Skip to content

Commit 5a7ace3

Browse files
author
Dennis Labordus
authored
Merge pull request #24 from com-pas/develop
Develop -> Main
2 parents d7a7bf2 + eaa4524 commit 5a7ace3

File tree

6 files changed

+73
-48
lines changed

6 files changed

+73
-48
lines changed

‎README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,12 @@ To start all configured services, go to the `docker` directory and run the follo
4545
This first command builds 2 containers (keycloak and reverse proxy) and next command starts all CoMPAS services at the same time.
4646
Now, the following services are available:
4747

48-
- open-scd, available at [http://localhost/](http://localhost/). **Not fully working yet, can't communicate with Data Service yet.**
48+
- open-scd, available at [http://localhost/](http://localhost/).
49+
- logout, available at [http://localhost/logout](http://localhost/logout).
4950
- scl-data-service, available at [http://localhost/compas-scl-data-service](http://localhost/compas-scl-data-service).
50-
- basex, available at [http://localhost:1984/](http://localhost:1984/)
5151
- cim-mapping - IEC 61850 mapping, available at [http://localhost/compas-cim-mapping/](http://localhost/compas-cim-mapping/).
52-
- keycloak, available at [http://localhost/auth/](http://localhost/auth/) or direclty if needed [http://localhost:8080/auth/](http://localhost:8080/auth/).
52+
- basex, available at [http://localhost:1984/](http://localhost:1984/)
53+
- keycloak, available at [http://localhost/auth/](http://localhost/auth/) or directly if needed [http://localhost:8089/auth/](http://localhost:8089/auth/).
5354
- Imports the demo configuration.
5455
- reverse-proxy, OpenResty instance that works as a reverse proxy so all services are available through a single port.
5556
- The JWT Access Token is added to the header for all Services, like the SCL Data Service.

‎docker/docker-compose.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,35 +17,39 @@ services:
1717
keycloak:
1818
build: keycloak
1919
ports:
20-
- "8080:8080"
20+
- "8089:8080"
2121
environment:
2222
- KEYCLOAK_FRONTEND_URL=http://localhost/auth/
23+
- PROXY_ADDRESS_FORWARDING=true
2324

2425
scl-data-service:
25-
image: "lfenergycompas/compas-scl-data-service:0.3.0"
26+
image: "lfenergycompas/compas-scl-data-service:0.6.2"
2627
environment:
2728
- BASEX_HOST=basex
2829
- BASEX_PORT=1984
2930
- JWT_VERIFY_KEY=http://keycloak:8080/auth/realms/compas/protocol/openid-connect/certs
3031
- JWT_VERIFY_ISSUER=http://localhost/auth/realms/compas
3132
- JWT_VERIFY_CLIENT_ID=scl-data-service
3233
- JWT_GROUPS_PATH=resource_access/scl-data-service/roles
34+
- USERINFO_NAME_CLAIMNAME=name
35+
- USERINFO_WHO_CLAIMNAME=name
3336
depends_on:
3437
- basex
3538
- keycloak
3639

3740
cim-mapping:
38-
image: "lfenergycompas/compas-cim-mapping:0.2.0"
41+
image: "lfenergycompas/compas-cim-mapping:0.6.0"
3942
environment:
4043
- JWT_VERIFY_KEY=http://keycloak:8080/auth/realms/compas/protocol/openid-connect/certs
4144
- JWT_VERIFY_ISSUER=http://localhost/auth/realms/compas
4245
- JWT_VERIFY_CLIENT_ID=cim-mapping
4346
- JWT_GROUPS_PATH=resource_access/cim-mapping/roles
47+
- USERINFO_WHO_CLAIMNAME=name
4448
depends_on:
4549
- keycloak
4650

4751
open-scd:
48-
image: "lfenergycompas/compas-open-scd:v0.6.0-compas-3"
52+
image: "lfenergycompas/compas-open-scd:v0.7.0-compas-4"
4953
depends_on:
5054
- scl-data-service
5155
- cim-mapping

