OIDC/Auth2 integration #18
Conversation
entrypoint
Outdated
| KEYCLOAK_HOST="${KEYCLOAK_URL:-keycloak}" \ | ||
| KEYCLOAK_PORT="${KEYCLOAK_URL:-8080}" \ |
There was a problem hiding this comment.
This is not consistent with what's being evaluated in caddy_base.json
| # remove endpoints if not set | ||
| for ENDPOINT in ACTION_HOST PRESENTER_HOST AUTOUPDATE_HOST ICC_HOST SEARCH_HOST MEDIA_HOST MANAGE_HOST CLIENT_HOST VOTE_HOST KEYCLOAK_HOST; do | ||
| if [ -z "${!ENDPOINT}" ]; then | ||
| echo "Removing endpoint $ENDPOINT" | ||
| jq ".apps.http.servers.srv0.routes |= map(select(.handle | any(.upstreams[]?.dial | contains(\"$ENDPOINT\") | not)))" "$base" > "$base.out" | ||
| mv -f "$base.out" "$base" | ||
| fi | ||
| done | ||
|
|
There was a problem hiding this comment.
I see this construct can be helpful.
I see the following risk:
Until now this entrypoint script ensured that all endpoint env vars are set (at least to defaults). Now if an admin of OpenSlides somehow misses setting one of these, the service suddenly is no longer reachable. This can be desired, but should be documented maybe here.
Checking if the manage tool actually does set all these variables to defaults: no it does not! See default config. So this must be adjusted to include CLIENT_HOST and CLIENT_PORT or suddenly the client won't be proxied anymore.
Personally I'd also prefer a [ -z "${ENDPOINT}" ] check (without '!'). I think it is less confusing as the '!' expansion is not as widely known. Also it would enable one to override some SERVICE_HOST= without needing to actually unset it to disable the service. This would provide more flexibility IMO.
| for var in $(grep -o '\$[A-Za-z_][A-Za-z0-9_]*' $config | sort | uniq | sed 's/\$//'); do | ||
| echo "Checking variable $var" | ||
| if [[ -z "${!var}" ]]; then | ||
| echo "Variable $var is not set" | ||
| fi | ||
| done |
There was a problem hiding this comment.
This is just a redundant check to be sure no unset variables survived, right?
This seems fine though.
This PR contains a POC for a OIDC/oauth2 integration into OpenSlides. The dev setup is based on keycloak.