Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 donghyeon-ka
|
2ee4b2af1c | ||
|
donghyeon-ka
|
030ae94be3 | ||
|
donghyeon-ka
|
728e737dc8 | ||
|
donghyeon-ka
|
e2fba41f56 | ||
|
donghyeon-ka
|
998eada6f5 | ||
|
donghyeon-ka
|
5ddb97d3a1 |
@@ -6,5 +6,19 @@ POSTGRES_DB=keycloak
|
||||
POSTGRES_USER=keycloak
|
||||
POSTGRES_PASSWORD=change-me-postgres-password
|
||||
|
||||
# Keycloak resolves these placeholders while importing the realm.
|
||||
TOKEN_MEDIATING_CLIENT_SECRET=change-me-token-mediating-client-secret
|
||||
BFF_CLIENT_SECRET=change-me-bff-client-secret
|
||||
EDGE_PROXY_CLIENT_SECRET=change-me-edge-proxy-client-secret
|
||||
MOCK_GOOGLE_BROKER_CLIENT_SECRET=change-me-mock-google-broker-client-secret
|
||||
ADMIN_USER_PASSWORD=change-me-admin-user-password
|
||||
REGULAR_USER_PASSWORD=change-me-regular-user-password
|
||||
MOCK_GOOGLE_USER_PASSWORD=change-me-mock-google-user-password
|
||||
|
||||
# Optional real-Google profile. These are consumed only by
|
||||
# scripts/configure-google-idp.sh and must never be committed with real values.
|
||||
GOOGLE_CLIENT_ID=
|
||||
GOOGLE_CLIENT_SECRET=
|
||||
|
||||
# Port 80 is the single-EC2 target. 8088 avoids common local port conflicts.
|
||||
NGINX_PORT=8088
|
||||
|
||||
@@ -5,3 +5,6 @@
|
||||
|
||||
backend/target/
|
||||
build/
|
||||
e2e/node_modules/
|
||||
frontend/node_modules/
|
||||
frontend/dist/
|
||||
|
||||
@@ -1,5 +1,12 @@
|
||||
# Keycloak Authentication Patterns
|
||||
|
||||
The 39-branch implementation registry is documented in
|
||||
[`docs/keycloak-branch-index.md`](docs/keycloak-branch-index.md).
|
||||
|
||||
Google brokering has a credential-free local OIDC harness and an opt-in
|
||||
real-Google profile described in
|
||||
[`docs/google-idp-brokering.md`](docs/google-idp-brokering.md).
|
||||
|
||||
Keycloak을 중심으로 네 가지 브라우저 인증 통합 패턴을 같은 로컬
|
||||
인프라에서 비교하는 학습 프로젝트입니다.
|
||||
|
||||
@@ -63,3 +70,36 @@ docker compose down -v && docker compose up --build -d
|
||||
`start-dev`와 로컬 HTTP 설정은 학습 전용입니다. 운영 환경에서는
|
||||
optimized Keycloak image, HTTPS, 엄격한 hostname 및 외부 secret store를
|
||||
사용해야 합니다.
|
||||
|
||||
## Realm baseline
|
||||
|
||||
`keycloak/import/keycloak-patterns-realm.json`은 시작 시 자동 import됩니다.
|
||||
하나의 `keycloak-patterns` realm 안에서 패턴마다 client를 분리합니다.
|
||||
|
||||
| Client | 유형 | 패턴 |
|
||||
|---|---|---|
|
||||
| `spa-public` | public + PKCE S256 | AP1 |
|
||||
| `token-mediating-confidential` | confidential | AP2 |
|
||||
| `bff-confidential` | confidential | AP3 |
|
||||
| `edge-proxy` | confidential | AP4 |
|
||||
|
||||
confidential client secret과 테스트 사용자 password는 JSON에 평문으로
|
||||
저장하지 않습니다. JSON에는 `${ENVIRONMENT_VARIABLE}` placeholder만
|
||||
커밋하고, Keycloak 26.7.0이 import 시 `.env` 값을 주입합니다.
|
||||
|
||||
```bash
|
||||
python3 scripts/validate-realm.py
|
||||
docker compose down -v
|
||||
docker compose up -d --wait
|
||||
./scripts/verify-realm.sh
|
||||
```
|
||||
|
||||
실행 중인 DB에서 CLI realm export를 재현하려면 다음 명령을 사용합니다.
|
||||
Keycloak을 잠시 중지하고 export한 뒤 자동으로 다시 올립니다.
|
||||
|
||||
```bash
|
||||
./scripts/export-realm.sh
|
||||
```
|
||||
|
||||
runtime export에는 실제 client secret과 credential hash가 포함될 수 있어
|
||||
gitignored `build/keycloak-export/`에 권한 `0600`으로만 저장됩니다.
|
||||
|
||||
@@ -35,6 +35,13 @@ services:
|
||||
KC_HEALTH_ENABLED: "true"
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}
|
||||
TOKEN_MEDIATING_CLIENT_SECRET: ${TOKEN_MEDIATING_CLIENT_SECRET:?set TOKEN_MEDIATING_CLIENT_SECRET in .env}
|
||||
BFF_CLIENT_SECRET: ${BFF_CLIENT_SECRET:?set BFF_CLIENT_SECRET in .env}
|
||||
EDGE_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
|
||||
MOCK_GOOGLE_BROKER_CLIENT_SECRET: ${MOCK_GOOGLE_BROKER_CLIENT_SECRET:?set MOCK_GOOGLE_BROKER_CLIENT_SECRET in .env}
|
||||
ADMIN_USER_PASSWORD: ${ADMIN_USER_PASSWORD:?set ADMIN_USER_PASSWORD in .env}
|
||||
REGULAR_USER_PASSWORD: ${REGULAR_USER_PASSWORD:?set REGULAR_USER_PASSWORD in .env}
|
||||
MOCK_GOOGLE_USER_PASSWORD: ${MOCK_GOOGLE_USER_PASSWORD:?set MOCK_GOOGLE_USER_PASSWORD in .env}
|
||||
ports:
|
||||
- "127.0.0.1:8080:8080"
|
||||
volumes:
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# Google IdP brokering
|
||||
|
||||
Keycloak is the only issuer trusted by AP1–AP4. Google is an upstream Identity
|
||||
Provider; applications do not receive or validate a Google token.
|
||||
|
||||
## Two verification profiles
|
||||
|
||||
The default local profile imports a second Keycloak realm named `mock-google`.
|
||||
It acts as a controllable OIDC provider and allows tests to choose claims such
|
||||
as a duplicate email, `email_verified=false`, `hd`, and `picture`. This is the
|
||||
safe way to reproduce an unsafe email auto-link without impersonating a real
|
||||
Google account.
|
||||
|
||||
The real-Google profile is configured explicitly:
|
||||
|
||||
1. Create a Google OAuth **Web application**.
|
||||
2. Register the exact redirect URI printed by
|
||||
`./scripts/configure-google-idp.sh`.
|
||||
3. Put `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` in ignored `.env`.
|
||||
4. Start the stack and run the configuration script.
|
||||
|
||||
The script writes `providerId=google`, `trustEmail=false`, minimal
|
||||
`openid profile email` scopes, and `syncMode=IMPORT` through the Keycloak Admin
|
||||
API. Credentials are never written to the realm export or repository.
|
||||
|
||||
Google requires a public HTTPS redirect for non-local deployments. Local mock
|
||||
verification proves the Keycloak brokering boundary; a real Google login is a
|
||||
separate credentialed acceptance profile.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Keycloak branch implementation index
|
||||
|
||||
The source inventory contains 39 `feature-keycloak-*.md` branch notes. This
|
||||
repository preserves one local Git feature branch for every note and merges it
|
||||
with `--no-ff` into either the common `develop` baseline or one of the four
|
||||
authentication-pattern branches.
|
||||
|
||||
| Target | Meaning |
|
||||
|---|---|
|
||||
| `common` | Shared realm, federation, deployment, or governance contract. Merge into `develop`, then propagate to AP1–AP4. |
|
||||
| `ap1` | Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
|
||||
| `ap2` | Token-mediating confidential backend: browser receives access token only. |
|
||||
| `ap3` | BFF: backend owns every OAuth token and browser owns only a session cookie. |
|
||||
| `ap4` | Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
|
||||
|
||||
The machine-readable registry is
|
||||
[`keycloak-branch-manifest.tsv`](keycloak-branch-manifest.tsv). Run:
|
||||
|
||||
```bash
|
||||
./scripts/audit-keycloak-branches.sh
|
||||
```
|
||||
|
||||
The audit succeeds only when all 39 note names have matching local feature
|
||||
branches and each feature tip is reachable from its declared target branch.
|
||||
|
||||
Google credentials are never committed. The default local acceptance harness
|
||||
uses a second Keycloak realm as a controllable OIDC provider so claim mapping
|
||||
and unsafe-linking failure paths can be reproduced. A real Google login remains
|
||||
an explicit credentialed/public-HTTPS verification profile.
