20 lines
702 B
Bash
Executable File
20 lines
702 B
Bash
Executable File
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
base="${KEYCLOAK_URL:-http://localhost:8080}"
|
|
main_issuer="$base/realms/keycloak-patterns"
|
|
mock_issuer="$base/realms/mock-google"
|
|
|
|
test "$(curl -fsS "$main_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
|
|
= "$main_issuer"
|
|
test "$(curl -fsS "$mock_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
|
|
= "$mock_issuer"
|
|
|
|
rg -Fq 'SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:' docker-compose.yml
|
|
if rg -qi 'accounts\\.google\\.com|realms/mock-google' backend/src/main; then
|
|
echo "backend must trust only the Keycloak issuer, not the upstream IdP" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Three-leg trust anchors verified: upstream -> Keycloak -> Resource Server"
|