feat: add Google broker configuration profiles

2026-07-25 15:30:47 +09:00
parent 030ae94be3
commit 2ee4b2af1c
8 changed files with 293 additions and 0 deletions
@@ -0,0 +1,81 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+: "${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}"
+: "${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}"
+: "${GOOGLE_CLIENT_ID:?set GOOGLE_CLIENT_ID in .env}"
+: "${GOOGLE_CLIENT_SECRET:?set GOOGLE_CLIENT_SECRET in .env}"
+
+keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
+realm="${KEYCLOAK_REALM:-keycloak-patterns}"
+
+admin_token="$(
+  curl -fsS \
+    -d client_id=admin-cli \
+    -d grant_type=password \
+    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+    "$keycloak_url/realms/master/protocol/openid-connect/token" |
+    jq -er .access_token
+)"
+
+payload="$(
+  jq -n \
+    --arg client_id "$GOOGLE_CLIENT_ID" \
+    --arg client_secret "$GOOGLE_CLIENT_SECRET" \
+    '{
+      alias: "google",
+      displayName: "Sign in with Google",
+      providerId: "google",
+      enabled: true,
+      updateProfileFirstLoginMode: "off",
+      trustEmail: false,
+      storeToken: false,
+      addReadTokenRoleOnCreate: false,
+      authenticateByDefault: false,
+      linkOnly: false,
+      firstBrokerLoginFlowAlias: "first broker login",
+      config: {
+        clientId: $client_id,
+        clientSecret: $client_secret,
+        defaultScope: "openid profile email",
+        syncMode: "IMPORT"
+      }
+    }'
+)"
+
+endpoint="$keycloak_url/admin/realms/$realm/identity-provider/instances"
+status="$(
+  curl -sS -o /dev/null -w '%{http_code}' \
+    -H "Authorization: Bearer $admin_token" \
+    "$endpoint/google"
+)"
+
+if [ "$status" = "200" ]; then
+  curl -fsS -X PUT \
+    -H "Authorization: Bearer $admin_token" \
+    -H "Content-Type: application/json" \
+    --data "$payload" \
+    "$endpoint/google"
+  action="updated"
+else
+  curl -fsS -X POST \
+    -H "Authorization: Bearer $admin_token" \
+    -H "Content-Type: application/json" \
+    --data "$payload" \
+    "$endpoint"
+  action="created"
+fi
+
+echo "Google Identity Provider $action for realm '$realm'"
+echo "Register this exact Google redirect URI:"
+echo "$keycloak_url/realms/$realm/broker/google/endpoint"