|
||||
@@ -0,0 +1,40 @@
|
||||
branch target delivery
|
||||
feature/keycloak-account-linking-spa-ux ap1 documented-and-contract-tested
|
||||
feature/keycloak-account-linking-sub-vs-email common documented-and-contract-tested
|
||||
feature/keycloak-bff-csrf-samesite-defense ap3 locally-verified
|
||||
feature/keycloak-bff-oauth2login-session ap3 locally-verified
|
||||
feature/keycloak-bff-vs-spa-direct ap3 documented
|
||||
feature/keycloak-docker-compose-stack common locally-verified
|
||||
feature/keycloak-edge-forwardauth-google-federation ap4 documented-and-config-tested
|
||||
feature/keycloak-edge-forwardauth-no-google ap4 documented-and-config-tested
|
||||
feature/keycloak-federation-spa-zero-change ap1 contract-tested
|
||||
feature/keycloak-first-broker-login-flow common locally-verified-with-mock-idp
|
||||
feature/keycloak-four-pattern-tradeoff-matrix common documented-and-evidence-linked
|
||||
feature/keycloak-google-claim-attribute-mapping common locally-verified-with-mock-idp
|
||||
feature/keycloak-google-redirect-uri-policy common config-tested
|
||||
feature/keycloak-header-spoofing-defense ap4 locally-verified
|
||||
feature/keycloak-https-termination-caddy-nginx common config-tested
|
||||
feature/keycloak-idp-brokering-google-client common locally-verified-with-mock-idp
|
||||
feature/keycloak-idp-mappers-claim-to-role common locally-verified-with-mock-idp
|
||||
feature/keycloak-internal-spa-direct-google-federation ap1 documented-and-contract-tested
|
||||
feature/keycloak-internal-spa-direct-no-google ap1 documented-and-contract-tested
|
||||
feature/keycloak-iss-claim-hostname-mismatch ap1 locally-verified
|
||||
feature/keycloak-nginx-auth-request-integration ap4 locally-verified
|
||||
feature/keycloak-oauth2-proxy-oidc-flow ap4 locally-verified
|
||||
feature/keycloak-patterns common governance
|
||||
feature/keycloak-pkce-flow-stages ap1 contract-tested
|
||||
feature/keycloak-public-domain-tunneling common config-tested
|
||||
feature/keycloak-realm-client-export common locally-verified
|
||||
feature/keycloak-refresh-rotation-and-logout ap1 locally-verified
|
||||
feature/keycloak-refresh-token-rotation ap1 contract-tested
|
||||
feature/keycloak-reverse-proxy-headers common config-tested
|
||||
feature/keycloak-single-ec2-google-federation ap1 documented-and-config-tested
|
||||
feature/keycloak-single-ec2-no-google ap1 documented-and-contract-tested
|
||||
feature/keycloak-spa-token-storage-tradeoff ap1 locally-verified
|
||||
feature/keycloak-spring-rs-audience-validator ap1 locally-verified
|
||||
feature/keycloak-spring-rs-role-mapping ap1 locally-verified
|
||||
feature/keycloak-three-leg-trust-chain ap1 documented-and-contract-tested
|
||||
feature/keycloak-token-mediating-access-handoff ap2 locally-verified
|
||||
feature/keycloak-token-mediating-confidential-client ap2 locally-verified
|
||||
feature/keycloak-traefik-forwardauth-alternative ap4 config-tested
|
||||
feature/keycloak-vanilla-js-spa-pkce ap1 locally-verified
|
||||
|
@@ -0,0 +1,195 @@
|
||||
{
|
||||
"realm": "keycloak-patterns",
|
||||
"displayName": "Keycloak Authentication Patterns",
|
||||
"enabled": true,
|
||||
"sslRequired": "external",
|
||||
"registrationAllowed": false,
|
||||
"resetPasswordAllowed": false,
|
||||
"editUsernameAllowed": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"bruteForceProtected": true,
|
||||
"accessTokenLifespan": 300,
|
||||
"ssoSessionIdleTimeout": 1800,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
"offlineSessionIdleTimeout": 2592000,
|
||||
"revokeRefreshToken": true,
|
||||
"refreshTokenMaxReuse": 0,
|
||||
"roles": {
|
||||
"realm": [
|
||||
{
|
||||
"name": "admin-role",
|
||||
"description": "Administrative role used by authorization examples"
|
||||
},
|
||||
{
|
||||
"name": "user-role",
|
||||
"description": "Regular authenticated user role"
|
||||
}
|
||||
]
|
||||
},
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "spa-public",
|
||||
"name": "AP1 SPA Public Client",
|
||||
