User consent display name : Create documents in RHTPA
      • User consent description : Allows the application to create documents in RHTPA
      • State : Enabled
   3. Click Add scope to save the scope.

   4. Create a scope for reading documents using the following values:

      • Scope name : read:document
      • Who can consent? : Admins and users
      • Admin consent display name : Read documents in RHTPA
      • Admin consent description : Allows the application to read documents in RHTPA
      • User consent display name : Read documents in RHTPA
      • User consent description : Allows the application to read documents in RHTPA
      • State : Enabled
   5. Click Add scope to save the scope.

   6. Create a scope for updating documents using the following values:

      • Scope name : update:document
      • Who can consent? : Admins and users
      • Admin consent display name : Update documents in RHTPA
      • Admin consent description : Allows the application to update documents in RHTPA
      • User consent display name : Update documents in RHTPA
      • User consent description : Allows the application to update documents in RHTPA
      • State : Enabled
   7. Click Add scope to save the scope.

   8. Create a scope for deleting documents using the following values:

      • Scope name : delete:document
      • Who can consent? : Admins and users
      • Admin consent display name : Delete documents in RHTPA
      • Admin consent description : Allows the application to delete documents in RHTPA
      • User consent display name : Delete documents in RHTPA
      • User consent description : Allows the application to delete documents in RHTPA
      • State : Enabled
   9. Click Add scope to save the scope.

   10. Once finished, you should have the following scopes defined for your application registration:

       • api://{API_CLIENT_ID}/create:document
       • api://{API_CLIENT_ID}/read:document
       • api://{API_CLIENT_ID}/update:document
       • api://{API_CLIENT_ID}/delete:document

4. Create a client secret for service-to-service authentication.

   This is useful for making API calls from backend services or command-line tools.

   1. Click Certificates & secrets from the navigation menu.
   2. Click New client secret.
   3. Add a description, such as CLI Access.
   4. Select a expiration period appropriate for your environment.

   5. Click Add to create the client secret.

      Important

      Make sure to copy the client secret value immediately after creation, as it will not be shown again. You will need this value for authentication.

5. Configure the token version.

   1. Click Manifest from the navigation menu.

   2. Find the accessTokenAcceptedVersion property in the JSON file, and set change its value from null`to `2:

      "accessTokenAcceptedVersion": 2

      Copy code to clipboard

      This ensures that tokens are using the v2.0 format.

   3. Click Save to save the manifest changes.

6. Add application roles with scopeMappings for admin consent.

   1. Click App roles from the navigation menu.
   2. Click Create app role.

   3. Create roles for each permission, as follows:

      • Value: App.Read.Document, Allowed member types: Applications
      • Value: App.Create.Document, Allowed member types: Applications
      • Value: App.Update.Document, Allowed member types: Applications
      • Value: App.Delete.Document, Allowed member types: Applications
   4. Click Apply to save each application role.
   5. Navigate to API permissions > Add a permission > My APIs, and select the API application registration you created earlier.
   6. Check the boxes for the App.Read.Document, App.Create.Document, App.Update.Document, and App.Delete.Document application roles, and click Add permissions to save.
   7. Click Grant admin consent to grant consent for the application roles you just added.

7. Create the front-end application registration.

   1. From the Microsoft Entra ID menu, navigate to App registrations > New registration.

   2. Fill out the following fields for your application registration:

      • Name : Add a descriptive name for your application registration, such as RHTPA UI.
      • Supported account types : Choose the appropriate option, Single tenant or Multi-tenant, based on your requirements.
      • Redirect URI > Platform : Select Single-page application (SPA).
      • Redirect URI > URI : Enter the URL where your front-end application is hosted, such as Content from rhtpa.apps.example.com is not included.https://rhtpa.apps.example.com/.

   3. Click Register to create the application registration.

      Note

      Your Application (client) ID is also your Frontend Client ID.

8. Optional. To allow the front-end application to request tokens on behalf of the user.

   1. In the Expose an API section, click Authorized client applications.
   2. Click Add a client application.
   3. Enter the Frontend Client ID.
   4. Check all the boxes for the scopes you want to allow the front-end application to request on behalf of the user.
   5. Click Add application to save the authorized client application.

9. Configure the authentication settings.

   1. Click Authentication from the navigation menu.

   2. Check the following settings:

      • Redirect URIs : Ensure the correct redirect URIs are listed for your front-end application.
      • Implicit grant and hybrid flows : Do not check the boxes for Access tokens or ID tokens.
      • Advanced settings > Allow public client flows : Set to No.
      • Select Single-page application.
   3. Click Save to save the authentication settings changes.

10. Configure the API permissions.

    1. Click API permissions from the navigation menu.

       You can keep Microsoft Graph with the User.Read permission.

    2. Click Add a permission.
    3. Click the My APIs tab.
    4. Select the RHTPA API application registration you created earlier.
    5. Click Delegated permissions.
    6. Check all the boxes for the scopes you defined earlier.
    7. Click Add permissions to save the API permissions.
    8. Optional. You can also grant admin consent for pre-approving the API permissions to avoid users having to consent individually when they log in for the first time. You can do this by clicking Grant admin consent, and then clicking Yes.

