Skip to content

Commit 0e9a66e

Browse files
author
Rob Tjalma
authored
Merge pull request #54 from com-pas/add_validator_client
Add validator client to KeyCloak
2 parents 5bdfc19 + e4f42c0 commit 0e9a66e

File tree

2 files changed

+108
-51
lines changed

2 files changed

+108
-51
lines changed

‎README.md‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ To start all configured services using BaseX, run the following two commands:
1616

1717
```
1818
# Build (if needed) and start all the containers in the background.
19-
docker-compose -f compas/docker-compose-basex.yml up -d --build
19+
docker-compose --env-file compas/.env -f compas/docker-compose-basex.yml up -d --build
2020
```
2121

2222
This command will first build the custom images for Keycloak and the Reverse Proxy and then start all containers.
@@ -50,7 +50,7 @@ To start all configured services using PostgreSQL, run the following two command
5050

5151
```
5252
# Build (if needed) and start all the containers in the background.
53-
docker-compose -f compas/docker-compose-postgresql.yml up -d --build
53+
docker-compose --env-file compas/.env -f compas/docker-compose-postgresql.yml up -d --build
5454
```
5555

5656
This command will first build the custom images for Keycloak and the Reverse Proxy and then start all containers.
@@ -87,10 +87,6 @@ The following Keycloak attributes have been added:
8787
- **CRUD roles for the SCL Data Service**: Create, Read, Update and Delete roles have been added to the SCL Data Service client.
8888
When interacting with the SCL Data Service, a JWT token needs to have certain roles before interaction is possible.
8989
These roles are assigned to certain users (see below).
90-
- **CoMPAS Group**: A CoMPAS demo group has been added.
91-
- **A Demo User**: A Demo user without specific roles.
92-
- Username: 'user'
93-
- Password: 'user'.
9490
- **A SCL Data Editor**: A user with the roles 'Create', 'Read', 'Update' and 'Delete'. This way, it has read and write access to the SCL Data Service.
9591
- Username: scl-data-editor
9692
- Password: editor