"description": "Browser-based OAuth client using Authorization Code and PKCE",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": true,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"frontchannelLogout": true,
|
||||
"redirectUris": [
|
||||
"http://localhost:8088/*",
|
||||
"http://127.0.0.1:8088/*"
|
||||
],
|
||||
"webOrigins": [
|
||||
"http://localhost:8088",
|
||||
"http://127.0.0.1:8088"
|
||||
],
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256",
|
||||
"post.logout.redirect.uris": "http://localhost:8088/*##http://127.0.0.1:8088/*"
|
||||
}
|
||||
},
|
||||
{
|
||||
"clientId": "token-mediating-confidential",
|
||||
"name": "AP2 Token-Mediating Backend",
|
||||
"description": "Confidential backend that keeps refresh tokens server-side",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "${TOKEN_MEDIATING_CLIENT_SECRET}",
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"frontchannelLogout": true,
|
||||
"redirectUris": [
|
||||
"http://localhost:8082/login/oauth2/code/keycloak"
|
||||
],
|
||||
"webOrigins": [
|
||||
"http://localhost:8082"
|
||||
],
|
||||
"attributes": {
|
||||
"post.logout.redirect.uris": "http://localhost:8082/*"
|
||||
}
|
||||
},
|
||||
{
|
||||
"clientId": "bff-confidential",
|
||||
"name": "AP3 Backend-for-Frontend",
|
||||
"description": "Confidential BFF that keeps all OAuth tokens server-side",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "${BFF_CLIENT_SECRET}",
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"frontchannelLogout": true,
|
||||
"redirectUris": [
|
||||
"http://localhost:8083/login/oauth2/code/keycloak"
|
||||
],
|
||||
"webOrigins": [
|
||||
"http://localhost:8083"
|
||||
],
|
||||
"attributes": {
|
||||
"post.logout.redirect.uris": "http://localhost:8083/*"
|
||||
}
|
||||
},
|
||||
{
|
||||
"clientId": "edge-proxy",
|
||||
"name": "AP4 Edge Forward Auth",
|
||||
"description": "Confidential oauth2-proxy OIDC client",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "${EDGE_PROXY_CLIENT_SECRET}",
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"frontchannelLogout": true,
|
||||
"redirectUris": [
|
||||
"http://localhost:4180/oauth2/callback"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"attributes": {
|
||||
"post.logout.redirect.uris": "http://localhost:8088/*"
|
||||
}
|
||||
}
|
||||
],
|
||||
"identityProviders": [
|
||||
{
|
||||
"alias": "mock-google",
|
||||
"displayName": "Mock Google (local verification)",
|
||||
"providerId": "oidc",
|
||||
"enabled": true,
|
||||
"updateProfileFirstLoginMode": "off",
|
||||
"trustEmail": false,
|
||||
"storeToken": false,
|
||||
"addReadTokenRoleOnCreate": false,
|
||||
"authenticateByDefault": false,
|
||||
"linkOnly": false,
|
||||
"firstBrokerLoginFlowAlias": "first broker login",
|
||||
"config": {
|
||||
"clientId": "mock-google-broker",
|
||||
"clientSecret": "${MOCK_GOOGLE_BROKER_CLIENT_SECRET}",
|
||||
"authorizationUrl": "http://localhost:8080/realms/mock-google/protocol/openid-connect/auth",
|
||||
"tokenUrl": "http://keycloak:8080/realms/mock-google/protocol/openid-connect/token",
|
||||
"userInfoUrl": "http://keycloak:8080/realms/mock-google/protocol/openid-connect/userinfo",
|
||||
"issuer": "http://localhost:8080/realms/mock-google",
|
||||
"jwksUrl": "http://keycloak:8080/realms/mock-google/protocol/openid-connect/certs",
|
||||
"useJwksUrl": "true",
|
||||
"validateSignature": "true",
|
||||
"defaultScope": "openid profile email",
|
||||
"syncMode": "IMPORT",
|
||||
"pkceEnabled": "true",
|
||||
"pkceMethod": "S256"
|
||||
}
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"username": "admin-user",
|
||||
"enabled": true,
|
||||
"email": "admin-user@example.test",
|
||||
"emailVerified": true,
|
||||
"firstName": "Admin",
|
||||
"lastName": "User",
|
||||
"realmRoles": [
|
||||
"admin-role"
|
||||
],
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "${ADMIN_USER_PASSWORD}",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"username": "regular-user",
|
||||
"enabled": true,
|
||||
"email": "regular-user@example.test",
