Add auth option for Tornjak (#259)

* Added auth option, specifically keycloak for tornjak production use Signed-off-by: Mohammed Abdi <[email protected]> * Added auth values for tornjak Signed-off-by: Mohammed Abdi <[email protected]> * Update charts/spire/charts/tornjak-frontend/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Mariusz Sabath <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * install keycloak first Signed-off-by: Mohammed Abdi <[email protected]> * add logs volume back Signed-off-by: Mohammed Abdi <[email protected]> * Fixed NPM init error Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the values documentation errors Signed-off-by: Mariusz Sabath <[email protected]> * Post-review suggestion fixes Signed-off-by: Mariusz Sabath <[email protected]> * Fixed typo Signed-off-by: Mariusz Sabath <[email protected]> * Updating Keyclaok examples README Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the parameter reference Signed-off-by: Mariusz Sabath <[email protected]> * Fix typo Signed-off-by: Mariusz Sabath <[email protected]> * use keycloak-config-cli to simplify tornjak realm import Signed-off-by: MohammedAbdi <[email protected]> * edit client id Signed-off-by: MohammedAbdi <[email protected]> * reverse client id Signed-off-by: MohammedAbdi <[email protected]> * fix the doc Signed-off-by: Mariusz Sabath <[email protected]> * update tornjak version and backend auth Signed-off-by: MohammedAbdi <[email protected]> * update client id Signed-off-by: MohammedAbdi <[email protected]> * updates values yaml Signed-off-by: MohammedAbdi <[email protected]> * update documentation Signed-off-by: MohammedAbdi <[email protected]> * nit Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * add audience check tornjak Signed-off-by: MohammedAbdi <[email protected]> * remove unused file Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * nit and add auth not enabled warning back Signed-off-by: MohammedAbdi <[email protected]> * adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery Signed-off-by: MohammedAbdi <[email protected]> * update doc and add keycloak proxy Signed-off-by: MohammedAbdi <[email protected]> --------- Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: MohammedAbdi <[email protected]> Co-authored-by: Mohammed Abdi <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
2024-04-25 15:49:20 -07:00
parent f679a0dab6
commit a2494ee45e
15 changed files with 360 additions and 71 deletions
@@ -0,0 +1,128 @@
+auth:
+  ## @param keycloak.auth.realm Realm name in which to create users## @param auth.adminUser Keycloak administrator user
+  ##
+  adminUser: admin
+  ## @param auth.adminPassword Keycloak administrator password for the new user
+  ##
+  adminPassword: admin
+proxy: edge # for https proxy reverse mode
+keycloakConfigCli:
+  enabled: true
+  configuration: # tornjak realm configuration
+    tornjak.json: |
+      {
+        "realm": "tornjak",
+        "enabled": true,
+        "roles" : {
+          "realm" : [ {
+            "name" : "tornjak-viewer-realm-role"
+          }, {
+            "name" : "tornjak-admin-realm-role"
+          } ],
+          "client" : {
+            "tornjak" : [ {
+              "name" : "viewer",
+              "composite" : true,
+              "composites" : {
+                "realm" : [ "tornjak-viewer-realm-role" ]
+              },
+              "clientRole" : true
+            }, {
+              "name" : "admin",
+              "composite" : true,
+              "composites" : {
+                "realm" : [ "tornjak-admin-realm-role" ]
+              },
+              "clientRole" : true
+            } ]
+          }
+        },
+        "groups" : [ {
+          "name" : "admin",
+          "path" : "/admin",
+          "realmRoles" : [ "tornjak-admin-realm-role" ]
+        }, {
+          "name" : "viewer",
+          "path" : "/viewer",
+          "realmRoles" : [ "tornjak-viewer-realm-role" ]
+        } ],
+        "users" : [ {
+          "username" : "admin",
+          "enabled" : true,
+          "firstName" : "Admin",
+          "lastName" : "User",
+          "credentials" : [ {
+            "type" : "password",
+            "userLabel" : "My password",
+            "secretData" : "{\"value\":\"Y1Kcmx/XxLWtnRLyMy/zn6wWbfu2fSKdaefrXM50cva3P+kA2BqBDvTZDswGP6JZ+IWrJaitm8RKV0L9LiwaFQ==\",\"salt\":\"Mh5g1EgTo26xhzoj67bovA==\",\"additionalParameters\":{}}",
+            "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
+          } ],
+          "groups" : [ "/admin" ]
+        }, {
+          "username" : "viewer",
+          "enabled" : true,
+          "firstName" : "Viewer",
+          "lastName" : "User",
+          "credentials" : [ {
+            "type" : "password",
+            "userLabel" : "My password",
+            "secretData" : "{\"value\":\"1ow3LfLDvpBRLfRbr2LtFRqje8NsKouHMw95Wwpsg5NP2Pga4ZBL7+T62bCDV6dOvy3U9xEEU4CRkhSWFaeDLg==\",\"salt\":\"qML2gBVSG7xYRZcaffW68A==\",\"additionalParameters\":{}}",
+            "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
+          } ],
+          "groups" : [ "/viewer" ]
+        } ],
+        "clients" : [ {
+          "clientId" : "tornjak",
+          "name" : "Tornjak",
+          "enabled" : true,
+          "alwaysDisplayInConsole" : true,
+          "clientAuthenticatorType" : "client-secret",
+          "redirectUris" : [ "http://localhost:3000/*" ],
+          "webOrigins" : [ "*" ],
+          "standardFlowEnabled" : true,
+          "implicitFlowEnabled" : false,
+          "directAccessGrantsEnabled" : false,
+          "serviceAccountsEnabled" : false,
+          "publicClient" : true,
+          "frontchannelLogout" : true,
+          "protocol" : "openid-connect",
+          "attributes" : {
+            "post.logout.redirect.uris" : "http://localhost:3000/*"
+          },
+          "fullScopeAllowed" : true,
+          "defaultClientScopes": [
+            "role_list",
+            "profile",
+            "email",
+            "roles",
+            "web-origins",
+            "acr",
+            "tornjak-backend",
+          ]
+        }],
+        "clientScopes": [{
+          "name": "tornjak-backend",
+          "description": "tornjak backend audience check",
+          "protocol": "openid-connect",
+          "attributes": {
+            "include.in.token.scope": "false",
+            "display.on.consent.screen": "false",
+            "gui.order": "",
+            "consent.screen.text": ""
+          },
+          "protocolMappers": [{
+            "name": "tornjak-backend",
+            "protocol": "openid-connect",
+            "protocolMapper": "oidc-audience-mapper",
+            "consentRequired": false,
+            "config": {
+              "introspection.token.claim": "true",
+              "included.custom.audience": "tornjak-backend",
+              "userinfo.token.claim": "false",
+              "id.token.claim": "false",
+              "lightweight.claim": "false",
+              "access.token.claim": "true"
+            }
+          }]
+        }]
+      }