feat: map upstream Google identity claims

2026-07-25 16:24:24 +09:00
parent 98566a713d
commit 98b07b4fdf
8 changed files with 383 additions and 10 deletions
@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
+realm="${KEYCLOAK_REALM:-keycloak-patterns}"
+profile_url="$keycloak_url/admin/realms/$realm/users/profile"
+
+admin_token="$(
+  curl -fsS \
+    -d client_id=admin-cli \
+    -d grant_type=password \
+    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+    "$keycloak_url/realms/master/protocol/openid-connect/token" |
+    jq -er .access_token
+)"
+
+profile="$(curl -fsS -H "Authorization: Bearer $admin_token" "$profile_url")"
+updated_profile="$(
+  printf '%s' "$profile" |
+    jq '
+      def broker_attribute($name; $label): {
+        name: $name,
+        displayName: $label,
+        validations: {length: {max: 2048}},
+        permissions: {
+          view: ["admin", "user"],
+          edit: ["admin"]
+        },
+        multivalued: false,
+        group: "user-metadata"
+      };
+      if any(.attributes[]; .name == "picture") then .
+      else .attributes += [broker_attribute("picture"; "Profile picture URL")]
+      end |
+      if any(.attributes[]; .name == "hd") then .
+      else .attributes += [broker_attribute("hd"; "Hosted domain")]
+      end
+    '
+)"
+
+printf '%s' "$updated_profile" |
+  curl -fsS -X PUT \
+    -H "Authorization: Bearer $admin_token" \
+    -H "Content-Type: application/json" \
+    --data @- \
+    "$profile_url"
+
+echo "Broker user-profile attributes configured for realm '$realm'"