‎compas/keycloak/keycloak_compas_realm.json‎

Lines changed: 106 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -549,6 +549,14 @@
549549
"containerId" : "e937c531-691f-4979-83b8-8ab90d390e17",
550550
"attributes" : { }
551551
} ],
552+
"scl-validator" : [ {
553+
"id" : "2ecc19e1-028e-4f00-aa26-458bb699b174",
554+
"name" : "USER",
555+
"composite" : false,
556+
"clientRole" : true,
557+
"containerId" : "666fec04-a2d5-4242-bfb5-e73877f76162",
558+
"attributes" : { }
559+
} ],
552560
"account" : [ {
553561
"id" : "cba909f5-4514-49d7-9f54-cafb98c48b7d",
554562
"name" : "view-profile",
@@ -708,25 +716,6 @@
708716
"realmRoles" : [ "default-roles-compas", "compas-admin" ],
709717
"notBefore" : 1629874418,
710718
"groups" : [ ]
711-
}, {
712-
"id" : "68f82bd0-4ad7-4737-ada1-b280dd13133d",
713-
"createdTimestamp" : 1627390619550,
714-
"username" : "god",
715-
"enabled" : true,
716-
"totp" : false,
717-
"emailVerified" : true,
718-
"credentials" : [ {
719-
"id" : "8c6e20c3-bb15-491a-98d3-28bea23efc8d",
720-
"type" : "password",
721-
"createdDate" : 1627390627798,
722-
"secretData" : "{\"value\":\"9TILmNOeVg7AjbSZIHcAircjZkPzTRT+AeXJSr/0ihUVKuxNbzZO6pB78RZ/g+HE8dg/7/zMJKSBcs+X1hNDrg==\",\"salt\":\"2WiaUpMnwp0MxzgVi8zD5g==\",\"additionalParameters\":{}}",
723-
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
724-
} ],
725-
"disableableCredentialTypes" : [ ],
726-
"requiredActions" : [ ],
727-
"realmRoles" : [ "default-roles-compas", "compas-user", "compas-admin" ],
728-
"notBefore" : 0,
729-
"groups" : [ ]
730719
}, {
731720
"id" : "0c7212ac-9308-490d-9f9a-a74702c86c71",
732721
"createdTimestamp" : 1629180641137,
@@ -750,6 +739,7 @@
750739
"scl-auto-alignment" : [ "USER" ],
751740
"scl-data-service" : [ "SCD_READ" ],
752741
"cim-mapping" : [ "USER" ],
742+
"scl-validator" : [ "USER" ],
753743
"openscd" : [ "USER" ]
754744
},
755745
"notBefore" : 1629874396,
@@ -773,6 +763,9 @@
773763
"disableableCredentialTypes" : [ ],
774764
"requiredActions" : [ ],
775765
"realmRoles" : [ "default-roles-compas" ],
766+
"clientRoles" : {
767+
"scl-validator" : [ "USER" ]
768+
},
776769
"notBefore" : 1629874406,
777770
"groups" : [ "/compas-editor-group", "/compas-read-group" ]
778771
}, {
@@ -794,6 +787,9 @@
794787
"disableableCredentialTypes" : [ ],
795788
"requiredActions" : [ ],
796789
"realmRoles" : [ "default-roles-compas" ],
790+
"clientRoles" : {
791+
"scl-validator" : [ "USER" ]
792+
},
797793
"notBefore" : 1629874401,
798794
"groups" : [ "/compas-read-group" ]
799795
}, {
@@ -1228,6 +1224,71 @@
12281224
} ],
12291225
"defaultClientScopes" : [ "web-origins", "roles", "profile", "email" ],
12301226
"optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
1227+
}, {
1228+
"id" : "666fec04-a2d5-4242-bfb5-e73877f76162",
1229+
"clientId" : "scl-validator",
1230+
"name" : "SCL Validator Service",
1231+
"description" : "The SCL Validator Service to validate SCL Files",
1232+
"rootUrl" : "http://##COMPAS_HOSTNAME##/",
1233+
"adminUrl" : "http://##COMPAS_HOSTNAME##/",
1234+
"surrogateAuthRequired" : false,
1235+
"enabled" : true,
1236+
"alwaysDisplayInConsole" : false,
1237+
"clientAuthenticatorType" : "client-secret",
1238+
"redirectUris" : [ "http://##COMPAS_HOSTNAME##/*" ],
1239+
"webOrigins" : [ "http://##COMPAS_HOSTNAME##" ],
1240+
"notBefore" : 0,
1241+
"bearerOnly" : false,
1242+
"consentRequired" : false,
1243+
"standardFlowEnabled" : true,
1244+
"implicitFlowEnabled" : false,
1245+
"directAccessGrantsEnabled" : true,
1246+
"serviceAccountsEnabled" : false,
1247+
"publicClient" : true,
1248+
"frontchannelLogout" : false,
1249+
"protocol" : "openid-connect",
1250+
"attributes" : {