‎docker/keycloak/keycloak_compas_realm.json‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"id" : "compas",
33
"realm" : "compas",
4-
"notBefore" : 0,
4+
"notBefore" : 1631530948,
55
"defaultSignatureAlgorithm" : "RS256",
66
"revokeRefreshToken" : false,
77
"refreshTokenMaxReuse" : 0,
@@ -958,7 +958,8 @@
958958
"config" : {
959959
"included.client.audience" : "cim-mapping",
960960
"id.token.claim" : "false",
961-
"access.token.claim" : "true"
961+
"access.token.claim" : "true",
962+
"userinfo.token.claim" : "false"
962963
}
963964
} ],
964965
"defaultClientScopes" : [ "web-origins", "roles", "profile", "email" ],
@@ -1001,6 +1002,7 @@
10011002
"backchannel.logout.session.required" : "true",
10021003
"client_credentials.use_refresh_token" : "false",
10031004
"saml_force_name_id_format" : "false",
1005+
"require.pushed.authorization.requests" : "false",
10041006
"saml.client.signature" : "false",
10051007
"tls.client.certificate.bound.access.tokens" : "false",
10061008
"saml.authnstatement" : "false",
@@ -1091,6 +1093,7 @@
10911093
"backchannel.logout.session.required" : "true",
10921094
"client_credentials.use_refresh_token" : "false",
10931095
"saml_force_name_id_format" : "false",
1096+
"require.pushed.authorization.requests" : "false",
10941097
"saml.client.signature" : "false",
10951098
"tls.client.certificate.bound.access.tokens" : "false",
10961099
"saml.authnstatement" : "false",
@@ -1630,7 +1633,7 @@
16301633
"subType" : "authenticated",
16311634
"subComponents" : { },
16321635
"config" : {
1633-
"allowed-protocol-mapper-types" : [ "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper" ]
1636+
"allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper", "saml-user-property-mapper" ]
16341637
}
16351638
}, {
16361639
"id" : "1df6c9e4-319c-43c1-a0f8-e97a9741cd36",
@@ -1639,7 +1642,7 @@
16391642
"subType" : "anonymous",
16401643
"subComponents" : { },
16411644
"config" : {
1642-
"allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "saml-user-property-mapper", "oidc-address-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper" ]
1645+
"allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-role-list-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper" ]
16431646
}
16441647
}, {
16451648
"id" : "276e7a01-2481-494c-a009-81965ed751a3",
@@ -1693,6 +1696,12 @@
16931696
"subComponents" : { },
16941697
"config" : { }
16951698
} ],
1699+
"org.keycloak.userprofile.UserProfileProvider" : [ {
1700+
"id" : "8e0ccee3-891c-4dfc-919c-0e323e3fc048",
1701+
"providerId" : "declarative-user-profile",
1702+
"subComponents" : { },
1703+
"config" : { }
1704+
} ],
16961705
"org.keycloak.keys.KeyProvider" : [ {
16971706
"id" : "49476e47-e217-44bf-8a49-18da0d28c330",
16981707
"name" : "rsa-generated",
@@ -1729,7 +1738,7 @@
17291738
"internationalizationEnabled" : false,
17301739
"supportedLocales" : [ ],
17311740
"authenticationFlows" : [ {
1732-
"id" : "0b70f6ce-2def-4002-9536-e30ef5b51109",
1741+
"id" : "47735bac-4f25-4640-95cc-7768e936100f",
17331742
"alias" : "Account verification options",
17341743
"description" : "Method with which to verity the existing account",
17351744
"providerId" : "basic-flow",
@@ -1751,7 +1760,7 @@
17511760
"autheticatorFlow" : true
17521761
} ]
17531762
}, {
1754-
"id" : "510f4a83-673e-43cb-8f1b-3f3dea901804",
1763+
"id" : "3474fd7f-5fdb-41d9-81e0-370d5864483b",
17551764
"alias" : "Authentication Options",
17561765
"description" : "Authentication options.",
17571766
"providerId" : "basic-flow",
@@ -1780,7 +1789,7 @@
17801789
"autheticatorFlow" : false
17811790
} ]
17821791
}, {
1783-
"id" : "f596697e-ae08-4371-a742-42dbab302b43",
1792+
"id" : "93be177f-4477-4edb-ade0-1026a6c57a6d",
17841793
"alias" : "Browser - Conditional OTP",
17851794
