merge: shared Google brokering baseline
This commit is contained in:
donghyeon-ka
Executable
+62
@@ -0,0 +1,62 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
manifest="${1:-docs/keycloak-branch-manifest.tsv}"
|
||||
notes_dir="${KEYCLOAK_BRANCH_NOTES_DIR:-/home/donghyeon/workspace/ai-tools/llm-wiki/raw/branch-notes}"
|
||||
|
||||
expected_count="$(awk 'NR > 1 { count += 1 } END { print count + 0 }' "$manifest")"
|
||||
if [ "$expected_count" -ne 39 ]; then
|
||||
echo "manifest must contain exactly 39 Keycloak branches; found $expected_count" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
note_count="$(find "$notes_dir" -maxdepth 1 -type f -name 'feature-keycloak-*.md' | wc -l)"
|
||||
if [ "$note_count" -ne 39 ]; then
|
||||
echo "branch-note inventory must contain exactly 39 files; found $note_count" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
missing=0
|
||||
unmerged=0
|
||||
tab="$(printf '\t')"
|
||||
|
||||
while IFS="$tab" read -r branch target delivery; do
|
||||
[ "$branch" = "branch" ] && continue
|
||||
|
||||
note_name="$(printf '%s\n' "$branch" |
|
||||
sed 's#^feature/keycloak-#feature-keycloak-#').md"
|
||||
if [ ! -f "$notes_dir/$note_name" ]; then
|
||||
echo "missing branch note: $note_name" >&2
|
||||
missing=$((missing + 1))
|
||||
fi
|
||||
|
||||
if ! git show-ref --verify --quiet "refs/heads/$branch"; then
|
||||
echo "missing local branch: $branch" >&2
|
||||
missing=$((missing + 1))
|
||||
continue
|
||||
fi
|
||||
|
||||
case "$target" in
|
||||
common) target_branch="develop" ;;
|
||||
ap1) target_branch="develop-keycloak-pattern1" ;;
|
||||
ap2) target_branch="develop-keycloak-pattern2" ;;
|
||||
ap3) target_branch="develop-keycloak-pattern3" ;;
|
||||
ap4) target_branch="develop-keycloak-pattern4" ;;
|
||||
*)
|
||||
echo "unknown target '$target' for $branch ($delivery)" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if ! git merge-base --is-ancestor "$branch" "$target_branch"; then
|
||||
echo "feature tip is not merged: $branch -> $target_branch" >&2
|
||||
unmerged=$((unmerged + 1))
|
||||
fi
|
||||
done < "$manifest"
|
||||
|
||||
if [ "$missing" -ne 0 ] || [ "$unmerged" -ne 0 ]; then
|
||||
echo "Keycloak branch audit failed: missing=$missing unmerged=$unmerged" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Keycloak branch audit passed: 39/39 branches exist and are merged"
|
||||
Executable
+81
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
: "${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}"
|
||||
: "${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}"
|
||||
: "${GOOGLE_CLIENT_ID:?set GOOGLE_CLIENT_ID in .env}"
|
||||
: "${GOOGLE_CLIENT_SECRET:?set GOOGLE_CLIENT_SECRET in .env}"
|
||||
|
||||
keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
|
||||
realm="${KEYCLOAK_REALM:-keycloak-patterns}"
|
||||
|
||||
admin_token="$(
|
||||
curl -fsS \
|
||||
-d client_id=admin-cli \
|
||||
-d grant_type=password \
|
||||
-d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
-d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
|
||||
"$keycloak_url/realms/master/protocol/openid-connect/token" |
|
||||
jq -er .access_token
|
||||
)"
|
||||
|
||||
payload="$(
|
||||
jq -n \
|
||||
--arg client_id "$GOOGLE_CLIENT_ID" \