|
||||
"emailVerified": true,
|
||||
"firstName": "Regular",
|
||||
"lastName": "User",
|
||||
"realmRoles": [
|
||||
"user-role"
|
||||
],
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "${REGULAR_USER_PASSWORD}",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
{
|
||||
"realm": "mock-google",
|
||||
"displayName": "Controllable Google OIDC Test Provider",
|
||||
"enabled": true,
|
||||
"sslRequired": "external",
|
||||
"registrationAllowed": false,
|
||||
"resetPasswordAllowed": false,
|
||||
"editUsernameAllowed": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"bruteForceProtected": true,
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "mock-google-broker",
|
||||
"name": "Main Realm Identity Broker",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "${MOCK_GOOGLE_BROKER_CLIENT_SECRET}",
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"redirectUris": [
|
||||
"http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
|
||||
],
|
||||
"webOrigins": []
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"username": "mock-new-user",
|
||||
"enabled": true,
|
||||
"email": "broker-new-user@example.test",
|
||||
"emailVerified": true,
|
||||
"firstName": "Broker",
|
||||
"lastName": "New",
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "${MOCK_GOOGLE_USER_PASSWORD}",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"username": "mock-collision-user",
|
||||
"enabled": true,
|
||||
"email": "regular-user@example.test",
|
||||
"emailVerified": false,
|
||||
"firstName": "Broker",
|
||||
"lastName": "Collision",
|
||||
"attributes": {
|
||||
"hd": [
|
||||
"example.test"
|
||||
],
|
||||
"picture": [
|
||||
"https://images.example.test/mock-collision-user.png"
|
||||
]
|
||||
},
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "${MOCK_GOOGLE_USER_PASSWORD}",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Executable
+62
@@ -0,0 +1,62 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
manifest="${1:-docs/keycloak-branch-manifest.tsv}"
|
||||
notes_dir="${KEYCLOAK_BRANCH_NOTES_DIR:-/home/donghyeon/workspace/ai-tools/llm-wiki/raw/branch-notes}"
|
||||
|
||||
expected_count="$(awk 'NR > 1 { count += 1 } END { print count + 0 }' "$manifest")"
|
||||
if [ "$expected_count" -ne 39 ]; then
|
||||
echo "manifest must contain exactly 39 Keycloak branches; found $expected_count" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
note_count="$(find "$notes_dir" -maxdepth 1 -type f -name 'feature-keycloak-*.md' | wc -l)"
|
||||
if [ "$note_count" -ne 39 ]; then
|
||||
echo "branch-note inventory must contain exactly 39 files; found $note_count" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
missing=0
|
||||
unmerged=0
|
||||
tab="$(printf '\t')"
|
||||
|
||||
while IFS="$tab" read -r branch target delivery; do
|
||||
[ "$branch" = "branch" ] && continue
|
||||
|
||||
note_name="$(printf '%s\n' "$branch" |
|
||||
sed 's#^feature/keycloak-#feature-keycloak-#').md"
|
||||
if [ ! -f "$notes_dir/$note_name" ]; then
|
||||
echo "missing branch note: $note_name" >&2
|
||||
missing=$((missing + 1))
|
||||
fi
|
||||
|
||||
if ! git show-ref --verify --quiet "refs/heads/$branch"; then
|
||||
echo "missing local branch: $branch" >&2
|
||||
missing=$((missing + 1))
|
||||
continue
|
||||
fi
|
||||
|
||||
case "$target" in
|
||||
common) target_branch="develop" ;;
|
||||
ap1) target_branch="develop-keycloak-pattern1" ;;
|
||||
ap2) target_branch="develop-keycloak-pattern2" ;;
|
||||
ap3) target_branch="develop-keycloak-pattern3" ;;
|
||||
ap4) target_branch="develop-keycloak-pattern4" ;;
|
||||
*)
|
||||
echo "unknown target '$target' for $branch ($delivery)" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if ! git merge-base --is-ancestor "$branch" "$target_branch"; then
|
||||
echo "feature tip is not merged: $branch -> $target_branch" >&2
|
||||
unmerged=$((unmerged + 1))
|
||||
fi
|
||||
done < "$manifest"
|
||||
|
||||
if [ "$missing" -ne 0 ] || [ "$unmerged" -ne 0 ]; then
|
||||