"description" : "Flow to determine if the OTP is required for the authentication",
17861795
"providerId" : "basic-flow",
@@ -1802,7 +1811,7 @@
18021811
"autheticatorFlow" : false
18031812
} ]
18041813
}, {
1805-
"id" : "e5bd8472-95b6-4182-bf71-48ac7d57ee9d",
1814+
"id" : "b2313c20-b215-47e5-952d-4e10a83b25fd",
18061815
"alias" : "Direct Grant - Conditional OTP",
18071816
"description" : "Flow to determine if the OTP is required for the authentication",
18081817
"providerId" : "basic-flow",
@@ -1824,7 +1833,7 @@
18241833
"autheticatorFlow" : false
18251834
} ]
18261835
}, {
1827-
"id" : "167776d0-db42-44ea-888a-fa4fca4cb6e1",
1836+
"id" : "55afb317-43e1-4a0e-8461-a16c328dca8c",
18281837
"alias" : "First broker login - Conditional OTP",
18291838
"description" : "Flow to determine if the OTP is required for the authentication",
18301839
"providerId" : "basic-flow",
@@ -1846,7 +1855,7 @@
18461855
"autheticatorFlow" : false
18471856
} ]
18481857
}, {
1849-
"id" : "d8f35e9f-8eb4-4e8c-ac80-e1f09568b9ad",
1858+
"id" : "145db225-ffaf-4bd6-8360-2a495520bd84",
18501859
"alias" : "Handle Existing Account",
18511860
"description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
18521861
"providerId" : "basic-flow",
@@ -1868,7 +1877,7 @@
18681877
"autheticatorFlow" : true
18691878
} ]
18701879
}, {
1871-
"id" : "a1ea2aff-8cd8-4858-b88a-3cc3541fd202",
1880+
"id" : "ba40de9e-306c-485a-8687-5c86abf79fa2",
18721881
"alias" : "Reset - Conditional OTP",
18731882
"description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
18741883
"providerId" : "basic-flow",
@@ -1890,7 +1899,7 @@
18901899
"autheticatorFlow" : false
18911900
} ]
18921901
}, {
1893-
"id" : "2c046f6c-1ebb-4413-bd0b-60e75af8a1d5",
1902+
"id" : "80d844c8-429e-49ea-8e08-4960bde67568",
18941903
"alias" : "User creation or linking",
18951904
"description" : "Flow for the existing/non-existing user alternatives",
18961905
"providerId" : "basic-flow",
@@ -1913,7 +1922,7 @@
19131922
"autheticatorFlow" : true
19141923
} ]
19151924
}, {
1916-
"id" : "9c8ba2e7-e552-4e08-914a-918dae66382f",
1925+
"id" : "a97f2d07-45a7-4445-b869-20795baf4dcb",
19171926
"alias" : "Verify Existing Account by Re-authentication",
19181927
"description" : "Reauthentication of existing account",
19191928
"providerId" : "basic-flow",
@@ -1935,7 +1944,7 @@
19351944
"autheticatorFlow" : true
19361945
} ]
19371946
}, {
1938-
"id" : "2c7d3895-0f00-4aae-acda-1fe3d1a460be",
1947+
"id" : "e8f6310f-8871-4161-9470-7eab44101e64",
19391948
"alias" : "browser",
19401949
"description" : "browser based authentication",
19411950
"providerId" : "basic-flow",
@@ -1971,7 +1980,7 @@
19711980
"autheticatorFlow" : true
19721981
} ]
19731982
}, {
1974-
"id" : "e3ad3625-fda3-43c6-a818-e5c70ef135f2",
1983+
"id" : "3a8bdb67-f2fc-472e-b5c1-2eb41f053dd0",
19751984
"alias" : "clients",
19761985
"description" : "Base authentication for clients",
19771986
"providerId" : "client-flow",
@@ -2007,7 +2016,7 @@
20072016
"autheticatorFlow" : false
20082017
} ]
20092018
}, {
2010-
"id" : "1ddd9c0e-d7b5-4784-9aac-6a034d8eee69",
2019+
"id" : "779ef763-3b57-465d-94de-559b65ccf58f",
20112020
"alias" : "direct grant",
20122021
"description" : "OpenID Connect Resource Owner Grant",
20132022
"providerId" : "basic-flow",
@@ -2036,7 +2045,7 @@
20362045
"autheticatorFlow" : true
20372046
} ]
20382047
}, {
2039-
"id" : "8836c38f-aef1-46fe-8369-606aca0f44b9",
2048+
"id" : "f45d8704-6179-491b-b70a-6e234fa3f532",
20402049
"alias" : "docker auth",
20412050
"description" : "Used by Docker clients to authenticate against the IDP",
20422051
"providerId" : "basic-flow",
@@ -2051,7 +2060,7 @@
20512060
"autheticatorFlow" : false
20522061
} ]
20532062
}, {
2054-
"id" : "547b29d8-2a30-4b68-bfe6-ee83edb9ff53",
2063+
"id" : "4c97b8eb-50bc-4be9-a3cd-7164502e4d25",
20552064
"alias" : "first broker login",