|
||||
--arg client_secret "$GOOGLE_CLIENT_SECRET" \
|
||||
'{
|
||||
alias: "google",
|
||||
displayName: "Sign in with Google",
|
||||
providerId: "google",
|
||||
enabled: true,
|
||||
updateProfileFirstLoginMode: "off",
|
||||
trustEmail: false,
|
||||
storeToken: false,
|
||||
addReadTokenRoleOnCreate: false,
|
||||
authenticateByDefault: false,
|
||||
linkOnly: false,
|
||||
firstBrokerLoginFlowAlias: "first broker login",
|
||||
config: {
|
||||
clientId: $client_id,
|
||||
clientSecret: $client_secret,
|
||||
defaultScope: "openid profile email",
|
||||
syncMode: "IMPORT"
|
||||
}
|
||||
}'
|
||||
)"
|
||||
|
||||
endpoint="$keycloak_url/admin/realms/$realm/identity-provider/instances"
|
||||
status="$(
|
||||
curl -sS -o /dev/null -w '%{http_code}' \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$endpoint/google"
|
||||
)"
|
||||
|
||||
if [ "$status" = "200" ]; then
|
||||
curl -fsS -X PUT \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$payload" \
|
||||
"$endpoint/google"
|
||||
action="updated"
|
||||
else
|
||||
curl -fsS -X POST \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$payload" \
|
||||
"$endpoint"
|
||||
action="created"
|
||||
fi
|
||||
|
||||
echo "Google Identity Provider $action for realm '$realm'"
|
||||
echo "Register this exact Google redirect URI:"
|
||||
echo "$keycloak_url/realms/$realm/broker/google/endpoint"
|
||||
Executable
+178
@@ -0,0 +1,178 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
mode="${1:-}"
|
||||
case "$mode" in
|
||||
vulnerable|secure) ;;
|
||||
*)
|
||||
echo "usage: $0 vulnerable|secure" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
|
||||
realm="${KEYCLOAK_REALM:-keycloak-patterns}"
|
||||
admin_base="$keycloak_url/admin/realms/$realm"
|
||||
vulnerable_flow="vulnerable first broker login"
|
||||
idp_url="$admin_base/identity-provider/instances/mock-google"
|
||||
|
||||
admin_token="$(
|
||||
curl -fsS \
|
||||
-d client_id=admin-cli \
|
||||
-d grant_type=password \
|
||||
-d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
-d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
|
||||
"$keycloak_url/realms/master/protocol/openid-connect/token" |
|
||||
jq -er .access_token
|
||||
)"
|
||||
|
||||
auth_header="Authorization: Bearer $admin_token"
|
||||
encode() {
|
||||
jq -rn --arg value "$1" '$value | @uri'
|
||||
}
|
||||
|
||||
flows="$(curl -fsS -H "$auth_header" "$admin_base/authentication/flows")"
|
||||
flow_id="$(
|
||||
printf '%s' "$flows" |
|
||||
jq -r --arg alias "$vulnerable_flow" '
|
||||
.[] | select(.alias == $alias) | .id
|
||||
' |
|
||||
head -1
|
||||
)"
|
||||
|
||||
if [ -n "$flow_id" ]; then
|
||||
existing_executions="$(
|
||||
curl -fsS -H "$auth_header" \
|
||||
"$admin_base/authentication/flows/$(encode "$vulnerable_flow")/executions"
|
||||
)"
|
||||
if printf '%s' "$existing_executions" | jq -e '
|
||||
any(.[]; .authenticationFlow == true)
|
||||
' >/dev/null; then
|
||||
idp_before_delete="$(curl -fsS -H "$auth_header" "$idp_url")"
|
||||
printf '%s' "$idp_before_delete" |
|
||||
jq '.firstBrokerLoginFlowAlias = "first broker login"' |
|
||||
curl -fsS -X PUT \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data @- \
|
||||
"$idp_url"
|
||||
