From 5a8faf7d566302f5b8a6c85aeb4c668f3ce07673 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20Forc=C3=A9n=20Mu=C3=B1oz?= Date: Wed, 16 Oct 2024 21:33:03 +0200 Subject: [PATCH] First commit --- .gitignore | 1 + bootstrap.yml | 152 + files/grafana/mforcen.crt | 33 + .../ssl/grafana.mforcen.dev.fullchain.pem | 67 + files/grafana/ssl/grafana.mforcen.dev.key | 52 + files/keycloak/Containerfile | 26 + files/keycloak/infra-realm.json | 2515 +++++++++++++++++ files/keycloak/mforcen.crt | 33 + files/keycloak/sso.mforcen.dev.fullchain.pem | 67 + files/keycloak/sso.mforcen.dev.key | 52 + inventory.yml | 3 + templates/compose.yml | 100 + templates/grafana.ini | 1907 +++++++++++++ templates/grafana.sql | 5 + templates/keycloak.sql | 5 + 15 files changed, 5018 insertions(+) create mode 100644 .gitignore create mode 100644 bootstrap.yml create mode 100644 files/grafana/mforcen.crt create mode 100644 files/grafana/ssl/grafana.mforcen.dev.fullchain.pem create mode 100644 files/grafana/ssl/grafana.mforcen.dev.key create mode 100644 files/keycloak/Containerfile create mode 100644 files/keycloak/infra-realm.json create mode 100644 files/keycloak/mforcen.crt create mode 100644 files/keycloak/sso.mforcen.dev.fullchain.pem create mode 100644 files/keycloak/sso.mforcen.dev.key create mode 100644 inventory.yml create mode 100644 templates/compose.yml create mode 100644 templates/grafana.ini create mode 100644 templates/grafana.sql create mode 100644 templates/keycloak.sql diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1d17dae --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.venv diff --git a/bootstrap.yml b/bootstrap.yml new file mode 100644 index 0000000..b041528 --- /dev/null +++ b/bootstrap.yml @@ -0,0 +1,152 @@ +--- +- name: Creating compose from template + hosts: localhost + gather_facts: false + tasks: + - name: Generate password for Keycloak password + ansible.builtin.set_fact: + keycloak_pass: "{{ lookup('community.general.random_string', length=20, min_lower=1, min_upper=1, min_numeric=1, special=false) }}" + grafana_pass: "{{ lookup('community.general.random_string', length=20, min_lower=1, min_upper=1, min_numeric=1, special=false) }}" + postgres_pass: "{{ lookup('community.general.random_string', length=20, min_lower=1, min_upper=1, min_numeric=1, special=false) }}" + grafana_kc_client_secret: "{{ lookup('community.general.random_string', length=20, min_lower=1, min_upper=1, min_numeric=1, special=false) }}" + + - name: Get current user + ansible.builtin.command: echo $USER + register: usercmd + + - name: Ensure working directory exists + ansible.builtin.stat: + path: /opt/infra + register: infrastat + + - name: Fails if working directory does not belong to ansible user + ansible.builtin.fail: + msg: "/opt/infra does not belong to {{ usercmd.stdout }}" + when: infrastat.stat.pw_name != usercmd.stdout + + - name: Generating Compose file + ansible.builtin.template: + src: compose.yml + dest: /opt/infra/compose.yml + + - name: Create postgres directory if it does not exist + ansible.builtin.file: + path: /opt/infra/postgres + state: directory + mode: '0755' + + - name: Create init-scripts directory if it does not exist + ansible.builtin.file: + path: /opt/infra/postgres/init-scripts + state: directory + mode: '0755' + + - name: Generate postgres init scripts for grafana user + ansible.builtin.template: + src: grafana.sql + dest: /opt/infra/postgres/init-scripts/grafana.sql + + - name: Generate postgres init scripts for keycloak user + ansible.builtin.template: + src: keycloak.sql + dest: /opt/infra/postgres/init-scripts/keycloak.sql + + - name: Copying grafana cert files + ansible.builtin.copy: + src: grafana + dest: /opt/infra/ + + - name: Copying keycloak image build files + ansible.builtin.copy: + src: keycloak + dest: /opt/infra/ + + - name: Deploying Compose file + community.docker.docker_compose_v2: + project_src: /opt/infra + files: + - compose.yml + + - name: Wait for docker to have all images deployed + ansible.builtin.wait_for: + timeout: 30 + + # - name: Adding root cert to grafana image + # community.docker.docker_container_copy_into: + # container: infra-grafana + # path: files/mforcen.crt + # container_path: /etc/ssl/mforcen.crt + # + # - name: Creating ssl folder + # community.docker.docker_container_exec: + # container: infra-grafana + # command: mkdir /ssl + # user: 0 + # + # - name: Adding fullchain cert to grafana container + # community.docker.docker_container_copy_into: + # container: infra-grafana + # path: files/grafana.mforcen.dev.fullchain.pem + # container_path: /ssl/grafana.mforcen.dev.fullchain.pem + # mode: 0755 + # + # - name: Adding key to grafana container + # community.docker.docker_container_copy_into: + # container: infra-grafana + # path: files/grafana.mforcen.dev.key + # container_path: /ssl/grafana.mforcen.dev.key + # mode: 0755 + + - name: Wait for keycloak to be ready + ansible.builtin.wait_for: + timeout: 60 + + - name: Creating realm infra in Keycloak + community.general.keycloak_realm: + auth_client_id: admin-cli + auth_keycloak_url: https://sso.mforcen.dev + auth_realm: master + auth_username: admin + auth_password: Radiola.123 + state: present + id: infra + realm: infra + + - name: Creating client Grafana in Keycloak + community.general.keycloak_client: + auth_client_id: admin-cli + auth_keycloak_url: https://sso.mforcen.dev + auth_realm: master + auth_username: admin + auth_password: Radiola.123 + realm: infra + client_id: grafana + enabled: true + direct_access_grants_enabled: true + protocol: openid-connect + standard_flow_enabled: true + root_url: https://grafana.mforcen.dev + redirect_uris: + - https://grafana.mforcen.dev/* + web_origins: + - https://grafana.mforcen.dev/* + admin_url: https://grafana.mforcen.dev + base_url: https://grafana.mforcen.dev + client_authenticator_type: client-secret + id: a6960246-4aa9-495f-8843-69d664dba0ea + secret: "{{ grafana_kc_client_secret }}" + + # - name: Create grafana config ini file + # ansible.builtin.template: + # src: grafana.ini + # dest: ../grafana.ini + # + # - name: Stopping grafana container + # community.docker.docker_container: + # name: infra-grafana + # state: stopped + # + # - name: Starting grafana container + # community.docker.docker_container: + # name: infra-grafana + # state: started diff --git a/files/grafana/mforcen.crt b/files/grafana/mforcen.crt new file mode 100644 index 0000000..7abe998 --- /dev/null +++ b/files/grafana/mforcen.crt @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFtzCCA5+gAwIBAgIUbvxoDsh6uZTB1wpb0mvR3MpLYygwDQYJKoZIhvcNAQEL +BQAwazELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFu +dWVsIEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAwOTE2MjAzMVoXDTM0MTAwNzE2MjAzMVow +azELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFudWVs +IEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEWDm1l +QG1mb3JjZW4uZGV2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5TlR +C8V5denK+snVj/N6mAcZaPE9YVyD1IYTA5tvmLZkBFOfCo1Ak5QSv5z1lMKjc6qE +32RLBsCZM0U+KFL9CerMdNtYPrWqlG4FffvKbaan0HHMFxdfDWkVFhPRtHU7LPcT +m5cSmQdsecst1CrLLA6bzhbdcw9GcRA1s+TrlNwNHiXGEQvg9JZbm+vpksR1xVbz +OAx5aHZx3XS6JokMovjc7pYdsi3bLIzvc1eBRsu+KMPOJ+mgolGnWPYKABpn8A9a +pV1t39mGLEPmw3l/83iH2mCTjAzDQHOE6KNd0mtF5+pEKwBzTVbQZBfRBLAvUrjP +PYeOPckImMR+k7l2rqyCBGdRod2DDDGN9f55uJ5+OAuxJ6v7Gg7rhlBVR5AJSIb8 +2FyZ7UfD2r1Vy/eHDo2bFkr1RQfvHCucxjlAkUcK1pyleboz3TbJ+z6Z2bZCkjOK +vbCxrxJjafGueqTmzxP/o/V6A9L3coSrWpILyxUYfs31K81XpYYyXN0m8ZZBmKTk +8LhMAkAPg+5KVcK9PS4VLWXkscZ5eR5eHbvTkphrLZ5KTR5uoTVVGDXGzRCB+Wl6 +mLPAIXrWuTS8F6wR/5Sk5D7mfiPfpZWVPRv3REcKpKl7Kqg1Ko8ob15xi7PHCYIi +nA7eJVinDvA0DcwN12LEiJcAV9vUKx92QxP0k6UCAwEAAaNTMFEwHQYDVR0OBBYE +FPkYkgkulvi/r0kWA2M825ni4zI8MB8GA1UdIwQYMBaAFPkYkgkulvi/r0kWA2M8 +25ni4zI8MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBALzjLPJs +/Qf+Ttw+Ke5dXC5CWT2C/4c8x1paLfiJRjdj+gvmzMRCEwyjuUY0+sxOJee4lPxM +We/S3km/DE3yRC9lSbYWxPYY8MMKiLB4k5Eo3FUw1zz/tgwP2nRoUzJ0KPbMbOTK +c+HUHfLmH5kRx2cBTz3mCMhpGSK7fPhZpWkxgKn3/xRbLGKDQ3ZG6l4fjZM4Dpkr +tTbfcf1OnwkzHqQ1jeXkqwfVTrxbjwNcdhfSU8XLgYJiULLRvNF2CmOqXMXXlhVg +zhTBipQt1ej18vVx0M2Ric4/4XpgBWkSRod6JCxphr9Cy0fm2BuilaJURt2eqfV2 +t+9HC54TcubcLZGXj6TL+PqmIhwTfst4ALmmyKB+fbdlPEPEZMIlskXQoFjvGI21 +A7j6yUL2vvpn0+ouifk4HmUJX+vY/u5TXSy+MDVwmMdRFPUt8lUzEbXB+ijEdm/T +yz8LrlcXIyoScsK7wE5IAw18CQleAVkRTWE+b6qInWoBzZbhTRzfCutIVn0ocKqu +s2n020nZpDBo87/SiHzIlzXh+mxTM9g39cuLpFFEnye0ZnyO4nSwQeybZlQXe0ND +EvweNEy4OR+SUiT4witD53REEn1eyr2IYJEgK/7L+1vSFbqrkIwkPf5dY6/EhkvP +Wf8dJV5WswtZStdYGRyq4jbLucNKtEMNLJhY +-----END CERTIFICATE----- diff --git a/files/grafana/ssl/grafana.mforcen.dev.fullchain.pem b/files/grafana/ssl/grafana.mforcen.dev.fullchain.pem new file mode 100644 index 0000000..a8205e9 --- /dev/null +++ b/files/grafana/ssl/grafana.mforcen.dev.fullchain.pem @@ -0,0 +1,67 @@ +-----BEGIN CERTIFICATE----- +MIIFzjCCA7agAwIBAgIUN+yqZtTpNBzmMppjPszb3oeZhSYwDQYJKoZIhvcNAQEL +BQAwazEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxCzAJBgNVBAYTAkVTMQ8wDQYDVQQI +DAZNdXJjaWExFjAUBgNVBAoMDU1hbnVlbCBGb3JjZW4xHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAxNDE4MTIyNFoXDTI5MTAxMzE4MTIyNFow +VDEcMBoGA1UEAwwTZ3JhZmFuYS5tZm9yY2VuLmRldjELMAkGA1UEBhMCRVMxDzAN +BgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFudWVsIEZvcmNlbjCCAiIwDQYJKoZI +hvcNAQEBBQADggIPADCCAgoCggIBANgEZBb/5rdo2JFN6fxHCJu+6cb/f/Nr14tC +z5+T5p1Uj2YGE73pQCWkuTYtXNkbyMWs5rMQEtBq1Eh8YXOCABy4gnQRjOSvgV4+ +kWH+YGuSKII3bNzZnSARvtNhShjo7uB5NgPjbYpe6qJ8omu9PBYddpbF6nMrYpeS +u6jVO1jlRhiXQpEaAsJlc2QSt2FhizBqezwICkqQIpvoxvQk2c7h7UC4FdZMunIy +GuQ5gouOep+d+x1paIniivO7brC2HxxTCSpa2+Z3KmEvUaaAP3vMf8QfKuD26Jbx +KBxIpPrWSZofGYfE7tQPQizgDRe62J3a/u/AGjyECYlBYZ3j/xAqeACUWVUp1+Dd +HjuwA1x6BX5tCEBLVxz4TcT92JQYwDcljbvIAyif56RHG2Dh0QI1hlZtNFNC/fdn +YGxsRg6yS+ky1kLxucP0R23OymDXnZDbRI7V9iegmqPzYXxMvByUIFK2HCCafCE/ +99B2nCKTVpiNC1jxj1HG693b4nw9wXNDO33eM/BYjPqEAmX8CBumqLkVjeGUdYj8 +tYMC3KNVYS1+PAjEEDDyi3l/CltRs+Dh/lVy2S+j4BVqQRLXU4dhwfWTFUrYFAPP +jOSZQxaHSUQDSe4mx0FrAEgFmmDV3mcPcew9DwJnYUEdK2x/cGunrzqw/OfLyaVe +1+BSZXZVAgMBAAGjgYAwfjAfBgNVHSMEGDAWgBRc4t76omnxreInvLtnc2S2TrNE +ZjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIE8DAkBgNVHREEHTAbghNncmFmYW5hLm1m +b3JjZW4uZGV2hwTAqGTIMB0GA1UdDgQWBBRpRofRPDWKKdyVtKdwb6l8S6Ls9DAN +BgkqhkiG9w0BAQsFAAOCAgEAuUakdo8k5ymg74WS/cEng2ThSGKd6/R9ph3l6zkV +yczJw5lVUHuzvRznBxVNSWNoWpzWrj5eXTI60PXZnWAD6QWGf608HDurOlHYIwl/ +0v36RVVS4Ds/NP4XR59qbyI/SCt7/TtxipBgEY1SScmoPVLMQzmvc74gkkDwgBI3 +01/3sunNpdtm9U5EOBkt7kvyx0duz2vYhNGGtowPrkB3nkTQ6zoLhDxnYHA2qzCW +2isLm+r/grWsScc050XLeLHTSHtk6++EHvsef5Js5EaJQ8ZC3iGR/WlVjq2CJkEg +FzjOnvQuw+NhycbLWzpXhPTa2vFNgQdZ13Ui1qJ9hPCx4U0kFw/op5p0VfzTviLe +pYe3zmrVS2ZYiurQ5rUQ5zuMjF3XPhFAmpRczq1mp63zvCh0pd7+IZwz8LHuLjhX +sBMkXtFSOJLLhcwS14UnpYL+4AcpAHY/gK6acEtw0njTenddv4RiOvszRybKWeYj +3euoLevE2FVFFTpcnvtfyEPgjvglqLBx+UDL49naJ6cFv9inqtRdef6Qo/88+VNz +eWnY0LIBRv48krXT4BjXd8oKrLV3FmMC3MbzTD7CBVF9/J2VpN77xIXPL79bv1HJ +yCjK7RVh3qcU0/JHvUkJiGt5516qAtu5wfDWHVspafDiXYQ5hQaOYpu6JTYFP8/8 +vJM= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFwTCCA6mgAwIBAgIUI2lRzQ83h1wud9kyxtu+QmrjjW8wDQYJKoZIhvcNAQEL +BQAwazELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFu +dWVsIEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAxMzE3MDgzMloXDTI5MTAxMjE3MDgzMlow +azEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxCzAJBgNVBAYTAkVTMQ8wDQYDVQQIDAZN +dXJjaWExFjAUBgNVBAoMDU1hbnVlbCBGb3JjZW4xHTAbBgkqhkiG9w0BCQEWDm1l +QG1mb3JjZW4uZGV2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxGNa +BVSWAWknlWMcTCU08BdMd0k9JHmsl5fSoxUHM6iiGZH0eAqH1hxLAN3lrmBkVLgR +etkK3Frk3HNwhzRssp4uh2OdGIveUIm1qfgpA5+0zTxBfFn+WhVx7Xif99U+wKxH +sFb8xgbBbrVWhF06S3eWFuYVNU16OBwNbuCQhAe5+ZC0Dh8zkmC37qavPBR9ByKd +1MayDV54wZK67/aq3b1xyO+mu7EYR8D1vbKCmkxYASBlXs270P4r+CKHt8xe2Db1 +Zs8nOQTcHEgYwIp8N9QI2BnHAw2iKDZwt9SwXO4YFxqO7ViedVTeruHIMAxTPAVX +MVz5Qg1lpFiUXzZVFIIyZ82etd7WC7clOPOKvB8HHnMathamK3D/pJwqZS31MdQW +87nPzugBJwG8eYfFOn7zwIPJqMpMRCrQUIIIZ1VzA5vMAD8ZI+U8dtWfqiVxQ2oT +OTjbqO8e9eTO12/iQ2ZmXqGrxxJexu/ulwvYP3rxEF4w+oJbI4rlOWfr7OnCNiRD +l+hojcMrB89igoVkDuTni28dVjHYxtBBPRl2RCy9Z0yrSrh3TFcY2yuDM1FZbEwn +6NsVwz7nGYZpi/wXqszQP3WsfmJjNmrUhVqNw/xRmbSFIcaIY6CvytiRCN5NfzmD +cBeJSDMWjeQVaqAbAg7/4ddKe4CtN11A6TkleB0CAwEAAaNdMFswHwYDVR0jBBgw +FoAU+RiSCS6W+L+vSRYDYzzbmeLjMjwwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMC +AfYwHQYDVR0OBBYEFFzi3vqiafGt4ie8u2dzZLZOs0RmMA0GCSqGSIb3DQEBCwUA +A4ICAQA9sqxxE6X/qw5JFJAxbPClKite4SStxcjdCZZiBsUl4QrT/8O9NZfhPNIT +gIugzGD5YtXqlYQZtwc/bJ0g3s1NdCXrA3fU+FrubeBBzTIw3o/YBgn9n7o+1C1M +kgCJq7s9biQub0Es4HnuTK/lNjvpEKLVTv2tOgV3Z2CRsFnfR0MNOGgZlY3ZkKEq +oWqTOHGH1fJO3sdJleXrGs1z2oUC3nRTUjRox+/EHMVKdf3+142i2UO+uSGScmRh +0xJC2Rh757hCZBO3DgT7qgGhEliLKCwCU6PZVmLEZ1RxjRZgVw0p7g7YxahfXSXQ +GvBntIcx2ynE3mE+Ke035qLAArc1hZbbwJ84bpplRbzEXSsLHOZ6iyg+/fFilVPZ +7D8oZtxmRjNSQbXCzDbEuC27nQS9DOIBL3jLg0inHKd6awxcb4IWS2tBDT+teoFj +MYkhwJhYKJUERN74lsodCQlxUcAqTxutHuSFEWqMUna+ujOjjRirPwWjSX3Qsjdi +DNJJtTY/sFn5ClBkMe9a9L/AcZuj0wTi575XGJCPAlilfEtawmYILSVcM8jvlADp +/lvTo3CaPSm5pWYlxyT6ye7wk6QexC3G1D47cDN3JOx3691tvfziPBDPmXeWWUuO +LWBWeRdSMgWm+LKnd/KhLRlgcQebOuWZ2+yNdf3dQsvgox2cWA== +-----END CERTIFICATE----- diff --git a/files/grafana/ssl/grafana.mforcen.dev.key b/files/grafana/ssl/grafana.mforcen.dev.key new file mode 100644 index 0000000..346a89a --- /dev/null +++ b/files/grafana/ssl/grafana.mforcen.dev.key @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDYBGQW/+a3aNiR +Ten8RwibvunG/3/za9eLQs+fk+adVI9mBhO96UAlpLk2LVzZG8jFrOazEBLQatRI +fGFzggAcuIJ0EYzkr4FePpFh/mBrkiiCN2zc2Z0gEb7TYUoY6O7geTYD422KXuqi +fKJrvTwWHXaWxepzK2KXkruo1TtY5UYYl0KRGgLCZXNkErdhYYswans8CApKkCKb +6Mb0JNnO4e1AuBXWTLpyMhrkOYKLjnqfnfsdaWiJ4orzu26wth8cUwkqWtvmdyph +L1GmgD97zH/EHyrg9uiW8SgcSKT61kmaHxmHxO7UD0Is4A0Xutid2v7vwBo8hAmJ +QWGd4/8QKngAlFlVKdfg3R47sANcegV+bQhAS1cc+E3E/diUGMA3JY27yAMon+ek +Rxtg4dECNYZWbTRTQv33Z2BsbEYOskvpMtZC8bnD9Edtzspg152Q20SO1fYnoJqj +82F8TLwclCBSthwgmnwhP/fQdpwik1aYjQtY8Y9Rxuvd2+J8PcFzQzt93jPwWIz6 +hAJl/Agbpqi5FY3hlHWI/LWDAtyjVWEtfjwIxBAw8ot5fwpbUbPg4f5Vctkvo+AV +akES11OHYcH1kxVK2BQDz4zkmUMWh0lEA0nuJsdBawBIBZpg1d5nD3HsPQ8CZ2FB +HStsf3Brp686sPzny8mlXtfgUmV2VQIDAQABAoICABJfyT21laPbLLSrWnBFgINy +6UKuf+0uKp7jV3K861xNkYb9lFdOjFDHYqOrlx62gMzjqJnpj5gfxh/GSKnBEI5g +2WPTDFd1YD0qeEZME1qDC6QL39wnPHi6Wa90Mo/M3GjGlqQdB7fB3BZnII+mgIJn +DivD+O3D7nZzGjhBrvMgSWaVEynxevObGoYUG3oSiHrdS88u5eUyvmbhlW615br1 +t68OGXlpfGBzR5tLEwIY4/BIyU/Wo/g6h1Q1CLTKQPoxS/HI2bSQRVAP7NOLTBsV +KXb+qbCJ//261I0XVsUpTghohczpIOFzzM6xXhu7HmrK8m1lOzYTixYcNBfwiUTo +O9apQl5vM6rEa537aHTaMVomhT/nXKGQ4bJONjtNyzCzmmIMr+CKFo7a2yS7ZZTq +thB5FfNpJpI7vKOm6N8VPwmGIttntIEwEekc2QYoXftjDHbWO90pFm5g5zce1fX1 +arR85ZHhi3z5Uz5bFkhq7Dz7f8Pa2aq1dehTurKfaYPQCaBQv9JhSkYL2ynCaYE0 +mU3IWpTfAR+5o6CBA7HZjUjF5ZFqxD9rtVe1H8IdC7LCZr9w7UNKp7UV0sDWL+lq +9IxO6kBwc43EK72w1tzaXR86UlyL2jf1+OntxgX65ESTWoMaCdItZJUXtcdsq4YI +NXPIFpI91ljzEwleuPABAoIBAQDwh+VHkSFfPxuwxdCFd8UHg4zgv4kuuKaaQOps +8/2AIwcwxH/WD4vyc2qeyIALcqFBB5CT4B/0UGxkhpFXg7+kv0Xrn4nKhKac+WLu +/4+nnjlC+kGqKPRaONEbuzFxraV5/ImI8fNnkDAwhKaUi7becFrJXQCMblYsp1dn +QDut2KTYM8cuVwozETPvIVyczAoT3rLL7AQ5u88fFyy9cMmJs93dGDRKgnzo7eQR +lVm3PVrrNtYr8bAzeq7Uw0vgj5Lkrm+bvdhpXSvqIIaaY2bIDH2po4FAJGUIKnVi +g0m19vwzMugULSwG4WS6ceoDodpSrAmZlT2TYZUFezyyZJ5VAoIBAQDl6ObIMyYm +HhB164QIVc2nLB6yUC5qaWDUJzSIvWRU8jb4ENJdL6V/FwDarceT4VCdp6i/5A4+ +E9HbVvqslKlJeVCKCaumGRVS8AdlJcSnyD7RW14EEY/nl443q81YPW5tnvrQoF7h +/Ncw6wPvZgWQRK/lZoE9FSejJgTUnNErfdckIJCfRzqMaetEtctfOPaictgsXMM4 +VD9r/OL/N98oRn8g/317A/hrZbjEZEGbTFoCvfPMsVgWIjoJbq8cBVha6St5zqXb +e+/EGwUtEfycxeXbMidFbtC2d68y1SfYOqe0CUPUhkGZKDGbJb626ac6FEC0GjMw +6rnJfAfFpXgBAoIBACGCLRTdSRLlzcvAox4U42P6laOxy0CxBLS0mnP3QbeaKaRH +m6+Mluh937qjIAN4QrK2hRO0w37bvV37yT+x4P7ojqsWnLGT7UotC/VTsQWe60dD +aeZ0siXniGoel/LISCdIYTiszEX/NldsA3DqTd2LNXqb9DmcHXE3FtwRfL7pUX21 +KOhxw7/9g4iq0yYc3sKJ4cq65JPOcDpalicGEW2Xmy7z8kT3DMO+cGlqrwbyCzp9 +dzTEBNIHI1gMpQNxvPsSugWuWvnCux1wzo+vjWANLWx2lMkEyPZsQ9InjBtHfzb6 +vo4hBOMof0niGMHMyId/5A57Vgq0K3iKBJitn8kCggEAeNUrVdTsG+R5KkCZp/fQ +mifqCjVx76NqrJXeWm+Pp8WVdlMA/NDp3h2s6UGkPuiQggt3+UJW6fFoviq8nK+V +OXR1C9eBS06rkmdsu5BaBwSLX2TxyJmiVEmnCUNWLSY8P4jqsXNX6tYEE0WxT8UC +74vqFlsFWaEgr/JvX377wCvnQqmK2OuKrfmNGROiy20Y0tAhJU+rmpNMsei7NP+c +XYKPljwxKtIvYeKYdT9r6775H6/Nzqr2bMuYTRTLG6MDiOQ7YU1mhjBhF2RMGB/3 +8D1iTQ3S7f8L2pqUjdbRliddtJWZ/LyDBYfGapAv59ptdWznhMCwXuk+s9JoE0yg +AQKCAQEAwHAeFTRY4rBa0C9joOvAq3h47Q8/c5+kEJHxvGfoFDysU+QN62+XhMvL +PsQAncHjXXdrE4HX/bb0RooKFSssgcf4J6jU4FgjuOFZU8e/xxjkXPygcFeasLQa +qV9exjBROmtl/h25HT3Y1N7SXF+AccpWuRW0v59f9rZCy01KPUQmObK84Dq8LZ0B +EhDp2Gdagi71s6p/Imp7BcyH4mglzwwyQst+sL4T+QOgeyK7A58FdIUcgrwEQCiS +ZdN75Y8E12a8ThdUR982kGIWP+wnXQk6AfyCEYtBqHIIMaDLOx5aWLsinnpRgWGX +d+eAu6tmgS/4M9xB0MobtRTqR4lM0g== +-----END PRIVATE KEY----- diff --git a/files/keycloak/Containerfile b/files/keycloak/Containerfile new file mode 100644 index 0000000..676b3c8 --- /dev/null +++ b/files/keycloak/Containerfile @@ -0,0 +1,26 @@ +FROM quay.io/keycloak/keycloak:latest as builder + +# Enable health and metrics support +ENV KC_HEALTH_ENABLED=true +ENV KC_METRICS_ENABLED=true + +# Configure a database vendor +ENV KC_DB=postgres + +WORKDIR /opt/keycloak +# for demonstration purposes only, please make sure to use proper certificates in production instead +COPY --chmod=444 sso.mforcen.dev.fullchain.pem /opt/keycloak +COPY --chmod=444 sso.mforcen.dev.key /opt/keycloak +COPY --chmod=444 mforcen.crt /opt/keycloak/conf/truststores +RUN /opt/keycloak/bin/kc.sh build + +FROM quay.io/keycloak/keycloak:latest +COPY --from=builder /opt/keycloak/ /opt/keycloak/ + +# change these values to point to a running postgres instance +ENV KC_DB=postgres +ENV KC_DB_URL=jdbc:postgres://infra-db/keycloak +ENV KC_DB_USERNAME=keycloak +ENV KC_DB_PASSWORD=keycloak_pass +ENV KC_HOSTNAME=sso.mforcen.dev +ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized", "--https-certificate-file=/opt/keycloak/sso.mforcen.dev.fullchain.pem", "--https-certificate-key-file=/opt/keycloak/sso.mforcen.dev.key"] diff --git a/files/keycloak/infra-realm.json