20562065
"description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
20572066
"providerId" : "basic-flow",
@@ -2074,7 +2083,7 @@
20742083
"autheticatorFlow" : true
20752084
} ]
20762085
}, {
2077-
"id" : "94601b35-bc2b-4473-92a6-57c82211c679",
2086+
"id" : "1206b0d1-0126-47af-8574-88b6a182460c",
20782087
"alias" : "forms",
20792088
"description" : "Username, password, otp and other auth forms.",
20802089
"providerId" : "basic-flow",
@@ -2096,7 +2105,7 @@
20962105
"autheticatorFlow" : true
20972106
} ]
20982107
}, {
2099-
"id" : "58e72ae4-c436-4552-9b30-5e43dadda814",
2108+
"id" : "654f2651-edde-400e-a1f5-b86392802919",
21002109
"alias" : "http challenge",
21012110
"description" : "An authentication flow based on challenge-response HTTP Authentication Schemes",
21022111
"providerId" : "basic-flow",
@@ -2118,7 +2127,7 @@
21182127
"autheticatorFlow" : true
21192128
} ]
21202129
}, {
2121-
"id" : "8c7edef9-f089-4b3d-a91c-0ca0361a50b6",
2130+
"id" : "ce53a107-0e6c-4b2a-b27d-6bc0ffbce21b",
21222131
"alias" : "registration",
21232132
"description" : "registration flow",
21242133
"providerId" : "basic-flow",
@@ -2134,7 +2143,7 @@
21342143
"autheticatorFlow" : true
21352144
} ]
21362145
}, {
2137-
"id" : "589ff3f9-1bea-40f2-9bf7-9b156a23ace9",
2146+
"id" : "6af6a8b4-d186-4363-aa9d-7f093815cce3",
21382147
"alias" : "registration form",
21392148
"description" : "registration form",
21402149
"providerId" : "form-flow",
@@ -2170,7 +2179,7 @@
21702179
"autheticatorFlow" : false
21712180
} ]
21722181
}, {
2173-
"id" : "a0387112-af87-4804-b019-b8e8e800622e",
2182+
"id" : "15f7d277-f0b3-48b9-a64b-48ae16663d87",
21742183
"alias" : "reset credentials",
21752184
"description" : "Reset credentials for a user if they forgot their password or something",
21762185
"providerId" : "basic-flow",
@@ -2206,7 +2215,7 @@
22062215
"autheticatorFlow" : true
22072216
} ]
22082217
}, {
2209-
"id" : "756273e1-58ef-41b3-8bd9-c21a7c065f17",
2218+
"id" : "fc0b0fee-985e-4885-a0ff-d7eb4d48a4cd",
22102219
"alias" : "saml ecp",
22112220
"description" : "SAML ECP Profile Authentication Flow",
22122221
"providerId" : "basic-flow",
@@ -2222,13 +2231,13 @@
22222231
} ]
22232232
} ],
22242233
"authenticatorConfig" : [ {
2225-
"id" : "d0a7a250-71d1-41df-9c91-c9007f9d8fad",
2234+
"id" : "a123d762-dbe5-408a-b2bd-09695596c0cc",
22262235
"alias" : "create unique user config",
22272236
"config" : {
22282237
"require.password.update.after.registration" : "false"
22292238
}
22302239
}, {
2231-
"id" : "8978bf31-cd77-4947-9331-02c92b0d7751",
2240+
"id" : "717f4403-9133-441c-89c1-42d044a5b29a",
22322241
"alias" : "review profile config",
22332242
"config" : {
22342243
"update.profile.on.first.login" : "missing"

‎docker/reverse-proxy/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@
55
FROM openresty/openresty:alpine-fat
66

77
RUN mkdir /var/log/nginx
8+
89
RUN apk add --no-cache openssl-dev
910
RUN apk add --no-cache git
1011
RUN apk add --no-cache gcc
12+
1113
RUN luarocks install lua-resty-openidc
1214

1315
RUN mkdir -p /etc/nginx/include

‎docker/reverse-proxy/authenticate.include‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
access_by_lua_block {
22
local opts = {
3-
redirect_uri_path = "/redirect_uri",
3+
redirect_uri = "http://localhost/redirect_uri",
44
discovery = "http://keycloak:8080/auth/realms/compas/.well-known/openid-configuration",
55
client_id = "openscd",
66
redirect_uri_scheme = "http",
@@ -12,7 +12,7 @@ access_by_lua_block {
1212
}
1313

1414
-- call introspect for OAuth 2.0 Bearer Access Token validation
15-
local res, err, _, session = require("resty.openidc").authenticate(opts)
15+
local res, err = require("resty.openidc").authenticate(opts)
1616

1717
if err then
1818
ngx.status = 403

0 commit comments

Comments
 (0)