curl -fsS -X DELETE \
|
||||
-H "$auth_header" \
|
||||
"$admin_base/authentication/flows/$flow_id"
|
||||
flow_id=""
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$flow_id" ]; then
|
||||
curl -fsS -X POST \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$(
|
||||
jq -n --arg alias "$vulnerable_flow" '{
|
||||
alias: $alias,
|
||||
description: "INSECURE LEARNING FLOW - automatic email linking",
|
||||
providerId: "basic-flow",
|
||||
topLevel: true,
|
||||
builtIn: false
|
||||
}'
|
||||
)" \
|
||||
"$admin_base/authentication/flows"
|
||||
fi
|
||||
|
||||
executions_url="$admin_base/authentication/flows/$(encode "$vulnerable_flow")/executions"
|
||||
executions="$(curl -fsS -H "$auth_header" "$executions_url")"
|
||||
create_user_id="$(
|
||||
printf '%s' "$executions" |
|
||||
jq -r '.[] | select(.providerId == "idp-create-user-if-unique") | .id' |
|
||||
head -1
|
||||
)"
|
||||
if [ -z "$create_user_id" ]; then
|
||||
curl -fsS -X POST \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data '{"provider":"idp-create-user-if-unique"}' \
|
||||
"$admin_base/authentication/flows/$(encode "$vulnerable_flow")/executions/execution"
|
||||
executions="$(curl -fsS -H "$auth_header" "$executions_url")"
|
||||
create_user_id="$(
|
||||
printf '%s' "$executions" |
|
||||
jq -r '.[] | select(.providerId == "idp-create-user-if-unique") | .id' |
|
||||
head -1
|
||||
)"
|
||||
fi
|
||||
|
||||
auto_link_id="$(
|
||||
printf '%s' "$executions" |
|
||||
jq -r '.[] | select(.providerId == "idp-auto-link") | .id' |
|
||||
head -1
|
||||
)"
|
||||
|
||||
if [ -z "$auto_link_id" ]; then
|
||||
curl -fsS -X POST \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data '{"provider":"idp-auto-link"}' \
|
||||
"$admin_base/authentication/flows/$(encode "$vulnerable_flow")/executions/execution"
|
||||
executions="$(curl -fsS -H "$auth_header" "$executions_url")"
|
||||
auto_link_id="$(
|
||||
printf '%s' "$executions" |
|
||||
jq -r '.[] | select(.providerId == "idp-auto-link") | .id' |
|
||||
head -1
|
||||
)"
|
||||
fi
|
||||
|
||||
if [ "$mode" = "vulnerable" ]; then
|
||||
curl -fsS -X PUT \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$(jq -n --arg id "$create_user_id" '{id: $id, requirement: "ALTERNATIVE"}')" \
|
||||
"$executions_url"
|
||||
curl -fsS -X PUT \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$(jq -n --arg id "$auto_link_id" '{id: $id, requirement: "ALTERNATIVE"}')" \
|
||||
"$executions_url"
|
||||
selected_flow="$vulnerable_flow"
|
||||
else
|
||||
selected_flow="first broker login"
|
||||
fi
|
||||
|
||||
idp="$(curl -fsS -H "$auth_header" "$idp_url")"
|
||||
printf '%s' "$idp" |
|
||||
jq --arg flow "$selected_flow" '.firstBrokerLoginFlowAlias = $flow' |
|
||||
curl -fsS -X PUT \
|
||||
-H "$auth_header" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data @- \
|
||||
"$idp_url"
|
||||
|
||||
assigned="$(
|
||||
curl -fsS -H "$auth_header" "$idp_url" |
|
||||
jq -r .firstBrokerLoginFlowAlias
|
||||
)"
|
||||
test "$assigned" = "$selected_flow"
|
||||
|
||||
if [ "$mode" = "secure" ]; then
|
||||
secure_executions="$(
|
||||
curl -fsS -H "$auth_header" \
|
||||
"$admin_base/authentication/flows/$(encode "first broker login")/executions"
|
||||
)"
|
||||