b/files/keycloak/infra-realm.json new file mode 100644 index 0000000..421e39d --- /dev/null +++ b/files/keycloak/infra-realm.json @@ -0,0 +1,2515 @@ +{ + "id": "bb08e436-fdfb-4ac4-ae0e-6eb57ddaf8df", + "realm": "infra", + "notBefore": 0, + "defaultSignatureAlgorithm": "RS256", + "revokeRefreshToken": false, + "refreshTokenMaxReuse": 0, + "accessTokenLifespan": 300, + "accessTokenLifespanForImplicitFlow": 900, + "ssoSessionIdleTimeout": 1800, + "ssoSessionMaxLifespan": 36000, + "ssoSessionIdleTimeoutRememberMe": 600, + "ssoSessionMaxLifespanRememberMe": 600, + "offlineSessionIdleTimeout": 2592000, + "offlineSessionMaxLifespanEnabled": false, + "offlineSessionMaxLifespan": 5184000, + "clientSessionIdleTimeout": 1800, + "clientSessionMaxLifespan": 3600, + "clientOfflineSessionIdleTimeout": 0, + "clientOfflineSessionMaxLifespan": 0, + "accessCodeLifespan": 60, + "accessCodeLifespanUserAction": 300, + "accessCodeLifespanLogin": 1800, + "actionTokenGeneratedByAdminLifespan": 43200, + "actionTokenGeneratedByUserLifespan": 300, + "oauth2DeviceCodeLifespan": 600, + "oauth2DevicePollingInterval": 5, + "enabled": true, + "sslRequired": "external", + "registrationAllowed": false, + "registrationEmailAsUsername": false, + "rememberMe": false, + "verifyEmail": false, + "loginWithEmailAllowed": true, + "duplicateEmailsAllowed": false, + "resetPasswordAllowed": false, + "editUsernameAllowed": false, + "bruteForceProtected": false, + "permanentLockout": false, + "maxTemporaryLockouts": 0, + "maxFailureWaitSeconds": 900, + "minimumQuickLoginWaitSeconds": 60, + "waitIncrementSeconds": 60, + "quickLoginCheckMilliSeconds": 1000, + "maxDeltaTimeSeconds": 43200, + "failureFactor": 30, + "roles": { + "realm": [ + { + "id": "02fde930-8fa3-4add-8e66-796b761a57c8", + "name": "offline_access", + "description": "${role_offline-access}", + "composite": false, + "clientRole": false, + "containerId": "bb08e436-fdfb-4ac4-ae0e-6eb57ddaf8df", + "attributes": {} + }, + { + "id": "4d7f8cd1-d0a6-466b-8fc5-f81f3d30ca05", + "name": "default-roles-infra", + "description": "${role_default-roles}", + "composite": true, + "composites": { + "realm": [ + "offline_access", + "uma_authorization" + ], + "client": { + "account": [ + "view-profile", + "manage-account" + ] + } + }, + "clientRole": false, + "containerId": "bb08e436-fdfb-4ac4-ae0e-6eb57ddaf8df", + "attributes": {} + }, + { + "id": "6a9938c9-ad17-4651-a335-4be41dd49046", + "name": "uma_authorization", + "description": "${role_uma_authorization}", + "composite": false, + "clientRole": false, + "containerId": "bb08e436-fdfb-4ac4-ae0e-6eb57ddaf8df", + "attributes": {} + } + ], + "client": { + "realm-management": [ + { + "id": "8a1b6297-f568-4195-a760-d953f2cb2487", + "name": "manage-authorization", + "description": "${role_manage-authorization}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "e757b4b3-50f3-4cc9-bccc-67824ae37ddf", + "name": "manage-clients", + "description": "${role_manage-clients}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "ba59c8d1-8538-462b-8d25-72b4ed1c5bfd", + "name": "realm-admin", + "description": "${role_realm-admin}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "manage-clients", + "manage-authorization", + "view-users", + "view-realm", + "view-authorization", + "query-users", + "manage-identity-providers", + "manage-events", + "query-realms", + "impersonation", + "manage-realm", + "query-clients", + "view-events", + "query-groups", + "view-identity-providers", + "manage-users", + "create-client", + "view-clients" + ] + } + }, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "1087b11a-b37c-4e72-984c-d076805f92ce", + "name": "view-users", + "description": "${role_view-users}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "query-users", + "query-groups" + ] + } + }, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "5e907934-0377-48b5-9e1d-003e103ef90f", + "name": "query-users", + "description": "${role_query-users}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "946d76bc-f40c-4260-870b-588969b6bac2", + "name": "view-authorization", + "description": "${role_view-authorization}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "f0b529b5-d3da-4ebd-89f1-e265ac75c6ef", + "name": "view-realm", + "description": "${role_view-realm}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "7f8d6328-23ca-44e8-b3be-89de217e9c6e", + "name": "manage-identity-providers", + "description": "${role_manage-identity-providers}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "d822c66a-9ee7-4398-99c4-16b54af6fa18", + "name": "manage-events", + "description": "${role_manage-events}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "ec904677-98ab-4334-a5e1-e4dee69bd005", + "name": "impersonation", + "description": "${role_impersonation}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "7d40f2e0-d57c-42fa-8ffa-13942eb23221", + "name": "query-realms", + "description": "${role_query-realms}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "979c4daa-0452-4c60-b052-34cfcf37ba46", + "name": "manage-realm", + "description": "${role_manage-realm}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "93db157e-acb0-4d33-94eb-3d522c911478", + "name": "query-clients", + "description": "${role_query-clients}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "28178110-1a7d-45e9-bc6b-5b5e11e96fba", + "name": "view-events", + "description": "${role_view-events}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "680b9f20-4c79-4f7a-8fc5-bad04e4aab9f", + "name": "query-groups", + "description": "${role_query-groups}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "617e7093-0fe5-4100-b16f-f5b2f1f3e0c9", + "name": "view-identity-providers", + "description": "${role_view-identity-providers}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "44a2fdaa-bed9-4d33-9915-239a855a0a9d", + "name": "manage-users", + "description": "${role_manage-users}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "fba3917d-56cc-47f9-9c83-092d85b28bc0", + "name": "create-client", + "description": "${role_create-client}", + "composite": false, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + }, + { + "id": "a604a0a2-f51f-40b5-ba18-17baae2d121b", + "name": "view-clients", + "description": "${role_view-clients}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "query-clients" + ] + } + }, + "clientRole": true, + "containerId": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "attributes": {} + } + ], + "grafana": [ + { + "id": "163b06bf-0f64-4bae-9901-86c718c5060b", + "name": "uma_protection", + "composite": false, + "clientRole": true, + "containerId": "a6960246-4aa9-495f-8843-69d664dba0ea", + "attributes": {} + } + ], + "security-admin-console": [], + "admin-cli": [], + "account-console": [], + "broker": [ + { + "id": "d3dc8755-93a4-45db-9d2d-566d335655cb", + "name": "read-token", + "description": "${role_read-token}", + "composite": false, + "clientRole": true, + "containerId": "f9bf83e0-d7a0-4703-a1c3-0b6f5d496a0d", + "attributes": {} + } + ], + "account": [ + { + "id": "c237315f-eb08-4be9-bec4-4d417cd25a3b", + "name": "view-applications", + "description": "${role_view-applications}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "f9d6c59d-3673-4ddd-8ce8-e7a8ba7ab788", + "name": "manage-account-links", + "description": "${role_manage-account-links}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "f3c642b9-902e-4d42-8a86-66d6c672571f", + "name": "manage-account", + "description": "${role_manage-account}", + "composite": true, + "composites": { + "client": { + "account": [ + "manage-account-links" + ] + } + }, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "66d4f646-3311-4b31-9dab-407d47a98bda", + "name": "manage-consent", + "description": "${role_manage-consent}", + "composite": true, + "composites": { + "client": { + "account": [ + "view-consent" + ] + } + }, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "9494254d-e46d-490e-ae01-6c658f006328", + "name": "view-groups", + "description": "${role_view-groups}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "8e3cc83c-fd19-4fdc-b998-c5796dc84b27", + "name": "view-profile", + "description": "${role_view-profile}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "177a4a43-c49e-4c05-9ee8-52bac7ab8663", + "name": "view-consent", + "description": "${role_view-consent}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + }, + { + "id": "f669212f-d88e-4868-b12e-1f86b70ce078", + "name": "delete-account", + "description": "${role_delete-account}", + "composite": false, + "clientRole": true, + "containerId": "af35d5a0-98eb-4636-9520-d00a632c037a", + "attributes": {} + } + ] + } + }, + "groups": [], + "defaultRole": { + "id": "4d7f8cd1-d0a6-466b-8fc5-f81f3d30ca05", + "name": "default-roles-infra", + "description": "${role_default-roles}", + "composite": true, + "clientRole": false, + "containerId": "bb08e436-fdfb-4ac4-ae0e-6eb57ddaf8df" + }, + "requiredCredentials": [ + "password" + ], + "otpPolicyType": "totp", + "otpPolicyAlgorithm": "HmacSHA1", + "otpPolicyInitialCounter": 0, + "otpPolicyDigits": 6, + "otpPolicyLookAheadWindow": 1, + "otpPolicyPeriod": 30, + "otpPolicyCodeReusable": false, + "otpSupportedApplications": [ + "totpAppFreeOTPName", + "totpAppGoogleName", + "totpAppMicrosoftAuthenticatorName" + ], + "localizationTexts": {}, + "webAuthnPolicyRpEntityName": "keycloak", + "webAuthnPolicySignatureAlgorithms": [ + "ES256", + "RS256" + ], + "webAuthnPolicyRpId": "", + "webAuthnPolicyAttestationConveyancePreference": "not specified", + "webAuthnPolicyAuthenticatorAttachment": "not specified", + "webAuthnPolicyRequireResidentKey": "not specified", + "webAuthnPolicyUserVerificationRequirement": "not specified", + "webAuthnPolicyCreateTimeout": 0, + "webAuthnPolicyAvoidSameAuthenticatorRegister": false, + "webAuthnPolicyAcceptableAaguids": [], + "webAuthnPolicyExtraOrigins": [], + "webAuthnPolicyPasswordlessRpEntityName": "keycloak", + "webAuthnPolicyPasswordlessSignatureAlgorithms": [ + "ES256", + "RS256" + ], + "webAuthnPolicyPasswordlessRpId": "", + "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified", + "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified", + "webAuthnPolicyPasswordlessRequireResidentKey": "not specified", + "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified", + "webAuthnPolicyPasswordlessCreateTimeout": 0, + "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false, + "webAuthnPolicyPasswordlessAcceptableAaguids": [], + "webAuthnPolicyPasswordlessExtraOrigins": [], + "users": [ + { + "id": "a075e513-4375-4b37-965d-3f75d7aa1d14", + "username": "service-account-grafana", + "emailVerified": false, + "createdTimestamp": 1728574833899, + "enabled": true, + "totp": false, + "serviceAccountClientId": "grafana", + "disableableCredentialTypes": [], + "requiredActions": [], + "realmRoles": [ + "default-roles-infra" + ], + "clientRoles": { + "grafana": [ + "uma_protection" + ] + }, + "notBefore": 0, + "groups": [] + } + ], + "scopeMappings": [ + { + "clientScope": "offline_access", + "roles": [ + "offline_access" + ] + } + ], + "clientScopeMappings": { + "account": [ + { + "client": "account-console", + "roles": [ + "manage-account", + "view-groups" + ] + } + ] + }, + "clients": [ + { + "id": "af35d5a0-98eb-4636-9520-d00a632c037a", + "clientId": "account", + "name": "${client_account}", + "rootUrl": "${authBaseUrl}", + "baseUrl": "/realms/infra/account/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/realms/infra/account/*" + ], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "false", + "post.logout.redirect.uris": "+" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + }, + { + "id": "9d651e07-7674-4e6e-8081-ccf0f44d6907", + "clientId": "account-console", + "name": "${client_account-console}", + "rootUrl": "${authBaseUrl}", + "baseUrl": "/realms/infra/account/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/realms/infra/account/*" + ], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "false", + "post.logout.redirect.uris": "+", + "pkce.code.challenge.method": "S256" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "protocolMappers": [ + { + "id": "05118860-74c5-4936-91e4-3dda2ef6bc57", + "name": "audience resolve", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-resolve-mapper", + "consentRequired": false, + "config": {} + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + }, + { + "id": "fa25ff58-d945-440d-abb7-2b6e1e53296f", + "clientId": "admin-cli", + "name": "${client_admin-cli}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "false", + "client.use.lightweight.access.token.enabled": "true" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + }, + { + "id": "f9bf83e0-d7a0-4703-a1c3-0b6f5d496a0d", + "clientId": "broker", + "name": "${client_broker}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": true, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "true" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + }, + { + "id": "a6960246-4aa9-495f-8843-69d664dba0ea", + "clientId": "grafana", + "name": "Grafana client", + "description": "", + "rootUrl": "http://grafana.mforcen.dev:3000/", + "adminUrl": "http://grafana.mforcen.dev:3000/", + "baseUrl": "http://grafana.mforcen.dev:3000/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "secret": "**********", + "redirectUris": [ + "http://grafana.mforcen.dev:3000/login/generic_oauth" + ], + "webOrigins": [ + "http://grafana.mforcen.dev:3000" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": true, + "authorizationServicesEnabled": true, + "publicClient": false, + "frontchannelLogout": true, + "protocol": "openid-connect", + "attributes": { + "realm_client": "false", + "oidc.ciba.grant.enabled": "false", + "client.secret.creation.time": "1728574833", + "backchannel.logout.session.required": "true", + "post.logout.redirect.uris": "http://grafana.mforcen.dev:3000", + "display.on.consent.screen": "false", + "oauth2.device.authorization.grant.enabled": "false", + "backchannel.logout.revoke.offline.tokens": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "protocolMappers": [ + { + "id": "ed94b7aa-aef0-475f-93eb-1e796d3f0526", + "name": "Client ID", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "client_id", + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "client_id", + "jsonType.label": "String" + } + }, + { + "id": "fc4a9afe-349e-4047-9b20-e4b3752b9924", + "name": "Client IP Address", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientAddress", + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientAddress", + "jsonType.label": "String" + } + }, + { + "id": "517cdb41-1479-4ba6-9625-d00fd9764ffc", + "name": "Client Host", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientHost", + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientHost", + "jsonType.label": "String" + } + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ], + "authorizationSettings": { + "allowRemoteResourceManagement": true, + "policyEnforcementMode": "ENFORCING", + "resources": [ + { + "name": "Default Resource", + "type": "urn:grafana:resources:default", + "ownerManagedAccess": false, + "attributes": {}, + "uris": [ + "/*" + ] + } + ], + "policies": [], + "scopes": [], + "decisionStrategy": "UNANIMOUS" + } + }, + { + "id": "fd71dbc8-b60a-4302-bd6a-34095a0a8c24", + "clientId": "realm-management", + "name": "${client_realm-management}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": true, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "true" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + }, + { + "id": "13bd2f65-9e7d-4b9c-9ae8-089ce0e0a5b7", + "clientId": "security-admin-console", + "name": "${client_security-admin-console}", + "rootUrl": "${authAdminUrl}", + "baseUrl": "/admin/infra/console/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/admin/infra/console/*" + ], + "webOrigins": [ + "+" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "realm_client": "false", + "client.use.lightweight.access.token.enabled": "true", + "post.logout.redirect.uris": "+", + "pkce.code.challenge.method": "S256" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": 0, + "protocolMappers": [ + { + "id": "86084004-321c-42dc-991d-c6ad2f8ea740", + "name": "locale", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "locale", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "locale", + "jsonType.label": "String" + } + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "basic", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "organization", + "microprofile-jwt" + ] + } + ], + "clientScopes": [ + { + "id": "57d831bb-d04d-4492-86be-74cb07ea5a12", + "name": "acr", + "description": "OpenID Connect scope for add acr (authentication context class reference) to the token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "d3e2fb80-b3ff-4669-99b9-48b0c18ed7ee", + "name": "acr loa level", + "protocol": "openid-connect", + "protocolMapper": "oidc-acr-mapper", + "consentRequired": false, + "config": { + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true" + } + } + ] + }, + { + "id": "5b9a9fc5-b9f5-4721-a13f-09a041af7791", + "name": "address", + "description": "OpenID Connect built-in scope: address", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "consent.screen.text": "${addressScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "1313e452-e551-4d1b-996b-1d9a9148b21c", + "name": "address", + "protocol": "openid-connect", + "protocolMapper": "oidc-address-mapper", + "consentRequired": false, + "config": { + "user.attribute.formatted": "formatted", + "user.attribute.country": "country", + "introspection.token.claim": "true", + "user.attribute.postal_code": "postal_code", + "userinfo.token.claim": "true", + "user.attribute.street": "street", + "id.token.claim": "true", + "user.attribute.region": "region", + "access.token.claim": "true", + "user.attribute.locality": "locality" + } + } + ] + }, + { + "id": "cc40fb89-08da-4940-8182-cf2192d3027d", + "name": "offline_access", + "description": "OpenID