1251+
"id.token.as.detached.signature" : "false",
1252+
"saml.assertion.signature" : "false",
1253+
"saml.force.post.binding" : "false",
1254+
"saml.multivalued.roles" : "false",
1255+
"saml.encrypt" : "false",
1256+
"oauth2.device.authorization.grant.enabled" : "false",
1257+
"backchannel.logout.revoke.offline.tokens" : "false",
1258+
"saml.server.signature" : "false",
1259+
"saml.server.signature.keyinfo.ext" : "false",
1260+
"use.refresh.tokens" : "true",
1261+
"exclude.session.state.from.auth.response" : "false",
1262+
"oidc.ciba.grant.enabled" : "false",
1263+
"saml.artifact.binding" : "false",
1264+
"backchannel.logout.session.required" : "true",
1265+
"client_credentials.use_refresh_token" : "false",
1266+
"saml_force_name_id_format" : "false",
1267+
"require.pushed.authorization.requests" : "false",
1268+
"saml.client.signature" : "false",
1269+
"tls.client.certificate.bound.access.tokens" : "false",
1270+
"saml.authnstatement" : "false",
1271+
"display.on.consent.screen" : "false",
1272+
"saml.onetimeuse.condition" : "false"
1273+
},
1274+
"authenticationFlowBindingOverrides" : { },
1275+
"fullScopeAllowed" : true,
1276+
"nodeReRegistrationTimeout" : -1,
1277+
"protocolMappers" : [ {
1278+
"id" : "434040a6-dbd7-4859-970d-b366322f4ea1",
1279+
"name" : "scl-validator",
1280+
"protocol" : "openid-connect",
1281+
"protocolMapper" : "oidc-audience-mapper",
1282+
"consentRequired" : false,
1283+
"config" : {
1284+
"included.client.audience" : "scl-validator",
1285+
"id.token.claim" : "false",
1286+
"access.token.claim" : "true",
1287+
"userinfo.token.claim" : "false"
1288+
}
1289+
} ],
1290+
"defaultClientScopes" : [ "web-origins", "roles", "profile", "email" ],
1291+
"optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
12311292
}, {
12321293
"id" : "577cc4e9-88f3-444b-bc5b-696863c6a625",
12331294
"clientId" : "security-admin-console",
@@ -1743,7 +1804,7 @@
17431804
"subType" : "authenticated",
17441805
"subComponents" : { },
17451806
"config" : {
1746-
"allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "saml-user-property-mapper", "saml-role-list-mapper", "saml-user-attribute-mapper", "oidc-usermodel-property-mapper" ]
1807+
"allowed-protocol-mapper-types" : [ "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper" ]
17471808
}
17481809
}, {
17491810
"id" : "1df6c9e4-319c-43c1-a0f8-e97a9741cd36",
@@ -1752,7 +1813,7 @@
17521813
"subType" : "anonymous",
17531814
"subComponents" : { },
17541815
"config" : {
1755-
"allowed-protocol-mapper-types" : [ "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper" ]
1816+
"allowed-protocol-mapper-types" : [ "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "oidc-address-mapper", "oidc-usermodel-property-mapper" ]
17561817
}
17571818
}, {
17581819
"id" : "276e7a01-2481-494c-a009-81965ed751a3",
@@ -1848,7 +1909,7 @@
18481909
"internationalizationEnabled" : false,
18491910
"supportedLocales" : [ ],
18501911
"authenticationFlows" : [ {
1851-
"id" : "7fb2cb1b-07a1-4d64-9f21-a942107e7df0",
1912+
"id" : "a1d83d0c-2ff1-45e8-b287-e49541188a02",
18521913
"alias" : "Account verification options",
18531914
"description" : "Method with which to verity the existing account",
18541915
"providerId" : "basic-flow",
@@ -1870,7 +1931,7 @@
18701931
"autheticatorFlow" : true
18711932
} ]
18721933
}, {
1873-
"id" : "427e24cc-b71e-49ef-a6cd-7ed6c623e870",
1934+
"id" : "b73f0e46-ebb2-4383-858e-9a11f2ba3eba",
18741935
"alias" : "Authentication Options",
18751936
"description" : "Authentication options.",
18761937
"providerId" : "basic-flow",
@@ -1899,7 +1960,7 @@
18991960
"autheticatorFlow" : false
19001961
} ]
19011962
}, {
1902-
