Basic keycloak bootstrapping

Author: alukach

auth/authentication/eoapi-realm.json renamed to auth/keycloak/eoapi-realm.json

@@ -0,0 +1,30 @@
+{
+  "realm" : "eoapi",
+  "users" : [ {
+    "id" : "59c5407b-6280-48b6-ae19-64fe593089c7",
+    "username" : "alice",
+    "emailVerified" : true,
+    "createdTimestamp" : 1712037625377,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-eoapi" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "ebe7613f-377e-416d-9ef5-c990c5ddbe66",
+    "username" : "bob",
+    "emailVerified" : true,
+    "createdTimestamp" : 1712037633309,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-eoapi" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ]
+}

auth/keycloak/eoapi-users-0.json

@@ -0,0 +1,111 @@
+{
+  "clientId": "stac-api",
+  "name": "STAC FastAPI",
+  "description": "",
+  "rootUrl": "http://localhost:8081",
+  "adminUrl": "http://localhost:8081",
+  "baseUrl": "",
+  "surrogateAuthRequired": false,
+  "enabled": true,
+  "alwaysDisplayInConsole": true,
+  "clientAuthenticatorType": "client-secret",
+  "secret": "L9xCdEwe6qyJag4oFX4Tivq4X5lY3Yb0",
+  "redirectUris": [
+    "http://localhost:8081/docs/oauth2-redirect"
+  ],
+  "webOrigins": [
+    "http://localhost:8081"
+  ],
+  "notBefore": 0,
+  "bearerOnly": false,
+  "consentRequired": false,
+  "standardFlowEnabled": true,
+  "implicitFlowEnabled": false,
+  "directAccessGrantsEnabled": true,
+  "serviceAccountsEnabled": true,
+  "authorizationServicesEnabled": true,
+  "publicClient": false,
+  "frontchannelLogout": true,
+  "protocol": "openid-connect",
+  "attributes": {
+    "client.secret.creation.time": "1712036922",
+    "oauth2.device.authorization.grant.enabled": "false",
+    "use.jwks.url": "false",
+    "backchannel.logout.revoke.offline.tokens": "false",
+    "use.refresh.tokens": "true",
+    "oidc.ciba.grant.enabled": "false",
+    "client.use.lightweight.access.token.enabled": "false",
+    "backchannel.logout.session.required": "true",
+    "client_credentials.use_refresh_token": "false",
+    "tls.client.certificate.bound.access.tokens": "false",
+    "require.pushed.authorization.requests": "false",
+    "acr.loa.map": "{}",
+    "display.on.consent.screen": "false",
+    "token.response.type.bearer.lower-case": "false"
+  },
+  "authenticationFlowBindingOverrides": {},
+  "fullScopeAllowed": true,
+  "nodeReRegistrationTimeout": -1,
+  "protocolMappers": [
+    {
+      "name": "Client Host",
+      "protocol": "openid-connect",
+      "protocolMapper": "oidc-usersessionmodel-note-mapper",
+      "consentRequired": false,
+      "config": {
+        "user.session.note": "clientHost",
+        "introspection.token.claim": "true",
+        "id.token.claim": "true",
+        "access.token.claim": "true",
+        "claim.name": "clientHost",
+        "jsonType.label": "String"
+      }
+    },
+    {
+      "name": "Client ID",
+      "protocol": "openid-connect",
+      "protocolMapper": "oidc-usersessionmodel-note-mapper",
+      "consentRequired": false,
+      "config": {
+        "user.session.note": "client_id",
+        "introspection.token.claim": "true",
+        "id.token.claim": "true",
+        "access.token.claim": "true",
+        "claim.name": "client_id",
+        "jsonType.label": "String"
+      }
+    },
+    {
+      "name": "Client IP Address",
+      "protocol": "openid-connect",
+      "protocolMapper": "oidc-usersessionmodel-note-mapper",
+      "consentRequired": false,
+      "config": {
+        "user.session.note": "clientAddress",
+        "introspection.token.claim": "true",
+        "id.token.claim": "true",
+        "access.token.claim": "true",
+        "claim.name": "clientAddress",
+        "jsonType.label": "String"
+      }
+    }
+  ],
+  "defaultClientScopes": [
+    "web-origins",
+    "acr",
+    "profile",
+    "roles",
+    "email"
+  ],
+  "optionalClientScopes": [
+    "address",
+    "phone",
+    "offline_access",
+    "microprofile-jwt"
+  ],
+  "access": {
+    "view": true,
+    "configure": true,
+    "manage": true
+  }
+}

auth/keycloak/stac-api._json

@@ -209,7 +209,7 @@ services:
       - "9990:9990"
     command: start-dev --import-realm
     volumes:
-      - ./auth/authentication/eoapi-realm.json:/opt/keycloak/data/import/eoapi-realm.json
+      - ./auth/keycloak:/opt/keycloak/data/import
 
 networks:
   default: