feat: add Google broker configuration profiles

2026-07-25 15:30:47 +09:00
parent 030ae94be3
commit 2ee4b2af1c
8 changed files with 293 additions and 0 deletions
@@ -0,0 +1,81 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+: "${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}"
+: "${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}"
+: "${GOOGLE_CLIENT_ID:?set GOOGLE_CLIENT_ID in .env}"
+: "${GOOGLE_CLIENT_SECRET:?set GOOGLE_CLIENT_SECRET in .env}"
+
+keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
+realm="${KEYCLOAK_REALM:-keycloak-patterns}"
+
+admin_token="$(
+  curl -fsS \
+    -d client_id=admin-cli \
+    -d grant_type=password \
+    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+    "$keycloak_url/realms/master/protocol/openid-connect/token" |
+    jq -er .access_token
+)"
+
+payload="$(
+  jq -n \
+    --arg client_id "$GOOGLE_CLIENT_ID" \
+    --arg client_secret "$GOOGLE_CLIENT_SECRET" \
+    '{
+      alias: "google",
+      displayName: "Sign in with Google",
+      providerId: "google",
+      enabled: true,
+      updateProfileFirstLoginMode: "off",
+      trustEmail: false,
+      storeToken: false,
+      addReadTokenRoleOnCreate: false,
+      authenticateByDefault: false,
+      linkOnly: false,
+      firstBrokerLoginFlowAlias: "first broker login",
+      config: {
+        clientId: $client_id,
+        clientSecret: $client_secret,
+        defaultScope: "openid profile email",
+        syncMode: "IMPORT"
+      }
+    }'
+)"
+
+endpoint="$keycloak_url/admin/realms/$realm/identity-provider/instances"
+status="$(
+  curl -sS -o /dev/null -w '%{http_code}' \
+    -H "Authorization: Bearer $admin_token" \
+    "$endpoint/google"
+)"
+
+if [ "$status" = "200" ]; then
+  curl -fsS -X PUT \
+    -H "Authorization: Bearer $admin_token" \
+    -H "Content-Type: application/json" \
+    --data "$payload" \
+    "$endpoint/google"
+  action="updated"
+else
+  curl -fsS -X POST \
+    -H "Authorization: Bearer $admin_token" \
+    -H "Content-Type: application/json" \
+    --data "$payload" \
+    "$endpoint"
+  action="created"
+fi
+
+echo "Google Identity Provider $action for realm '$realm'"
+echo "Register this exact Google redirect URI:"
+echo "$keycloak_url/realms/$realm/broker/google/endpoint"
@@ -0,0 +1,70 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
+
+admin_token="$(
+  curl -fsS \
+    -d client_id=admin-cli \
+    -d grant_type=password \
+    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+    "$keycloak_url/realms/master/protocol/openid-connect/token" |
+    jq -er .access_token
+)"
+
+idp="$(
+  curl -fsS \
+    -H "Authorization: Bearer $admin_token" \
+    "$keycloak_url/admin/realms/keycloak-patterns/identity-provider/instances/mock-google"
+)"
+
+printf '%s' "$idp" | jq -e '
+  .providerId == "oidc" and
+  .enabled == true and
+  .trustEmail == false and
+  .config.clientId == "mock-google-broker" and
+  .config.defaultScope == "openid profile email" and
+  .config.syncMode == "IMPORT" and
+  .config.validateSignature == "true"
+' >/dev/null
+
+client="$(
+  curl -fsS \
+    -H "Authorization: Bearer $admin_token" \
+    "$keycloak_url/admin/realms/mock-google/clients?clientId=mock-google-broker"
+)"
+
+printf '%s' "$client" | jq -e '
+  length == 1 and
+  .[0].publicClient == false and
+  (.[0].redirectUris | index(
+    "http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
+  )) != null
+' >/dev/null
+
+location="$(
+  curl -sS -D - -o /dev/null \
+    "$keycloak_url/realms/keycloak-patterns/protocol/openid-connect/auth?client_id=spa-public&redirect_uri=http%3A%2F%2Flocalhost%3A8088%2F&response_type=code&scope=openid&code_challenge=K2qUEfBl-nQvF2gB4dNxC2zYVwZc1CVnZb5CsX2L7fI&code_challenge_method=S256&kc_idp_hint=mock-google" |
+    awk 'BEGIN { IGNORECASE=1 } /^Location:/ { print $2 }' |
+    tr -d '\r'
+)"
+
+case "$location" in
+  "$keycloak_url/realms/keycloak-patterns/broker/mock-google/login"*) ;;
+  *)
+    echo "broker did not redirect to the controllable OIDC provider: $location" >&2
+    exit 1
+    ;;
+esac
+
+echo "Google broker contract verified with the local mock OIDC realm"