printf '%s' "$secure_executions" | jq -e '
|
||||
any(.[];
|
||||
.providerId == "idp-confirm-link" and .requirement == "REQUIRED"
|
||||
) and
|
||||
(any(.[];
|
||||
.providerId == "idp-auto-link" and .requirement != "DISABLED"
|
||||
) | not)
|
||||
' >/dev/null
|
||||
fi
|
||||
|
||||
echo "mock-google First Broker Login mode: $mode ($selected_flow)"
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
restore_secure_flow() {
|
||||
./scripts/set-first-broker-login-mode.sh secure >/dev/null 2>&1 || true
|
||||
}
|
||||
trap restore_secure_flow 0 1 2 15
|
||||
|
||||
npm --prefix google-e2e ci
|
||||
|
||||
./scripts/set-first-broker-login-mode.sh vulnerable
|
||||
FIRST_BROKER_EXPECTATION=vulnerable \
|
||||
npm --prefix google-e2e run test:first-broker
|
||||
|
||||
./scripts/set-first-broker-login-mode.sh secure
|
||||
FIRST_BROKER_EXPECTATION=secure \
|
||||
npm --prefix google-e2e run test:first-broker
|
||||
|
||||
trap - 0 1 2 15
|
||||
echo "First Broker Login verified: unsafe AutoLink reproduced, Confirm Link restored"
|
||||
Executable
+70
@@ -0,0 +1,70 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
|
||||
|
||||
admin_token="$(
|
||||
curl -fsS \
|
||||
-d client_id=admin-cli \
|
||||
-d grant_type=password \
|
||||
-d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
-d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
|
||||
"$keycloak_url/realms/master/protocol/openid-connect/token" |
|
||||
jq -er .access_token
|
||||
)"
|
||||
|
||||
idp="$(
|
||||
curl -fsS \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$keycloak_url/admin/realms/keycloak-patterns/identity-provider/instances/mock-google"
|
||||
)"
|
||||
|
||||
printf '%s' "$idp" | jq -e '
|
||||
.providerId == "oidc" and
|
||||
.enabled == true and
|
||||
.trustEmail == false and
|
||||
.config.clientId == "mock-google-broker" and
|
||||
.config.defaultScope == "openid profile email" and
|
||||
.config.syncMode == "IMPORT" and
|
||||
.config.validateSignature == "true"
|
||||
' >/dev/null
|
||||
|
||||
client="$(
|
||||
curl -fsS \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$keycloak_url/admin/realms/mock-google/clients?clientId=mock-google-broker"
|
||||
)"
|
||||
|
||||
printf '%s' "$client" | jq -e '
|
||||
length == 1 and
|
||||
.[0].publicClient == false and
|
||||
(.[0].redirectUris | index(
|
||||
"http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
|
||||
)) != null
|
||||
' >/dev/null
|
||||
|
||||
location="$(
|
||||
curl -sS -D - -o /dev/null \
|
||||
"$keycloak_url/realms/keycloak-patterns/protocol/openid-connect/auth?client_id=spa-public&redirect_uri=http%3A%2F%2Flocalhost%3A8088%2F&response_type=code&scope=openid&code_challenge=K2qUEfBl-nQvF2gB4dNxC2zYVwZc1CVnZb5CsX2L7fI&code_challenge_method=S256&kc_idp_hint=mock-google" |
|
||||
awk 'BEGIN { IGNORECASE=1 } /^Location:/ { print $2 }' |
|
||||
tr -d '\r'
|
||||
)"
|
||||
|
||||
case "$location" in
|
||||
"$keycloak_url/realms/keycloak-patterns/broker/mock-google/login"*) ;;
|
||||
*)
|
||||
echo "broker did not redirect to the controllable OIDC provider: $location" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "Google broker contract verified with the local mock OIDC realm"
|
||||
Reference in New Issue
Block a user