echo "Keycloak branch audit failed: missing=$missing unmerged=$unmerged" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Keycloak branch audit passed: 39/39 branches exist and are merged"
|
||||
Executable
+81
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
: "${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}"
|
||||
: "${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}"
|
||||
: "${GOOGLE_CLIENT_ID:?set GOOGLE_CLIENT_ID in .env}"
|
||||
: "${GOOGLE_CLIENT_SECRET:?set GOOGLE_CLIENT_SECRET in .env}"
|
||||
|
||||
keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
|
||||
realm="${KEYCLOAK_REALM:-keycloak-patterns}"
|
||||
|
||||
admin_token="$(
|
||||
curl -fsS \
|
||||
-d client_id=admin-cli \
|
||||
-d grant_type=password \
|
||||
-d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
-d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
|
||||
"$keycloak_url/realms/master/protocol/openid-connect/token" |
|
||||
jq -er .access_token
|
||||
)"
|
||||
|
||||
payload="$(
|
||||
jq -n \
|
||||
--arg client_id "$GOOGLE_CLIENT_ID" \
|
||||
--arg client_secret "$GOOGLE_CLIENT_SECRET" \
|
||||
'{
|
||||
alias: "google",
|
||||
displayName: "Sign in with Google",
|
||||
providerId: "google",
|
||||
enabled: true,
|
||||
updateProfileFirstLoginMode: "off",
|
||||
trustEmail: false,
|
||||
storeToken: false,
|
||||
addReadTokenRoleOnCreate: false,
|
||||
authenticateByDefault: false,
|
||||
linkOnly: false,
|
||||
firstBrokerLoginFlowAlias: "first broker login",
|
||||
config: {
|
||||
clientId: $client_id,
|
||||
clientSecret: $client_secret,
|
||||
defaultScope: "openid profile email",
|
||||
syncMode: "IMPORT"
|
||||
}
|
||||
}'
|
||||
)"
|
||||
|
||||
endpoint="$keycloak_url/admin/realms/$realm/identity-provider/instances"
|
||||
status="$(
|
||||
curl -sS -o /dev/null -w '%{http_code}' \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$endpoint/google"
|
||||
)"
|
||||
|
||||
if [ "$status" = "200" ]; then
|
||||
curl -fsS -X PUT \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$payload" \
|
||||
"$endpoint/google"
|
||||
action="updated"
|
||||
else
|
||||
curl -fsS -X POST \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
-H "Content-Type: application/json" \
|
||||
--data "$payload" \
|
||||
"$endpoint"
|
||||
action="created"
|
||||
fi
|
||||
|
||||
echo "Google Identity Provider $action for realm '$realm'"
|
||||
echo "Register this exact Google redirect URI:"
|
||||
echo "$keycloak_url/realms/$realm/broker/google/endpoint"
|
||||
Executable
+30
@@ -0,0 +1,30 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
compose_file=${COMPOSE_FILE:-docker-compose.yml}
|
||||
output_dir=${REALM_EXPORT_DIR:-"$(pwd)/build/keycloak-export"}
|
||||
output_file="$output_dir/keycloak-patterns-realm.json"
|
||||
|
||||
mkdir -p "$output_dir"
|
||||
|
||||
restart_keycloak() {
|
||||
trap - EXIT INT TERM
|
||||
docker compose -f "$compose_file" up -d --wait >/dev/null
|
||||
}
|
||||
trap restart_keycloak EXIT
|
||||
trap 'exit 130' INT
|
||||
trap 'exit 143' TERM
|
||||
|
||||
docker compose -f "$compose_file" stop keycloak >/dev/null
|
||||
docker compose -f "$compose_file" run --rm --no-deps \
|
||||
--volume "$output_dir:/opt/keycloak/data/export" \
|
||||
keycloak \
|
||||
export \
|
||||
--realm keycloak-patterns \
|
||||
--file /opt/keycloak/data/export/keycloak-patterns-realm.json \
|
||||
--users same_file
|
||||
|
||||
chmod 600 "$output_file"
|
||||
python3 scripts/validate-realm.py --runtime "$output_file"
|
||||
|
||||
echo "runtime realm export written to $output_file"
|
||||
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Validate the committed realm template or a runtime Keycloak CLI export."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
REALM_NAME = "keycloak-patterns"
|
||||
PUBLIC_CLIENT = "spa-public"
|
||||
CONFIDENTIAL_CLIENTS = {
|
||||
"token-mediating-confidential": "${TOKEN_MEDIATING_CLIENT_SECRET}",
|
||||
"bff-confidential": "${BFF_CLIENT_SECRET}",
|
||||
"edge-proxy": "${EDGE_PROXY_CLIENT_SECRET}",
|
||||
}
|
||||
EXPECTED_ROLES = {"admin-role", "user-role"}
