Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SPSH-1307 SchoolSH client and realm keys #86

Closed
wants to merge 11 commits into from
Closed

SPSH-1307 SchoolSH client and realm keys #86

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
7ef170b
Client for school-sh
marode-cap Nov 25, 2024
3221e3e
Use full URLs
marode-cap Nov 25, 2024
5296f7d
Add to configmap
marode-cap Nov 25, 2024
0aa3d6e
Replace dashes with underscores
marode-cap Nov 25, 2024
54cd176
Switch to manual provider
marode-cap Nov 25, 2024
fede84c
Fix typo
marode-cap Nov 25, 2024
85600c7
cleanup
marode-cap Nov 25, 2024
a018e08
Accidental space
marode-cap Nov 25, 2024
ac3b896
Update prod realm
marode-cap Nov 25, 2024
28a9dc7
Switch to invalid TLD for dev
marode-cap Nov 25, 2024
53c866f
Add client ID
marode-cap Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 83 additions & 2 deletions charts/dbildungs-iam-keycloak/dev-realm-spsh.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1445,6 +1445,72 @@
"configure": true,
"manage": true
}
},
{
"id": "dd986a17-44c7-4ec9-87f6-addf1646ecf0",
"clientId": "school-sh",
"name": "School-SH",
"description": "",
"rootUrl": "${KC_SCHOOLSH_CLIENT_ROOT_URL}",
"adminUrl": "",
"baseUrl": "",
"surrogateAuthRequired": false,
"enabled": true,
"alwaysDisplayInConsole": false,
"clientAuthenticatorType": "client-secret",
"secret": "${KC_SCHOOLSH_CLIENT_SECRET}",
"redirectUris": [
"/cgi/samlauth"
],
"webOrigins": [
"+"
],
"notBefore": 0,
"bearerOnly": false,
"consentRequired": false,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"publicClient": false,
"frontchannelLogout": true,
"protocol": "saml",
"attributes": {
"saml.assertion.signature": "true",
"saml_assertion_consumer_url_redirect": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/samlauth",
"saml_single_logout_service_url_post": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/tmlogout",
"saml.force.post.binding": "true",
"saml.encrypt": "true",
"saml_assertion_consumer_url_post": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/samlauth",
"saml.server.signature": "true",
"saml.server.signature.keyinfo.ext": "false",
"saml.signing.certificate": "${KC_SCHOOLSH_CLIENT_SIGNING_CERTIFICATE}",
"saml_single_logout_service_url_redirect": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/tmlogout",
"saml.artifact.binding": "false",
"saml.signature.algorithm": "RSA_SHA256",
"saml_force_name_id_format": "false",
"saml.client.signature": "true",
"saml.encryption.certificate": "${KC_SCHOOLSH_CLIENT_ENCRYPTION_CERTIFICATE}",
"saml.authnstatement": "true",
"display.on.consent.screen": "false",
"saml_name_id_format": "username",
"saml.allow.ecp.flow": "false",
"saml_signature_canonicalization_method": "http://www.w3.org/2001/10/xml-exc-c14n#",
"saml.onetimeuse.condition": "false",
"saml.server.signature.keyinfo.xmlSigKeyInfoKeyNameTransformer": "NONE"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": true,
"nodeReRegistrationTimeout": -1,
"defaultClientScopes": [
"role_list"
],
"optionalClientScopes": [],
"access": {
"view": true,
"configure": true,
"manage": true
}
}
],
"clientScopes": [
Expand Down Expand Up @@ -2126,12 +2192,27 @@
},
{
"id": "d47622d7-8d04-4d38-b7f0-d80eb182f80d",
"name": "rsa-generated",
"providerId": "rsa-generated",
"name": "rsa",
"providerId": "rsa",
"subComponents": {},
"config": {
"privateKey": [
"${KC_RS256_PRIVATE_KEY}"
],
"certificate": [
"${KC_RS256_CERTIFICATE}"
],
"active": [
"true"
],
"enabled": [
"true"
],
"priority": [
"100"
],
"algorithm": [
"RS256"
]
}
},
Expand Down
85 changes: 83 additions & 2 deletions charts/dbildungs-iam-keycloak/prod-realm-spsh.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1282,6 +1282,72 @@
"configure": true,
"manage": true
}
},
{
"id": "dd986a17-44c7-4ec9-87f6-addf1646ecf0",
"clientId": "school-sh",
"name": "School-SH",
"description": "",
"rootUrl": "${KC_SCHOOLSH_CLIENT_ROOT_URL}",
"adminUrl": "",
"baseUrl": "",
"surrogateAuthRequired": false,
"enabled": true,
"alwaysDisplayInConsole": false,
"clientAuthenticatorType": "client-secret",
"secret": "${KC_SCHOOLSH_CLIENT_SECRET}",
"redirectUris": [
"/cgi/samlauth"
],
"webOrigins": [
"+"
],
"notBefore": 0,
"bearerOnly": false,
"consentRequired": false,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"publicClient": false,
"frontchannelLogout": true,
"protocol": "saml",
"attributes": {
"saml.assertion.signature": "true",
"saml_assertion_consumer_url_redirect": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/samlauth",
"saml_single_logout_service_url_post": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/tmlogout",
"saml.force.post.binding": "true",
"saml.encrypt": "true",
"saml_assertion_consumer_url_post": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/samlauth",
"saml.server.signature": "true",
"saml.server.signature.keyinfo.ext": "false",
"saml.signing.certificate": "${KC_SCHOOLSH_CLIENT_SIGNING_CERTIFICATE}",