11. Configure the token version.

    1. Click Manifest from the navigation menu.

    2. Find the accessTokenAcceptedVersion property in the JSON file, and set change its value from null`to `2:

       "accessTokenAcceptedVersion": 2

       Copy code to clipboard

       This ensures that tokens are using the v2.0 format.

    3. Click Save to save the manifest changes.

12. You now have the Tenant ID, API Client ID, Frontend Client ID, Client Secret, and Scopes values that you need to add Microsoft Entra ID as your OIDC provider in the RHTPA configuration.

    Your Issuer URL will be in the format, Content from login.microsoftonline.com is not included.https://login.microsoftonline.com/TENANT_ID/v2.0, and the token endpoint will be Content from login.microsoftonline.com is not included.https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token.

13. Create a new configuration map for the scope assignments.

    1. Open a terminal on your workstation.

    2. Create a new auth.yaml file:

       $ touch auth.yaml

       Copy code to clipboard

    3. Copy this content to the clipboard:

       authentication:
         clients:
           # Microsoft Entra ID Frontend Client (for user sign-in)
           - clientId: FRONTEND_CLIENT_ID
             issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
             requiredAudience: API_CLIENT_ID
       
             scopeMappings:
               "read:document":
                 - "ai"
                 - "read.sbom"
                 - "read.advisory"
                 - "read.importer"
                 - "read.metadata"
                 - "read.sbomGroup"
                 - "read.weakness"
                 - "read.systemInformation"
               "create:document":
                 - "create.sbom"
                 - "create.advisory"
                 - "create.importer"
                 - "create.metadata"
                 - "create.sbomGroup"
                 - "create.weakness"
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
                 - "upload.dataset"
               "update:document":
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
               "delete:document":
                 - "delete.sbom"
                 - "delete.advisory"
                 - "delete.importer"
                 - "delete.metadata"
                 - "delete.sbomGroup"
                 - "delete.vulnerability"
                 - "delete.weakness"
       
           # Microsoft Entra ID CLI/API Client (for client credentials)
           - clientId: API_CLIENT_ID
             issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
             requiredAudience: API_CLIENT_ID
       
             # Extract from 'scope', 'scp', or 'roles' claims
             scopeSelector: "$['scope','scp','roles']"
       
             scopeMappings:
               # App roles from 'roles' claim
               "App.Read.Document":
                 - "ai"
                 - "read.sbom"
                 - "read.advisory"
                 - "read.importer"
                 - "read.metadata"
                 - "read.sbomGroup"
                 - "read.weakness"
                 - "read.systemInformation"
               "App.Create.Document":
                 - "create.sbom"
                 - "create.advisory"
                 - "create.importer"
                 - "create.metadata"
                 - "create.sbomGroup"
                 - "create.weakness"
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
                 - "upload.dataset"
               "App.Update.Document":
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
               "App.Delete.Document":
                 - "delete.sbom"
                 - "delete.advisory"
                 - "delete.importer"
                 - "delete.metadata"
                 - "delete.sbomGroup"
                 - "delete.vulnerability"
                 - "delete.weakness"

       Copy code to clipboard
    4. Open the auth.yaml file for editing.
    5. Paste the clipboard contents into the auth.yaml file, and replace the TENANT_ID, API_CLIENT_ID, and FRONTEND_CLIENT_ID placeholders with your values.
    6. Save and close the auth.yaml file
    7. Log in to the OpenShift web console.
    8. From the navigation menu, expand Workloads, click ConfigMaps.
    9. Click the Create ConfigMap button.
    10. In the Name field, set the value to server-entra-auth, and leave the Immutable checkbox unchecked.
    11. In the Key field, set the value to auth.yaml.
    12. On the Value field, click the Browse…​ button.
    13. Browse to the newly created auth.yaml file, and select it.
    14. Click the *Create button.

14. Open the values-rhtpa.yaml Helm chart file for editing.

    1. Update the oidc section with the following values:

       ...
       oidc:
         issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
         uiScope: "openid profile email offline_access api://API_CLIENT_ID/create:document api://API_CLIENT_ID/read:document api://API_CLIENT_ID/update:document api://API_CLIENT_ID/delete:document"
         loadUser: false
         clients:
           frontend:
             clientId: FRONTEND_CLIENT_ID
           cli:
             clientId: API_CLIENT_ID
             clientSecret: CLIENT_SECRET
       ...

       Copy code to clipboard

       Replace the API_CLIENT_ID, FRONTEND_CLIENT_ID, and CLIENT_SECRET placeholders with your values.

       Also, under the oidc section, set the loadUser option to false.

    2. Under the authenticator section, add the new configuration map reference as follows:

       ...
       authenticator:
         configMapRef:
           name: server-entra-auth
           key: auth.yaml
       ...

       Copy code to clipboard
    3. Save and close the values-rhtpa.yaml Helm chart file.

15. If you are configuring Microsoft Entra ID during the deployment of RHTPA, continue with the installation procedure.

    If you are configuring Microsoft Entra ID after RHTPA is deployed, you need to upgrade your RHTPA Helm release to apply the new OIDC configuration. You can do this by running the following command:

    $ helm upgrade --install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values values-rhtpa.yaml --values values-importers.yaml --set-string appDomain=$APP_DOMAIN_URL

    Copy code to clipboard