|
||||
EXPECTED_USERS = {"admin-user", "regular-user"}
|
||||
|
||||
|
||||
def parse_args() -> argparse.Namespace:
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument(
|
||||
"realm_file",
|
||||
nargs="?",
|
||||
type=Path,
|
||||
default=Path("keycloak/import/keycloak-patterns-realm.json"),
|
||||
)
|
||||
parser.add_argument(
|
||||
"--runtime",
|
||||
action="store_true",
|
||||
help="validate an expanded CLI export instead of the committed template",
|
||||
)
|
||||
return parser.parse_args()
|
||||
|
||||
|
||||
def require(condition: bool, message: str) -> None:
|
||||
if not condition:
|
||||
raise SystemExit(f"realm validation failed: {message}")
|
||||
|
||||
|
||||
def indexed(items: list[dict[str, Any]], key: str) -> dict[str, dict[str, Any]]:
|
||||
return {str(item[key]): item for item in items}
|
||||
|
||||
|
||||
def validate(path: Path, runtime: bool) -> None:
|
||||
document = json.loads(path.read_text(encoding="utf-8"))
|
||||
require(document.get("realm") == REALM_NAME, f"realm must be {REALM_NAME}")
|
||||
require(document.get("enabled") is True, "realm must be enabled")
|
||||
require(document.get("accessTokenLifespan") == 300, "access token TTL must be 300s")
|
||||
require(document.get("revokeRefreshToken") is True, "refresh token rotation must be enabled")
|
||||
require(document.get("refreshTokenMaxReuse") == 0, "refresh token max reuse must be 0")
|
||||
|
||||
clients = indexed(document.get("clients", []), "clientId")
|
||||
expected_client_ids = {PUBLIC_CLIENT, *CONFIDENTIAL_CLIENTS}
|
||||
require(expected_client_ids <= clients.keys(), "all four pattern clients must exist")
|
||||
if not runtime:
|
||||
require(clients.keys() == expected_client_ids, "template must declare exactly four clients")
|
||||
|
||||
spa = clients[PUBLIC_CLIENT]
|
||||
require(spa.get("publicClient") is True, "spa-public must be a public client")
|
||||
require("secret" not in spa, "spa-public must not have a client secret")
|
||||
require(spa.get("standardFlowEnabled") is True, "spa-public standard flow must be enabled")
|
||||
require(
|
||||
spa.get("directAccessGrantsEnabled") is False,
|
||||
"spa-public direct access grants must be disabled",
|
||||
)
|
||||
require(
|
||||
spa.get("attributes", {}).get("pkce.code.challenge.method") == "S256",
|
||||
"spa-public must enforce PKCE S256",
|
||||
)
|
||||
|
||||
for client_id, placeholder in CONFIDENTIAL_CLIENTS.items():
|
||||
client = clients[client_id]
|
||||
require(client.get("publicClient") is False, f"{client_id} must be confidential")
|
||||
require(
|
||||
client.get("clientAuthenticatorType") == "client-secret",
|
||||
f"{client_id} must use client-secret authentication",
|
||||
)
|
||||
secret = client.get("secret")
|
||||
if runtime:
|
||||
require(isinstance(secret, str) and len(secret) >= 16, f"{client_id} secret missing")
|
||||
require(not secret.startswith("${"), f"{client_id} placeholder was not resolved")
|
||||
else:
|
||||
require(secret == placeholder, f"{client_id} must use an env placeholder")
|
||||
|
||||
roles = {
|
||||
role["name"]
|
||||
for role in document.get("roles", {}).get("realm", [])
|
||||
if "name" in role
|
||||
}
|
||||
require(EXPECTED_ROLES <= roles, "admin-role and user-role must exist")
|
||||
|
||||
users = indexed(document.get("users", []), "username")
|
||||
require(EXPECTED_USERS <= users.keys(), "both baseline users must exist")
|
||||
if not runtime:
|
||||
expected_passwords = {
|
||||
"admin-user": "${ADMIN_USER_PASSWORD}",
|
||||
"regular-user": "${REGULAR_USER_PASSWORD}",
|
||||
}
|
||||
for username, placeholder in expected_passwords.items():
|
||||
credentials = users[username].get("credentials", [])
|
||||
require(len(credentials) == 1, f"{username} must have one initial credential")
|
||||
require(
|
||||
credentials[0].get("value") == placeholder,
|
||||
f"{username} password must use an env placeholder",
|
||||
)
|
||||
|
||||
print(
|
||||
f"realm validated: {REALM_NAME}, four pattern clients, "
|
||||