Connect built-in scope: offline_access", + "protocol": "openid-connect", + "attributes": { + "consent.screen.text": "${offlineAccessScopeConsentText}", + "display.on.consent.screen": "true" + } + }, + { + "id": "d04faaf3-f2c3-41f1-9668-d3570595b579", + "name": "web-origins", + "description": "OpenID Connect scope for add allowed web origins to the access token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "consent.screen.text": "", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "977c4df2-71e1-48b4-ad9c-e5e496c67ef4", + "name": "allowed web origins", + "protocol": "openid-connect", + "protocolMapper": "oidc-allowed-origins-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "access.token.claim": "true" + } + } + ] + }, + { + "id": "d149f69f-318b-4226-918d-0b57f3b5911d", + "name": "organization", + "description": "Additional claims about the organization a subject belongs to", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "consent.screen.text": "${organizationScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "7b0ec40d-b483-4a0f-8523-0ff9d758e745", + "name": "organization", + "protocol": "openid-connect", + "protocolMapper": "oidc-organization-membership-mapper", + "consentRequired": false, + "config": { + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "organization", + "jsonType.label": "String", + "multivalued": "true" + } + } + ] + }, + { + "id": "b10a024d-b2ff-4956-b459-f81a61b8680b", + "name": "profile", + "description": "OpenID Connect built-in scope: profile", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "consent.screen.text": "${profileScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "7eb22047-72f1-4849-a78b-1b22fe812dd7", + "name": "family name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "lastName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "family_name", + "jsonType.label": "String" + } + }, + { + "id": "d6a0e95e-d4cf-4bd7-bdbf-4436a145b59e", + "name": "locale", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "locale", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "locale", + "jsonType.label": "String" + } + }, + { + "id": "ee9c9d42-62e7-4266-ba70-235033bea727", + "name": "updated at", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "updatedAt", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "updated_at", + "jsonType.label": "long" + } + }, + { + "id": "c912be3f-826a-477a-be1f-37a816ec4a4e", + "name": "zoneinfo", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "zoneinfo", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "zoneinfo", + "jsonType.label": "String" + } + }, + { + "id": "3e001177-325e-4ec6-bf23-ca1dd95a8f18", + "name": "birthdate", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "birthdate", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "birthdate", + "jsonType.label": "String" + } + }, + { + "id": "4c1227d7-bc98-4a16-aba9-286302db6922", + "name": "profile", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "profile", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "profile", + "jsonType.label": "String" + } + }, + { + "id": "c47066b3-41c6-4a67-8283-841561633c7b", + "name": "full name", + "protocol": "openid-connect", + "protocolMapper": "oidc-full-name-mapper", + "consentRequired": false, + "config": { + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true" + } + }, + { + "id": "24b74203-fc85-49b6-ba4f-f6aed8d706e6", + "name": "gender", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "gender", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "gender", + "jsonType.label": "String" + } + }, + { + "id": "f1ae70b9-3b1c-4368-844c-6933061f8126", + "name": "middle name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "middleName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "middle_name", + "jsonType.label": "String" + } + }, + { + "id": "c0545ed9-8525-49ab-ab84-cf4a858a4503", + "name": "nickname", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "nickname", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "nickname", + "jsonType.label": "String" + } + }, + { + "id": "3caa4eea-eac9-4f9c-9d04-47bfe1baf1ca", + "name": "website", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "website", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "website", + "jsonType.label": "String" + } + }, + { + "id": "7ba328e8-c86f-4a4a-a4c1-4a5db5599c5d", + "name": "picture", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "picture", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "picture", + "jsonType.label": "String" + } + }, + { + "id": "6621cf6e-4c43-4a0c-a7d4-c366653041aa", + "name": "username", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "username", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "preferred_username", + "jsonType.label": "String" + } + }, + { + "id": "d227ccda-774f-4c3d-8644-c937469da0af", + "name": "given name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "firstName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "given_name", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "9188645c-00fd-4395-84f4-d987ce4708b0", + "name": "roles", + "description": "OpenID Connect scope for add user roles to the access token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "consent.screen.text": "${rolesScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "65afc880-9e17-42d2-aec5-ca4a31c175af", + "name": "realm roles", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-realm-role-mapper", + "consentRequired": false, + "config": { + "user.attribute": "foo", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "realm_access.roles", + "jsonType.label": "String", + "multivalued": "true" + } + }, + { + "id": "cef3e663-3c5a-4f81-88b5-ffdd12417766", + "name": "audience resolve", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-resolve-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "access.token.claim": "true" + } + }, + { + "id": "7701b716-c921-46ae-8626-4fb5cbc22cd8", + "name": "client roles", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-client-role-mapper", + "consentRequired": false, + "config": { + "user.attribute": "foo", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "resource_access.${client_id}.roles", + "jsonType.label": "String", + "multivalued": "true" + } + } + ] + }, + { + "id": "9c61a7d8-30d1-4e07-abbd-0bfc354e87d7", + "name": "role_list", + "description": "SAML role list", + "protocol": "saml", + "attributes": { + "consent.screen.text": "${samlRoleListScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "e70c61e8-b798-4152-99ce-2bdc52b785fd", + "name": "role list", + "protocol": "saml", + "protocolMapper": "saml-role-list-mapper", + "consentRequired": false, + "config": { + "single": "false", + "attribute.nameformat": "Basic", + "attribute.name": "Role" + } + } + ] + }, + { + "id": "0c4a0040-3dd8-4265-9f45-cb130d0339a8", + "name": "microprofile-jwt", + "description": "Microprofile - JWT built-in scope", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "9c722c54-0085-4e75-b571-f842fa38492d", + "name": "groups", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-realm-role-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "multivalued": "true", + "user.attribute": "foo", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "groups", + "jsonType.label": "String" + } + }, + { + "id": "573e9165-803f-4af0-93c9-044a18fe938e", + "name": "upn", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "username", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "upn", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "b092b2fd-34e9-4f2c-8c5e-d06c51e4c719", + "name": "basic", + "description": "OpenID Connect scope for add all basic claims to the token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "61520e95-aa8f-4627-a4fb-084e68545503", + "name": "sub", + "protocol": "openid-connect", + "protocolMapper": "oidc-sub-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "access.token.claim": "true" + } + }, + { + "id": "ca928866-5c89-4bb9-a054-eca11c883c98", + "name": "auth_time", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "AUTH_TIME", + "id.token.claim": "true", + "introspection.token.claim": "true", + "access.token.claim": "true", + "claim.name": "auth_time", + "jsonType.label": "long" + } + } + ] + }, + { + "id": "6459de71-e987-4fa4-a3dd-d87e275f5610", + "name": "saml_organization", + "description": "Organization Membership", + "protocol": "saml", + "attributes": { + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "800a715f-d156-4ea4-8c5a-b1ad22ed10ad", + "name": "organization", + "protocol": "saml", + "protocolMapper": "saml-organization-membership-mapper", + "consentRequired": false, + "config": {} + } + ] + }, + { + "id": "661fd911-982f-4208-a45c-72ae768d1011", + "name": "phone", + "description": "OpenID