"id" : "e23dca88-6596-49d6-8b22-ae5b204a2d08",
1963+
"id" : "704d8eb5-e561-4326-8cd4-f7132cebf87d",
19031964
"alias" : "Browser - Conditional OTP",
19041965
"description" : "Flow to determine if the OTP is required for the authentication",
19051966
"providerId" : "basic-flow",
@@ -1921,7 +1982,7 @@
19211982
"autheticatorFlow" : false
19221983
} ]
19231984
}, {
1924-
"id" : "486bd779-5f66-4c66-a195-0c7615216e8f",
1985+
"id" : "c82e1520-2440-4583-837f-ca66c21e9742",
19251986
"alias" : "Direct Grant - Conditional OTP",
19261987
"description" : "Flow to determine if the OTP is required for the authentication",
19271988
"providerId" : "basic-flow",
@@ -1943,7 +2004,7 @@
19432004
"autheticatorFlow" : false
19442005
} ]
19452006
}, {
1946-
"id" : "f3b4a1ac-7836-48e4-be60-b5591ef4dc0c",
2007+
"id" : "a01d163b-462b-4ab5-8e62-5988cbaed17d",
19472008
"alias" : "First broker login - Conditional OTP",
19482009
"description" : "Flow to determine if the OTP is required for the authentication",
19492010
"providerId" : "basic-flow",
@@ -1965,7 +2026,7 @@
19652026
"autheticatorFlow" : false
19662027
} ]
19672028
}, {
1968-
"id" : "3c90d795-f083-4d7d-89be-d570786d94fe",
2029+
"id" : "84372c8d-f85a-441b-9368-43eae1deb05f",
19692030
"alias" : "Handle Existing Account",
19702031
"description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
19712032
"providerId" : "basic-flow",
@@ -1987,7 +2048,7 @@
19872048
"autheticatorFlow" : true
19882049
} ]
19892050
}, {
1990-
"id" : "156a87ea-eec7-491c-9dd6-eed787b32301",
2051+
"id" : "6c819b6d-8435-49e1-998d-5c69a4386a4d",
19912052
"alias" : "Reset - Conditional OTP",
19922053
"description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
19932054
"providerId" : "basic-flow",
@@ -2009,7 +2070,7 @@
20092070
"autheticatorFlow" : false
20102071
} ]
20112072
}, {
2012-
"id" : "ffbd38f3-304a-4802-82a9-8e48453a8223",
2073+
"id" : "4098edf6-2715-4724-ba49-264caf4718fa",
20132074
"alias" : "User creation or linking",
20142075
"description" : "Flow for the existing/non-existing user alternatives",
20152076
"providerId" : "basic-flow",
@@ -2032,7 +2093,7 @@
20322093
"autheticatorFlow" : true
20332094
} ]
20342095
}, {
2035-
"id" : "b5c19f99-240f-47c0-bfc7-cbaab48c6412",
2096+
"id" : "836a4d48-a93c-40f3-ad99-17262d6804fe",
20362097
"alias" : "Verify Existing Account by Re-authentication",
20372098
"description" : "Reauthentication of existing account",
20382099
"providerId" : "basic-flow",
@@ -2054,7 +2115,7 @@
20542115
"autheticatorFlow" : true
20552116
} ]
20562117
}, {
2057-
"id" : "032b408c-d9ef-4371-92cb-f754fd54285a",
2118+
"id" : "1b3e4c48-a642-452f-86e6-a6963f4d0748",
20582119
"alias" : "browser",
20592120
"description" : "browser based authentication",
20602121
"providerId" : "basic-flow",
@@ -2090,7 +2151,7 @@
20902151
"autheticatorFlow" : true
20912152
} ]
20922153
}, {
2093-
"id" : "9a3964ec-1839-4f2d-9dcf-93e6dbe2d069",
2154+
"id" : "cce675ab-038f-4e16-a39b-b108e855fc58",
20942155
"alias" : "clients",
20952156
"description" : "Base authentication for clients",
20962157
"providerId" : "client-flow",
@@ -2126,7 +2187,7 @@
21262187
"autheticatorFlow" : false
21272188
} ]
21282189
}, {
2129-
"id" : "a7d0f016-5d73-4d74-be53-1ad54a328464",
2190+
"id" : "0a0c2daa-e8b9-4a29-b4f0-5aa46c8ef7f9",
21302191
"alias" : "direct grant",
21312192
"description" : "OpenID Connect Resource Owner Grant",
21322193
"providerId" : "basic-flow",
@@ -2155,7 +2216,7 @@
21552216
"autheticatorFlow" : true
21562217
} ]
21572218
}, {
2158-
"id" : "d9fc1e42-ef91-4f30-9df9-b178f94558b5",
2219+
"id" : "8da84853-6899-44a5-b474-6c80e399fb7f",
21592220
"alias" : "docker auth",
21602221