f"{len(EXPECTED_ROLES)} roles, {len(EXPECTED_USERS)} users"
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
arguments = parse_args()
|
||||
validate(arguments.realm_file, arguments.runtime)
|
||||
Executable
+70
@@ -0,0 +1,70 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
if [ ! -f .env ]; then
|
||||
echo "missing .env" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -a
|
||||
. ./.env
|
||||
set +a
|
||||
|
||||
keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
|
||||
|
||||
admin_token="$(
|
||||
curl -fsS \
|
||||
-d client_id=admin-cli \
|
||||
-d grant_type=password \
|
||||
-d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
-d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
|
||||
"$keycloak_url/realms/master/protocol/openid-connect/token" |
|
||||
jq -er .access_token
|
||||
)"
|
||||
|
||||
idp="$(
|
||||
curl -fsS \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$keycloak_url/admin/realms/keycloak-patterns/identity-provider/instances/mock-google"
|
||||
)"
|
||||
|
||||
printf '%s' "$idp" | jq -e '
|
||||
.providerId == "oidc" and
|
||||
.enabled == true and
|
||||
.trustEmail == false and
|
||||
.config.clientId == "mock-google-broker" and
|
||||
.config.defaultScope == "openid profile email" and
|
||||
.config.syncMode == "IMPORT" and
|
||||
.config.validateSignature == "true"
|
||||
' >/dev/null
|
||||
|
||||
client="$(
|
||||
curl -fsS \
|
||||
-H "Authorization: Bearer $admin_token" \
|
||||
"$keycloak_url/admin/realms/mock-google/clients?clientId=mock-google-broker"
|
||||
)"
|
||||
|
||||
printf '%s' "$client" | jq -e '
|
||||
length == 1 and
|
||||
.[0].publicClient == false and
|
||||
(.[0].redirectUris | index(
|
||||
"http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
|
||||
)) != null
|
||||
' >/dev/null
|
||||
|
||||
location="$(
|
||||
curl -sS -D - -o /dev/null \
|
||||
"$keycloak_url/realms/keycloak-patterns/protocol/openid-connect/auth?client_id=spa-public&redirect_uri=http%3A%2F%2Flocalhost%3A8088%2F&response_type=code&scope=openid&code_challenge=K2qUEfBl-nQvF2gB4dNxC2zYVwZc1CVnZb5CsX2L7fI&code_challenge_method=S256&kc_idp_hint=mock-google" |
|
||||
awk 'BEGIN { IGNORECASE=1 } /^Location:/ { print $2 }' |
|
||||
tr -d '\r'
|
||||
)"
|
||||
|
||||
case "$location" in
|
||||
"$keycloak_url/realms/keycloak-patterns/broker/mock-google/login"*) ;;
|
||||
*)
|
||||
echo "broker did not redirect to the controllable OIDC provider: $location" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "Google broker contract verified with the local mock OIDC realm"
|
||||
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
compose_file=${COMPOSE_FILE:-docker-compose.yml}
|
||||
|
||||
python3 scripts/validate-realm.py
|
||||
./scripts/verify-stack.sh
|
||||
|
||||
curl --fail --silent --show-error --output /dev/null \
|
||||
"http://localhost:8080/realms/keycloak-patterns/.well-known/openid-configuration"
|
||||
|
||||
docker compose -f "$compose_file" exec -T keycloak sh -ec '
|
||||
kcadm=/opt/keycloak/bin/kcadm.sh
|
||||
"$kcadm" config credentials \
|
||||
--server http://localhost:8080 \
|
||||
--realm master \
|
||||
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
||||
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null
|
||||
|
||||
clients=$("$kcadm" get clients -r keycloak-patterns --fields clientId)
|
||||
for client in \
|
||||
spa-public \
|
||||
token-mediating-confidential \
|
||||
bff-confidential \
|
||||
edge-proxy
|
||||
do
|
||||
printf "%s" "$clients" | grep -q "\"$client\""
|
||||
done
|
||||
|
||||
users=$("$kcadm" get users -r keycloak-patterns --fields username)
|
||||
printf "%s" "$users" | grep -q "\"admin-user\""
|
||||
printf "%s" "$users" | grep -q "\"regular-user\""
|
||||
|
||||
roles=$("$kcadm" get roles -r keycloak-patterns --fields name)
|
||||
printf "%s" "$roles" | grep -q "\"admin-role\""
|
||||
printf "%s" "$roles" | grep -q "\"user-role\""
|
||||
'
|
||||
|
||||
echo "realm verified: import, discovery, four clients, two roles, two users"
|
||||
Reference in New Issue
Block a user