Connect built-in scope: phone", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "consent.screen.text": "${phoneScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "298f9f71-5366-46f0-b150-40ee5c3ec2e4", + "name": "phone number verified", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "phoneNumberVerified", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "phone_number_verified", + "jsonType.label": "boolean" + } + }, + { + "id": "04adfaeb-f3f7-4114-ad4d-ccce75bbaaa5", + "name": "phone number", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "phoneNumber", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "phone_number", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "6a62082d-0a9e-4ba5-b0dd-5fcd9f172d89", + "name": "email", + "description": "OpenID Connect built-in scope: email", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "consent.screen.text": "${emailScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "817e2e59-1630-4288-b4f1-ee0736791879", + "name": "email", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "email", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "email", + "jsonType.label": "String" + } + }, + { + "id": "f44b30b3-0ca0-47b5-b178-48e32e256c99", + "name": "email verified", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-property-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "userinfo.token.claim": "true", + "user.attribute": "emailVerified", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "email_verified", + "jsonType.label": "boolean" + } + } + ] + } + ], + "defaultDefaultClientScopes": [ + "role_list", + "saml_organization", + "profile", + "email", + "roles", + "web-origins", + "acr", + "basic" + ], + "defaultOptionalClientScopes": [ + "offline_access", + "address", + "phone", + "microprofile-jwt", + "organization" + ], + "browserSecurityHeaders": { + "contentSecurityPolicyReportOnly": "", + "xContentTypeOptions": "nosniff", + "referrerPolicy": "no-referrer", + "xRobotsTag": "none", + "xFrameOptions": "SAMEORIGIN", + "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';", + "xXSSProtection": "1; mode=block", + "strictTransportSecurity": "max-age=31536000; includeSubDomains" + }, + "smtpServer": {}, + "eventsEnabled": false, + "eventsListeners": [ + "jboss-logging" + ], + "enabledEventTypes": [], + "adminEventsEnabled": false, + "adminEventsDetailsEnabled": false, + "identityProviders": [], + "identityProviderMappers": [], + "components": { + "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [ + { + "id": "40bbef61-72f5-4aea-bcfe-1f4fe4cb9ef8", + "name": "Full Scope Disabled", + "providerId": "scope", + "subType": "anonymous", + "subComponents": {}, + "config": {} + }, + { + "id": "0fe68a5d-06af-4f54-b62e-5796598ae757", + "name": "Max Clients Limit", + "providerId": "max-clients", + "subType": "anonymous", + "subComponents": {}, + "config": { + "max-clients": [ + "200" + ] + } + }, + { + "id": "b28a02ee-d7b4-449c-963b-271b68534472", + "name": "Allowed Client Scopes", + "providerId": "allowed-client-templates", + "subType": "anonymous", + "subComponents": {}, + "config": { + "allow-default-scopes": [ + "true" + ] + } + }, + { + "id": "d5dd62c7-05a3-4fb9-ad40-0843b53902ea", + "name": "Allowed Client Scopes", + "providerId": "allowed-client-templates", + "subType": "authenticated", + "subComponents": {}, + "config": { + "allow-default-scopes": [ + "true" + ] + } + }, + { + "id": "c34e5435-fea8-4dd4-bc0f-b4ae97215e61", + "name": "Trusted Hosts", + "providerId": "trusted-hosts", + "subType": "anonymous", + "subComponents": {}, + "config": { + "host-sending-registration-request-must-match": [ + "true" + ], + "client-uris-must-match": [ + "true" + ] + } + }, + { + "id": "7c049f09-0a62-4095-897f-6239b65bc04e", + "name": "Allowed Protocol Mapper Types", + "providerId": "allowed-protocol-mappers", + "subType": "anonymous", + "subComponents": {}, + "config": { + "allowed-protocol-mapper-types": [ + "saml-user-attribute-mapper", + "oidc-full-name-mapper", + "oidc-usermodel-attribute-mapper", + "oidc-usermodel-property-mapper", + "oidc-address-mapper", + "saml-role-list-mapper", + "oidc-sha256-pairwise-sub-mapper", + "saml-user-property-mapper" + ] + } + }, + { + "id": "2e50ab32-eef0-41ad-b051-babe4db0aefb", + "name": "Consent Required", + "providerId": "consent-required", + "subType": "anonymous", + "subComponents": {}, + "config": {} + }, + { + "id": "96efa174-388e-4a61-b96e-0a53d9769daf", + "name": "Allowed Protocol Mapper Types", + "providerId": "allowed-protocol-mappers", + "subType": "authenticated", + "subComponents": {}, + "config": { + "allowed-protocol-mapper-types": [ + "saml-user-attribute-mapper", + "saml-role-list-mapper", + "oidc-address-mapper", + "oidc-sha256-pairwise-sub-mapper", + "oidc-usermodel-attribute-mapper", + "oidc-usermodel-property-mapper", + "saml-user-property-mapper", + "oidc-full-name-mapper" + ] + } + } + ], + "org.keycloak.keys.KeyProvider": [ + { + "id": "ecbd235d-4d7d-49d1-b2a8-8c075d12f520", + "name": "rsa-generated", + "providerId": "rsa-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ] + } + }, + { + "id": "96e7fbab-ae82-4490-8e3a-3d2cee51959c", + "name": "rsa-enc-generated", + "providerId": "rsa-enc-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ], + "algorithm": [ + "RSA-OAEP" + ] + } + }, + { + "id": "17f71d73-102f-499b-bde5-2d3ff60ad9b4", + "name": "aes-generated", + "providerId": "aes-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ] + } + }, + { + "id": "56c71a25-d9bb-4411-ba64-89d2bbda02ed", + "name": "hmac-generated-hs512", + "providerId": "hmac-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ], + "algorithm": [ + "HS512" + ] + } + } + ] + }, + "internationalizationEnabled": false, + "supportedLocales": [], + "authenticationFlows": [ + { + "id": "2e6a2f20-729f-4fef-8f71-ce63d5b6e3f1", + "alias": "Account verification options", + "description": "Method with which to verity the existing account", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-email-verification", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Verify Existing Account by Re-authentication", + "userSetupAllowed": false + } + ] + }, + { + "id": "4acb8868-8158-4516-bfd5-a7401bce7ed3", + "alias": "Browser - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-otp-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "23308316-b8b7-4b87-82c1-d0368acc58b7", + "alias": "Browser - Conditional Organization", + "description": "Flow to determine if the organization identity-first login is to be used", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "organization", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "1dc08e66-695e-43d2-a875-bafa21b4b90a", + "alias": "Direct Grant - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "direct-grant-validate-otp", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "32ca21ba-a716-494c-84dd-0f1e2c1aeb09", + "alias": "First Broker Login - Conditional Organization", + "description": "Flow to determine if the authenticator that adds organization members is to be used", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "idp-add-organization-member", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "eaf86da5-e729-4cf2-bc7f-6461befe087f", + "alias": "First broker login - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-otp-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "341fe4c1-5c28-482e-b666-3f403c760cc6", + "alias": "Handle Existing Account", + "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-confirm-link", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Account verification options", + "userSetupAllowed": false + } + ] + }, + { + "id": "41d0053f-8115-42cd-b0c2-7f8f86c3116d", + "alias": "Organization", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 10, + "autheticatorFlow": true, + "flowAlias": "Browser - Conditional Organization", + "userSetupAllowed": false + } + ] + }, + { + "id": "eb64172e-406d-4562-9e76-0a210793725a", + "alias": "Reset - Conditional OTP", + "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-otp", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "a1413524-9910-4404-8284-799edd30d4d4", + "alias": "User creation or linking", + "description": "Flow for the existing/non-existing user alternatives", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticatorConfig": "create unique user config", + "authenticator": "idp-create-user-if-unique", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Handle Existing Account", + "userSetupAllowed": false + } + ] + }, + { + "id": "28beed1b-d27c-41d8-8680-21bb933f50af", + "alias": "Verify Existing Account by Re-authentication", + "description": "Reauthentication of existing account", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-username-password-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "First broker login - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "c1390092-e00c-47a4-95c0-42f675a75065", + "alias": "browser", + "description": "Browser