Skip to content

Commit a070b17

Browse files
filippomcfilippomc
committed
CH-231 refactorAPI user init
1 parent bff42a6 commit a070b17

File tree

2 files changed

+60
-62
lines changed

2 files changed

+60
-62
lines changed

‎applications/accounts/scripts/create_api_user.sh‎

Lines changed: 56 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,58 @@
11
#!/bin/bash
22

3-
NAMESPACE=${CH_ACCOUNTS_REALM}
4-
USERNAME=admin_api
5-
PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password)
6-
7-
echo "Checking if API user exists..."
8-
9-
# Check if user already exists
10-
if /opt/keycloak/bin/kcadm.sh get users -q "username=$USERNAME" | grep -q "$USERNAME"; then
11-
echo "ERROR: API user $USERNAME already exists, but password is out of sync. You may need to reset it manually."
12-
# /opt/keycloak/bin/kcadm.sh set-password --username "$USERNAME" --new-password "$PASSWORD"
13-
# Removed automatic password reset as that would only work if the main admin password is unchanged from the default password
14-
# That would create the false impression that the password is reset successfully when in fact it has not on production systems
15-
exit 0
16-
fi
17-
18-
echo "Creating API user $USERNAME"
19-
set -e
20-
# create the user and reload keycloak
21-
/opt/keycloak/bin/kcadm.sh create users -s "username=$USERNAME" -s enabled=True
22-
/opt/keycloak/bin/kcadm.sh set-password --username "$USERNAME" --new-password "$PASSWORD"
23-
/opt/keycloak/bin/kcadm.sh add-roles --uusername "$USERNAME" --rolename admin
24-
25-
echo "API user created successfully"
3+
4+
API_USERNAME="admin_api"
5+
API_PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password 2>/dev/null || echo "")
6+
7+
echo "create_api_user: waiting for Keycloak to start..."
8+
9+
# Wait for Keycloak to be ready - just give it some time to start up
10+
sleep 120s
11+
12+
echo "Attempting authentication..."
13+
14+
# First, try to authenticate as admin_api
15+
if [ -n "$API_PASSWORD" ] && /opt/keycloak/bin/kcadm.sh config credentials \
16+
--server http://localhost:8080 \
17+
--realm master \
18+
--user "$API_USERNAME" \
19+
--password "$API_PASSWORD" 2>/dev/null; then
20+
echo "Successfully authenticated as $API_USERNAME"
21+
echo "Startup scripts not needed (admin_api user already exists)"
22+
else
23+
echo "admin_api user does not exist or authentication failed. Authenticating as bootstrap admin to create the user..."
24+
25+
# Authenticate as bootstrap admin to create admin_api user
26+
if ! /opt/keycloak/bin/kcadm.sh config credentials \
27+
--server http://localhost:8080 \
28+
--realm master \
29+
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
30+
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD"; then
31+
echo "ERROR: Failed to authenticate as bootstrap admin. You must manually create the ${API_USERNAME} with password from the secret api_user_password."
32+
echo "Continuing without running startup scripts..."
33+
exit 0
34+
fi
35+
36+
echo "Successfully authenticated as bootstrap admin"
37+
38+
echo "Checking if API user exists..."
39+
40+
# Check if user already exists
41+
if /opt/keycloak/bin/kcadm.sh get users -q "username=$API_USERNAME" | grep -q "$API_USERNAME"; then
42+
echo "ERROR: API user $API_USERNAME already exists, but password is out of sync. You may need to reset it manually."
43+
# /opt/keycloak/bin/kcadm.sh set-password --username "$API_USERNAME" --new-password "$API_PASSWORD"
44+
# Removed automatic password reset as that would only work if the main admin password is unchanged from the default password
45+
# That would create the false impression that the password is reset successfully when in fact it has not on production systems
46+
exit 0
47+
fi
48+
49+
echo "Creating API user $API_USERNAME"
50+
set -e
51+
# create the user and reload keycloak
52+
/opt/keycloak/bin/kcadm.sh create users -s "username=$API_USERNAME" -s enabled=True
53+
/opt/keycloak/bin/kcadm.sh set-password --username "$API_USERNAME" --new-password "$API_PASSWORD"
54+
/opt/keycloak/bin/kcadm.sh add-roles --uusername "$API_USERNAME" --rolename admin
55+
56+
echo "API user created successfully"
57+
fi
58+

‎applications/accounts/scripts/kc-entrypoint.sh‎

Lines changed: 4 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2,51 +2,16 @@
22

33
/opt/keycloak/bin/kc.sh $@ &
44

5-
API_USERNAME="admin_api"
6-
API_PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password 2>/dev/null || echo "")
75

8-
echo "Waiting for Keycloak to start..."
9-
10-
# Wait for Keycloak to be ready - just give it some time to start up
11-
sleep 120s
12-
13-
echo "Attempting authentication..."
14-
15-
# First, try to authenticate as admin_api
16-
if [ -n "$API_PASSWORD" ] && /opt/keycloak/bin/kcadm.sh config credentials \
17-
--server http://localhost:8080 \
18-
--realm master \
19-
--user "$API_USERNAME" \
20-
--password "$API_PASSWORD" 2>/dev/null; then
21-
echo "Successfully authenticated as $API_USERNAME"
22-
echo "Startup scripts not needed (admin_api user already exists)"
23-
else
24-
echo "admin_api user does not exist or authentication failed. Authenticating as bootstrap admin to create the user..."
25-
26-
# Authenticate as bootstrap admin to create admin_api user
27-
if ! /opt/keycloak/bin/kcadm.sh config credentials \
28-
--server http://localhost:8080 \
29-
--realm master \
30-
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
31-
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD"; then
32-
echo "ERROR: Failed to authenticate as bootstrap admin. Check KC_BOOTSTRAP_ADMIN credentials."
33-
echo "Continuing without running startup scripts..."
34-
wait
35-
exit 0
36-
fi
37-
38-
echo "Successfully authenticated as bootstrap admin"
39-
40-
# Run startup scripts to create admin_api user
41-
for script in /opt/keycloak/startup-scripts/*.sh;
6+
# Run startup scripts to create admin_api user
7+
for script in /opt/keycloak/startup-scripts/*.sh;
428
do
439
echo "Running startup script: $script"
4410
if bash "$script"; then
4511
echo "Successfully executed $script"
4612
else
4713
echo "Warning: $script failed with exit code $?"
48-
fi
49-
done
50-
fi
14+
fi
15+
done
5116

5217
wait

0 commit comments

Comments
 (0)