"description" : "Used by Docker clients to authenticate against the IDP",
21612222
"providerId" : "basic-flow",
@@ -2170,7 +2231,7 @@
21702231
"autheticatorFlow" : false
21712232
} ]
21722233
}, {
2173-
"id" : "45167191-e9a0-46fc-b3e0-84042ba22a04",
2234+
"id" : "e1fa38bf-cda7-46ba-bf39-c89409fa1c1f",
21742235
"alias" : "first broker login",
21752236
"description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
21762237
"providerId" : "basic-flow",
@@ -2193,7 +2254,7 @@
21932254
"autheticatorFlow" : true
21942255
} ]
21952256
}, {
2196-
"id" : "454e5e3b-ba60-43c8-9c7b-391971deec3e",
2257+
"id" : "812591ad-8326-4d81-8e66-137906e15743",
21972258
"alias" : "forms",
21982259
"description" : "Username, password, otp and other auth forms.",
21992260
"providerId" : "basic-flow",
@@ -2215,7 +2276,7 @@
22152276
"autheticatorFlow" : true
22162277
} ]
22172278
}, {
2218-
"id" : "3aff2caa-dcae-4e4a-b452-edfbff9ad09a",
2279+
"id" : "7d5bc978-9171-42af-b450-1a236f9b4583",
22192280
"alias" : "http challenge",
22202281
"description" : "An authentication flow based on challenge-response HTTP Authentication Schemes",
22212282
"providerId" : "basic-flow",
@@ -2237,7 +2298,7 @@
22372298
"autheticatorFlow" : true
22382299
} ]
22392300
}, {
2240-
"id" : "891f5cf9-7c67-477a-9b9a-052426796e8c",
2301+
"id" : "b66de3a5-95d3-4dfd-b2ae-c720f8fa775b",
22412302
"alias" : "registration",
22422303
"description" : "registration flow",
22432304
"providerId" : "basic-flow",
@@ -2253,7 +2314,7 @@
22532314
"autheticatorFlow" : true
22542315
} ]
22552316
}, {
2256-
"id" : "ada03e27-e052-4a57-9ee0-5b432edfe066",
2317+
"id" : "e8574154-1eb8-463f-a857-a86a34726749",
22572318
"alias" : "registration form",
22582319
"description" : "registration form",
22592320
"providerId" : "form-flow",
@@ -2289,7 +2350,7 @@
22892350
"autheticatorFlow" : false
22902351
} ]
22912352
}, {
2292-
"id" : "bf724311-2f1a-4667-ac09-0e660db83f7d",
2353+
"id" : "304f056b-eb54-4d01-9b3b-a783cd448323",
22932354
"alias" : "reset credentials",
22942355
"description" : "Reset credentials for a user if they forgot their password or something",
22952356
"providerId" : "basic-flow",
@@ -2325,7 +2386,7 @@
23252386
"autheticatorFlow" : true
23262387
} ]
23272388
}, {
2328-
"id" : "27b4a61a-89c6-4ce7-b4bc-7844b2384980",
2389+
"id" : "dfdd4d4f-c330-4f88-a40a-54a62cdb4dfa",
23292390
"alias" : "saml ecp",
23302391
"description" : "SAML ECP Profile Authentication Flow",
23312392
"providerId" : "basic-flow",
@@ -2341,13 +2402,13 @@
23412402
} ]
23422403
} ],
23432404
"authenticatorConfig" : [ {
2344-
"id" : "3871e726-fb96-40e9-ba7a-a9c5f3b5e239",
2405+
"id" : "18b6cad0-0c47-4eee-91bd-b8801dfcee9f",
23452406
"alias" : "create unique user config",
23462407
"config" : {
23472408
"require.password.update.after.registration" : "false"
23482409
}
23492410
}, {
2350-
"id" : "1b6e98b2-afd9-4326-bcaf-e68047699d81",
2411+
"id" : "c04d141f-0bd0-4d6c-95bf-5fffaf932986",
23512412
"alias" : "review profile config",
23522413
"config" : {
23532414
"update.profile.on.first.login" : "missing"
@@ -2424,12 +2485,12 @@
24242485
"clientOfflineSessionMaxLifespan" : "0",
24252486
"oauth2DevicePollingInterval" : "5",
24262487
"clientSessionIdleTimeout" : "0",
2427-
"clientSessionMaxLifespan" : "0",
24282488
"parRequestUriLifespan" : "60",
2489+
"clientSessionMaxLifespan" : "0",
24292490
"clientOfflineSessionIdleTimeout" : "0",
24302491
"cibaInterval" : "5"
24312492
},
2432-
"keycloakVersion" : "15.0.2",
2493+
"keycloakVersion" : "16.1.1",
24332494
"userManagedAccessAllowed" : false,
24342495
"clientProfiles" : {
24352496
"profiles" : [ ]

0 commit comments

Comments
 (0)