"saml_single_logout_service_url_redirect": "${KC_SCHOOLSH_CLIENT_ROOT_URL}/cgi/tmlogout",
"saml.artifact.binding": "false",
"saml.signature.algorithm": "RSA_SHA256",
"saml_force_name_id_format": "false",
"saml.client.signature": "true",
"saml.encryption.certificate": "${KC_SCHOOLSH_CLIENT_ENCRYPTION_CERTIFICATE}",
"saml.authnstatement": "true",
"display.on.consent.screen": "false",
"saml_name_id_format": "username",
"saml.allow.ecp.flow": "false",
"saml_signature_canonicalization_method": "http://www.w3.org/2001/10/xml-exc-c14n#",
"saml.onetimeuse.condition": "false",
"saml.server.signature.keyinfo.xmlSigKeyInfoKeyNameTransformer": "NONE"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": true,
"nodeReRegistrationTimeout": -1,
"defaultClientScopes": [
"role_list"
],
"optionalClientScopes": [],
"access": {
"view": true,
"configure": true,
"manage": true
}
}
],
"clientScopes": [
Expand Down Expand Up @@ -1963,12 +2029,27 @@
},
{
"id": "d47622d7-8d04-4d38-b7f0-d80eb182f80d",
"name": "rsa-generated",
"providerId": "rsa-generated",
"name": "rsa",
"providerId": "rsa",
"subComponents": {},
"config": {
"privateKey": [
"${KC_RS256_PRIVATE_KEY}"
],
"certificate": [
"${KC_RS256_CERTIFICATE}"
],
"active": [
"true"
],
"enabled": [
"true"
],
"priority": [
"100"
],
"algorithm": [
"RS256"
]
}
},
Expand Down
1 change: 1 addition & 0 deletions charts/dbildungs-iam-keycloak/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,5 +11,6 @@ data:
KC_ROOT_URL: "https://{{ .Values.frontendHostname }}"
KC_PROXY: "edge"
KEYCLOAK_ADMIN: admin
KC_SCHOOLSH_CLIENT_ROOT_URL: "{{ .Values.schoolsh.rootUrl }}"
KC_HTTP_MANAGEMENT_PORT: "8090"
STATUS_URL: "{{ .Values.status.url }}"
25 changes: 25 additions & 0 deletions charts/dbildungs-iam-keycloak/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,16 @@ spec:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: db-password
- name: KC_RS256_PRIVATE_KEY
valueFrom:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: keycloak-rs256-privateKey
- name: KC_RS256_CERTIFICATE
valueFrom:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: keycloak-rs256-certificate
- name: KC_CLIENT_SECRET
valueFrom:
secretKeyRef:
Expand Down Expand Up @@ -127,6 +137,21 @@ spec:
key: keycloak-nextcloud-clientSecret
- name: KC_DB_URL
value: "jdbc:postgresql://$(DB_HOST)/$(DB_NAME)"
- name: KC_SCHOOLSH_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: keycloak-schoolsh-clientSecret
- name: KC_SCHOOLSH_CLIENT_SIGNING_CERTIFICATE
valueFrom:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: keycloak-schoolsh-signingCertificate
- name: KC_SCHOOLSH_CLIENT_ENCRYPTION_CERTIFICATE
valueFrom:
secretKeyRef:
name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
key: keycloak-schoolsh-encryptionCertificate
{{- if .Values.extraEnvVars }}
{{ toYaml .Values.extraEnvVars | nindent 12 }}
{{- end }}
Expand Down
5 changes: 5 additions & 0 deletions charts/dbildungs-iam-keycloak/templates/secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ data:
admin-password: {{ .Values.auth.admin_password }}
db-host: {{ .Values.database.host }}
db-password: {{ .Values.database.password }}
keycloak-rs256-privateKey: {{ .Values.auth.keycloak_rs256_privateKey }}
keycloak-rs256-certificate: {{ .Values.auth.keycloak_rs256_certificate }}
keycloak-adminSecret: {{ .Values.auth.keycloak_adminSecret }}
keycloak-clientSecret: {{ .Values.auth.keycloak_clientSecret }}
keycloak-itslearning-clientSecret: {{ .Values.auth.keycloak_itslearning_clientSecret }}
Expand All @@ -20,5 +22,8 @@ data:
pi-user-realm: {{ .Values.auth.pi_user_realm }}
keycloak-nextcloud-clientId: {{ .Values.auth.keycloak_nextcloud_clientId }}
keycloak-nextcloud-clientSecret: {{ .Values.auth.keycloak_nextcloud_clientSecret }}
keycloak-schoolsh-clientSecret: {{ .Values.auth.keycloak_schoolsh_clientSecret }}
keycloak-schoolsh-signingCertificate: {{ .Values.auth.keycloak_schoolsh_signingCertificate }}
keycloak-schoolsh-encryptionCertificate: {{ .Values.auth.keycloak_schoolsh_encryptionCertificate }}

{{- end }}
9 changes: 9 additions & 0 deletions charts/dbildungs-iam-keycloak/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,17 @@ image:
tag: ""
pullPolicy: Always

schoolsh:
rootUrl: https://school-sh.invalid

auth:
# existingSecret: Refers to a secret already present in the cluster, which is required for the authentication and configuration of the database setup tasks.
existingSecret: ""
secretName: dbildungs-iam-keycloak
admin_password: ""
admin_user: ""
keycloak_rs256_privateKey: ""
keycloak_rs256_certificate: ""
keycloak_adminSecret: ""
keycloak_clientSecret: ""
keycloak_itslearning_clientSecret: ""
Expand All @@ -25,6 +30,10 @@ auth:
pi_admin_password: ""
pi_user_resolver: ""
pi_user_realm: ""
schoolsh_clientSecret: ""
schoolsh_signingCertificate: ""
schoolsh_encryptionCertificate: ""


command: []

Expand Down
Loading