based authentication", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "auth-cookie", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-spnego", + "authenticatorFlow": false, + "requirement": "DISABLED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "identity-provider-redirector", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 25, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 26, + "autheticatorFlow": true, + "flowAlias": "Organization", + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 30, + "autheticatorFlow": true, + "flowAlias": "forms", + "userSetupAllowed": false + } + ] + }, + { + "id": "4e2f8e9b-0c8d-4e42-bb1f-5da000566354", + "alias": "clients", + "description": "Base authentication for clients", + "providerId": "client-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "client-secret", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-jwt", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-secret-jwt", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 30, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-x509", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 40, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "dff3bdca-1531-42f0-997a-45efa981affd", + "alias": "direct grant", + "description": "OpenID Connect Resource Owner Grant", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "direct-grant-validate-username", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "direct-grant-validate-password", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 30, + "autheticatorFlow": true, + "flowAlias": "Direct Grant - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "c9871a40-ff0b-48cc-aa71-f7f415271520", + "alias": "docker auth", + "description": "Used by Docker clients to authenticate against the IDP", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "docker-http-basic-authenticator", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "7ea162b2-78c6-4cdd-bea9-021e98503a7f", + "alias": "first broker login", + "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticatorConfig": "review profile config", + "authenticator": "idp-review-profile", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "User creation or linking", + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 50, + "autheticatorFlow": true, + "flowAlias": "First Broker Login - Conditional Organization", + "userSetupAllowed": false + } + ] + }, + { + "id": "c6931ebb-6249-42ad-8553-6fa910ab0b75", + "alias": "forms", + "description": "Username, password, otp and other auth forms.", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "auth-username-password-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Browser - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "c6c1a0b7-f2bf-4d8d-9477-f53e1e6e6fa1", + "alias": "registration", + "description": "Registration flow", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "registration-page-form", + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": true, + "flowAlias": "registration form", + "userSetupAllowed": false + } + ] + }, + { + "id": "1cc100b4-a49a-4e78-a145-e86419f45880", + "alias": "registration form", + "description": "Registration form", + "providerId": "form-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "registration-user-creation", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "registration-password-action", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 50, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "registration-recaptcha-action", + "authenticatorFlow": false, + "requirement": "DISABLED", + "priority": 60, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "registration-terms-and-conditions", + "authenticatorFlow": false, + "requirement": "DISABLED", + "priority": 70, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "d81aaaae-b675-4804-8407-67e93f34955c", + "alias": "reset credentials", + "description": "Reset credentials for a user if they forgot their password or something", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "reset-credentials-choose-user", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-credential-email", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-password", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 30, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 40, + "autheticatorFlow": true, + "flowAlias": "Reset - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "79e40125-2434-4e31-9739-dcf7242770d2", + "alias": "saml ecp", + "description": "SAML ECP Profile Authentication Flow", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "http-basic-authenticator", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + } + ], + "authenticatorConfig": [ + { + "id": "cfae4120-319f-4d65-b1a7-98c546b19ec9", + "alias": "create unique user config", + "config": { + "require.password.update.after.registration": "false" + } + }, + { + "id": "394ebd86-3d13-4808-bb20-600e19cb6138", + "alias": "review profile config", + "config": { + "update.profile.on.first.login": "missing" + } + } + ], + "requiredActions": [ + { + "alias": "CONFIGURE_TOTP", + "name": "Configure OTP", + "providerId": "CONFIGURE_TOTP", + "enabled": true, + "defaultAction": false, + "priority": 10, + "config": {} + }, + { + "alias": "TERMS_AND_CONDITIONS", + "name": "Terms and Conditions", + "providerId": "TERMS_AND_CONDITIONS", + "enabled": false, + "defaultAction": false, + "priority": 20, + "config": {} + }, + { + "alias": "UPDATE_PASSWORD", + "name": "Update Password", + "providerId": "UPDATE_PASSWORD", + "enabled": true, + "defaultAction": false, + "priority": 30, + "config": {} + }, + { + "alias": "UPDATE_PROFILE", + "name": "Update Profile", + "providerId": "UPDATE_PROFILE", + "enabled": true, + "defaultAction": false, + "priority": 40, + "config": {} + }, + { + "alias": "VERIFY_EMAIL", + "name": "Verify Email", + "providerId": "VERIFY_EMAIL", + "enabled": true, + "defaultAction": false, + "priority": 50, + "config": {} + }, + { + "alias": "delete_account", + "name": "Delete Account", + "providerId": "delete_account", + "enabled": false, + "defaultAction": false, + "priority": 60, + "config": {} + }, + { + "alias": "webauthn-register", + "name": "Webauthn Register", + "providerId": "webauthn-register", + "enabled": true, + "defaultAction": false, + "priority": 70, + "config": {} + }, + { + "alias": "webauthn-register-passwordless", + "name": "Webauthn Register Passwordless", + "providerId": "webauthn-register-passwordless", + "enabled": true, + "defaultAction": false, + "priority": 80, + "config": {} + }, + { + "alias": "VERIFY_PROFILE", + "name": "Verify Profile", + "providerId": "VERIFY_PROFILE", + "enabled": true, + "defaultAction": false, + "priority": 90, + "config": {} + }, + { + "alias": "delete_credential", + "name": "Delete Credential", + "providerId": "delete_credential", + "enabled": true, + "defaultAction": false, + "priority": 100, + "config": {} + }, + { + "alias": "update_user_locale", + "name": "Update User Locale", + "providerId": "update_user_locale", + "enabled": true, + "defaultAction": false, + "priority": 1000, + "config": {} + } + ], + "browserFlow": "browser", + "registrationFlow": "registration", + "directGrantFlow": "direct grant", + "resetCredentialsFlow": "reset credentials", + "clientAuthenticationFlow": "clients", + "dockerAuthenticationFlow": "docker auth", + "firstBrokerLoginFlow": "first broker login", + "attributes": { + "cibaBackchannelTokenDeliveryMode": "poll", + "cibaAuthRequestedUserHint": "login_hint", + "oauth2DevicePollingInterval": "5", + "clientOfflineSessionMaxLifespan": "0", + "clientSessionIdleTimeout": "1800", + "clientOfflineSessionIdleTimeout": "0", + "cibaInterval": "5", + "realmReusableOtpCode": "false", + "cibaExpiresIn": "120", + "oauth2DeviceCodeLifespan": "600", + "parRequestUriLifespan": "60", + "clientSessionMaxLifespan": "3600", + "organizationsEnabled": "false" + }, + "keycloakVersion": "26.0.0", + "userManagedAccessAllowed": false, + "organizationsEnabled": false, + "clientProfiles": { + "profiles": [] + }, + "clientPolicies": { + "policies": [] + } +} diff --git a/files/keycloak/mforcen.crt b/files/keycloak/mforcen.crt new file mode 100644 index 0000000..7abe998 --- /dev/null +++ b/files/keycloak/mforcen.crt @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFtzCCA5+gAwIBAgIUbvxoDsh6uZTB1wpb0mvR3MpLYygwDQYJKoZIhvcNAQEL +BQAwazELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFu +dWVsIEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAwOTE2MjAzMVoXDTM0MTAwNzE2MjAzMVow +azELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFudWVs +IEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEWDm1l +QG1mb3JjZW4uZGV2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5TlR +C8V5denK+snVj/N6mAcZaPE9YVyD1IYTA5tvmLZkBFOfCo1Ak5QSv5z1lMKjc6qE +32RLBsCZM0U+KFL9CerMdNtYPrWqlG4FffvKbaan0HHMFxdfDWkVFhPRtHU7LPcT +m5cSmQdsecst1CrLLA6bzhbdcw9GcRA1s+TrlNwNHiXGEQvg9JZbm+vpksR1xVbz +OAx5aHZx3XS6JokMovjc7pYdsi3bLIzvc1eBRsu+KMPOJ+mgolGnWPYKABpn8A9a +pV1t39mGLEPmw3l/83iH2mCTjAzDQHOE6KNd0mtF5+pEKwBzTVbQZBfRBLAvUrjP +PYeOPckImMR+k7l2rqyCBGdRod2DDDGN9f55uJ5+OAuxJ6v7Gg7rhlBVR5AJSIb8 +2FyZ7UfD2r1Vy/eHDo2bFkr1RQfvHCucxjlAkUcK1pyleboz3TbJ+z6Z2bZCkjOK +vbCxrxJjafGueqTmzxP/o/V6A9L3coSrWpILyxUYfs31K81XpYYyXN0m8ZZBmKTk +8LhMAkAPg+5KVcK9PS4VLWXkscZ5eR5eHbvTkphrLZ5KTR5uoTVVGDXGzRCB+Wl6 +mLPAIXrWuTS8F6wR/5Sk5D7mfiPfpZWVPRv3REcKpKl7Kqg1Ko8ob15xi7PHCYIi +nA7eJVinDvA0DcwN12LEiJcAV9vUKx92QxP0k6UCAwEAAaNTMFEwHQYDVR0OBBYE +FPkYkgkulvi/r0kWA2M825ni4zI8MB8GA1UdIwQYMBaAFPkYkgkulvi/r0kWA2M8 +25ni4zI8MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBALzjLPJs +/Qf+Ttw+Ke5dXC5CWT2C/4c8x1paLfiJRjdj+gvmzMRCEwyjuUY0+sxOJee4lPxM +We/S3km/DE3yRC9lSbYWxPYY8MMKiLB4k5Eo3FUw1zz/tgwP2nRoUzJ0KPbMbOTK +c+HUHfLmH5kRx2cBTz3mCMhpGSK7fPhZpWkxgKn3/xRbLGKDQ3ZG6l4fjZM4Dpkr +tTbfcf1OnwkzHqQ1jeXkqwfVTrxbjwNcdhfSU8XLgYJiULLRvNF2CmOqXMXXlhVg +zhTBipQt1ej18vVx0M2Ric4/4XpgBWkSRod6JCxphr9Cy0fm2BuilaJURt2eqfV2 +t+9HC54TcubcLZGXj6TL+PqmIhwTfst4ALmmyKB+fbdlPEPEZMIlskXQoFjvGI21 +A7j6yUL2vvpn0+ouifk4HmUJX+vY/u5TXSy+MDVwmMdRFPUt8lUzEbXB+ijEdm/T +yz8LrlcXIyoScsK7wE5IAw18CQleAVkRTWE+b6qInWoBzZbhTRzfCutIVn0ocKqu +s2n020nZpDBo87/SiHzIlzXh+mxTM9g39cuLpFFEnye0ZnyO4nSwQeybZlQXe0ND +EvweNEy4OR+SUiT4witD53REEn1eyr2IYJEgK/7L+1vSFbqrkIwkPf5dY6/EhkvP +Wf8dJV5WswtZStdYGRyq4jbLucNKtEMNLJhY +-----END CERTIFICATE----- diff --git a/files/keycloak/sso.mforcen.dev.fullchain.pem b/files/keycloak/sso.mforcen.dev.fullchain.pem new file mode 100644 index 0000000..34f3fd2 --- /dev/null +++ b/files/keycloak/sso.mforcen.dev.fullchain.pem @@ -0,0 +1,67 @@ +-----BEGIN CERTIFICATE----- +MIIF1zCCA7+gAwIBAgIUN+yqZtTpNBzmMppjPszb3oeZhSUwDQYJKoZIhvcNAQEL +BQAwazEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxCzAJBgNVBAYTAkVTMQ8wDQYDVQQI +DAZNdXJjaWExFjAUBgNVBAoMDU1hbnVlbCBGb3JjZW4xHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAxMzE3MTAxMFoXDTI2MTAxMzE3MTAxMFow +UDEYMBYGA1UEAwwPc3NvLm1mb3JjZW4uZGV2MQswCQYDVQQGEwJFUzEPMA0GA1UE +CAwGTXVyY2lhMRYwFAYDVQQKDA1NYW51ZWwgRm9yY2VuMIICIjANBgkqhkiG9w0B +AQEFAAOCAg8AMIICCgKCAgEA5mbumObZY9DKdCSclItvrHzFiYwcn2YHZQWEQudY +5rDM8JKdKUGD3B4zGRbZf/kNrLN8tYaH9Mn1SfHdCN6qYVoaxe9T6VRqgn0dTbim +2FWkH/Q4BMKGHcDdDXiBzpjvZSS++OVv1yZQjIIqfmIa6lPbeDE80dP4d3cQdsJB +wWBLr/KbYcHwVwXNg4NAblclveeVJlNXT+DfUg8xVJYY2RaAfHoKBVogtjkTOwwG +oTZinR0+ZzMOBL4JqFAICMwyplSasj1Eyia0FRI9AjNWILpqu7MtGoQ6IUHgVa77 +RAy8E2z5MtFysff4qwtUt50pSsOMgtWOmb/YNYlYOJVGhqXky7horlorKZEMcNPG +fwTiizaFy+gMHsukC087OoPnCTVZ2P+F8U5tFDUqRq1m3MqAWdjUN2C8d8SKS1Z7 +S2Q+Rm5BGL5NZnFz6/7LW1iidG4b9YC5heqtJmoNhRHryZboRe2VEtqPxciEHpWY +QmPs0OFgZHJgAPNgeQgpE+pBRcwWTa3Z+3A/Nm6UgPfPpTmUbirk4/jBTbP7aQq5 +jEsFqQYbCIS5gTBeyhjbbBH3hz7e0sPVRrhL+vDtZ6retYVtClM/zR8eXP/EC4zi +yQ6c7SzqX2IY0NM3pSuAcLmN2SEr1XRoFNrXiJLeQG34QtFPPExA0mMrc2zq8jds +ZCUCAwEAAaOBjTCBijAfBgNVHSMEGDAWgBRc4t76omnxreInvLtnc2S2TrNEZjAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIE8DAwBgNVHREEKTAngg9zc28ubWZvcmNlbi5k +ZXaCDmluZnJhLWtleWNsb2FrhwTAqGTIMB0GA1UdDgQWBBSmfY+Ys9/OM0QqABZH +x9Hfad/QsDANBgkqhkiG9w0BAQsFAAOCAgEAj5/YbTeF0jUjSDIo4OwqKy9ahefr +eiCjsjDwUBn7QgL/FYC4BCQw0y7WSLsHJxEHu2KSEs5GdVayTZY80e1eKEBKtg1u +ZALP7fpBWUsLx7jEq1gLaxuHK2Tdbbt7gTcEKJuSCEQkBYwHiE4SiLvF4kgyBhdt +9k6lWMAMIkyUsoqW35FibL+4DRCFT88gxPlInXeap7U457DPiTR+YQcDoMOasfKw +uLk6kxPdAj9+/C4jR44JNwizl9dOwhLeXPg9IZxO1FcRUt3Q7OMQ7al3EeDOz8pB +iON74z5Za9FX6QHP1Psxg/74v6wbOoAiatJ5zR5VZ3oZDPwWMcmC8Omh15f9HRR6 ++RUrsC2YW+9Zkj6fCheZfbi/vAica8n8t6PXRpHZ+8+xUCLOeREekjSVkIaacBkr +wxfGmn6wCibnGVBp6MY8bZg5SudmRC8qPhMGsTtWD2MX6i5I1kxDfRKdMum3+nuL +YN4ZGaDldpp7Y9vB1o3KcY6aDycKvMwqbfYXPHxRi8gbHxtaRpBTHYoJikBnIoTs +bwJEIVq28XjmmcLDKkeHN4LCnKOJ/F7t5tqQpieIVr/mOJxahznSybRAQHYUup7H +ePYfbP6zL0ZfDZ67UZPFiPfBWxpQny8KhouBF04oNJ5PDEC4ifHVWOoekYsEpk2e +m1LzzWJ0yOhABpY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFwTCCA6mgAwIBAgIUI2lRzQ83h1wud9kyxtu+QmrjjW8wDQYJKoZIhvcNAQEL +BQAwazELMAkGA1UEBhMCRVMxDzANBgNVBAgMBk11cmNpYTEWMBQGA1UECgwNTWFu +dWVsIEZvcmNlbjEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxHTAbBgkqhkiG9w0BCQEW +Dm1lQG1mb3JjZW4uZGV2MB4XDTI0MTAxMzE3MDgzMloXDTI5MTAxMjE3MDgzMlow +azEUMBIGA1UEAwwLbWZvcmNlbi5kZXYxCzAJBgNVBAYTAkVTMQ8wDQYDVQQIDAZN +dXJjaWExFjAUBgNVBAoMDU1hbnVlbCBGb3JjZW4xHTAbBgkqhkiG9w0BCQEWDm1l +QG1mb3JjZW4uZGV2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxGNa +BVSWAWknlWMcTCU08BdMd0k9JHmsl5fSoxUHM6iiGZH0eAqH1hxLAN3lrmBkVLgR +etkK3Frk3HNwhzRssp4uh2OdGIveUIm1qfgpA5+0zTxBfFn+WhVx7Xif99U+wKxH +sFb8xgbBbrVWhF06S3eWFuYVNU16OBwNbuCQhAe5+ZC0Dh8zkmC37qavPBR9ByKd +1MayDV54wZK67/aq3b1xyO+mu7EYR8D1vbKCmkxYASBlXs270P4r+CKHt8xe2Db1 +Zs8nOQTcHEgYwIp8N9QI2BnHAw2iKDZwt9SwXO4YFxqO7ViedVTeruHIMAxTPAVX +MVz5Qg1lpFiUXzZVFIIyZ82etd7WC7clOPOKvB8HHnMathamK3D/pJwqZS31MdQW +87nPzugBJwG8eYfFOn7zwIPJqMpMRCrQUIIIZ1VzA5vMAD8ZI+U8dtWfqiVxQ2oT +OTjbqO8e9eTO12/iQ2ZmXqGrxxJexu/ulwvYP3rxEF4w+oJbI4rlOWfr7OnCNiRD +l+hojcMrB89igoVkDuTni28dVjHYxtBBPRl2RCy9Z0yrSrh3TFcY2yuDM1FZbEwn +6NsVwz7nGYZpi/wXqszQP3WsfmJjNmrUhVqNw/xRmbSFIcaIY6CvytiRCN5NfzmD +cBeJSDMWjeQVaqAbAg7/4ddKe4CtN11A6TkleB0CAwEAAaNdMFswHwYDVR0jBBgw +FoAU+RiSCS6W+L+vSRYDYzzbmeLjMjwwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMC +AfYwHQYDVR0OBBYEFFzi3vqiafGt4ie8u2dzZLZOs0RmMA0GCSqGSIb3DQEBCwUA +A4ICAQA9sqxxE6X/qw5JFJAxbPClKite4SStxcjdCZZiBsUl4QrT/8O9NZfhPNIT +gIugzGD5YtXqlYQZtwc/bJ0g3s1NdCXrA3fU+FrubeBBzTIw3o/YBgn9n7o+1C1M +kgCJq7s9biQub0Es4HnuTK/lNjvpEKLVTv2tOgV3Z2CRsFnfR0MNOGgZlY3ZkKEq +oWqTOHGH1fJO3sdJleXrGs1z2oUC3nRTUjRox+/EHMVKdf3+142i2UO+uSGScmRh +0xJC2Rh757hCZBO3DgT7qgGhEliLKCwCU6PZVmLEZ1RxjRZgVw0p7g7YxahfXSXQ +GvBntIcx2ynE3mE+Ke035qLAArc1hZbbwJ84bpplRbzEXSsLHOZ6iyg+/fFilVPZ +7D8oZtxmRjNSQbXCzDbEuC27nQS9DOIBL3jLg0inHKd6awxcb4IWS2tBDT+teoFj +MYkhwJhYKJUERN74lsodCQlxUcAqTxutHuSFEWqMUna+ujOjjRirPwWjSX3Qsjdi +DNJJtTY/sFn5ClBkMe9a9L/AcZuj0wTi575XGJCPAlilfEtawmYILSVcM8jvlADp +/lvTo3CaPSm5pWYlxyT6ye7wk6QexC3G1D47cDN3JOx3691tvfziPBDPmXeWWUuO +LWBWeRdSMgWm+LKnd/KhLRlgcQebOuWZ2+yNdf3dQsvgox2cWA== +-----END CERTIFICATE----- diff --git a/files/keycloak/sso.mforcen.dev.key b/files/keycloak/sso.mforcen.dev.key new file mode 100644 index 0000000..8720c02 --- /dev/null +++ b/files/keycloak/sso.mforcen.dev.key @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDmZu6Y5tlj0Mp0 +JJyUi2+sfMWJjByfZgdlBYRC51jmsMzwkp0pQYPcHjMZFtl/+Q2ss3y1hof0yfVJ +8d0I3qphWhrF71PpVGqCfR1NuKbYVaQf9DgEwoYdwN0NeIHOmO9lJL745W/XJlCM +gip+YhrqU9t4MTzR0/h3dxB2wkHBYEuv8pthwfBXBc2Dg0BuVyW955UmU1dP4N9S +DzFUlhjZFoB8egoFWiC2ORM7DAahNmKdHT5nMw4EvgmoUAgIzDKmVJqyPUTKJrQV +Ej0CM1Ygumq7sy0ahDohQeBVrvtEDLwTbPky0XKx9/irC1S3nSlKw4yC1Y6Zv9g1 +iVg4lUaGpeTLuGiuWispkQxw08Z/BOKLNoXL6Awey6QLTzs6g+cJNVnY/4XxTm0U +NSpGrWbcyoBZ2NQ3YLx3xIpLVntLZD5GbkEYvk1mcXPr/stbWKJ0bhv1gLmF6q0m +ag2FEevJluhF7ZUS2o/FyIQelZhCY+zQ4WBkcmAA82B5CCkT6kFFzBZNrdn7cD82 +bpSA98+lOZRuKuTj+MFNs/tpCrmMSwWpBhsIhLmBMF7KGNtsEfeHPt7Sw9VGuEv6 +8O1nqt61hW0KUz/NHx5c/8QLjOLJDpztLOpfYhjQ0zelK4BwuY3ZISvVdGgU2teI +kt5AbfhC0U88TEDSYytzbOryN2xkJQIDAQABAoICAAm7QmvRYPsNuXtfL4DjryS9 +2WRrogAxNvHooiiRl8hDTUis/KKJNUinEDlIpTOkoT6l5HLQsEM3LjCAciRQLqnx +fGzXT2KX0ZmE2ifApfAVv+/8k0rPgjWAAlDcbJPSvavL5J1j0s3nfPf4/dKm5071 +70YRQv8e1kwKH/clfHxZNPaFHKnWn0WMWxzpU9+ajTTLSFoHzkneAY4Np7j++k+I +WzFxayUaOdml0/7cDWyiPNc412b++aIwJP1yXJXYisbKjy/PlYKkpgRiJ+haTZKQ +z8txRYqs7T1J3cU+CzgELK51CBqCImIgyzntlCy0NedbQT77xlaOoJMe+QuyHGTP +ggcmk65ZCYrxnDqETs7K0ER4XHt3henEdgViEoDdIp+ajzk7AdVkJwN6ycMH5sWU +MGAoTII8QfAFRO2axO4rYuDHRPoc6RaSa/vN1hVrsgmHoMBgt2m4RQS0GYLW15iR +TXytj+RKFFYF11gNXShVbaYmobIkpzCfR0cx+sOjjl0D0TU/8o1u3Tf6/fDpw0JW +mlDvhnHib0GznuXMe9KCaWT4htaP4CeBBCa+FuNLu0xreYVapPT9IhqcHV4h7P4z +92zMZ75ugugtJtwYsAn1mkXy/habLLpPBotZQZFXZDSCIYYJTn/nIqB4ezHxaJ55 +4fC1AaBAMvR6erEcc4EZAoIBAQD5r7NA4B8wecZcIvhuA/YQf3FHnT3gxlJhaNZu +d5ouqbNL/BBlqkP7WgglIAC/Ff7nshv0OYFOZaezQXeQD/5EmBtDXVsL/9BNKvjt +M586rsE1A1Xm0tzCjLi3RsJGlzb3OKzh+do33kaIGlWoRByuiIwCh1spE70zmGTm +6QiMISGe2o19mSQ+oc/+kVPKNeJR9zzkTfi787ZQpX/x3Cvs4h+wl3D32mHHP5c0 +VnHx2oV3bkpGYOPRGkBUiKSexTdBiEMqdYh7rwQXdOzdbEwIwL3cmljLT9RZjtH3 +5/LKgF31IEM73s9Sl1CCawDrMkbXlxA1gmZp4nqOAmXM3KYtAoIBAQDsOmYO19Tl +1gsUX3lpVDmAL0jjHRHwbNKNt82O81aA5IO+NVGVzlp/8e8MkqPsr1ME3drP+Rgr +1Tvt9fd2ftIfg4DQ6T07oQvNULB/byBlfcOD+zC1qFFfq98zyws8vFLZ0luUCvRD +OWApOFbuN/27jwzmcg/ntJsiA+L3hWVBIcqu088v6MrqrpPpcRvVjH8DFSGhR6ls +jrDDRQJRPrMkKzFMOMXfQPMkUNSVjtRR3D1V9/1xPcNQ1PI+AGkgev0traI8YoR9 +VOE+p18oK9FsZud39BLFvEdylyY5KPrCK804LEOGqF9oP8MgDoakw0RGElmcV8nS +SNcTCZpMbqjZAoIBAQCvvqTsSBSL+VrOZWr5fN5I1Hs2jg4M1WsM107/aD3lFFt4 +Y05jUMoS9FcBUppT5baK/QnCCGvkc5brjGwMwcUWIP4nl2FLe97xQgr+YrR0CKdD +mjpvgwISChzGHA8IwszUjFbbpBKd+l0o1WhvTKnni4MJEJ7wtc0ZsO1svp/eij9w +4aJvwkgJsbmGFGKm1PCdAuogRGWMXcl40FTTN0bPsIXftWi1fEgQh8j09Ne1BTum +ScIL8YzJFLItDhTZEDWJcdDc5OeRLyoxHILQg7as/oVk7lsLl//+nZFa7i8tq9b2 +f6PzUywYlRr9ATYfVj8Y5mJpV4SgiOH8bOGcpb5tAoIBAGYtQFWtP3YGZhZy0XYg +qxpp2XH68fZ3a39HAE+Tq1fm/6D3OQm+DuEGiWp7xxGqKBOTzoBkcvMKsXhVCquj +YUmmPMKgEA9JsmwlOaJ1M6MSic39iW0Zl9D0639glMS5hHCZD2lyb4LgP1q09szl +RQeqcV7/+Sc0tGE7IyIC/e/1KNED5rsHSzXFO08e0HZG5e00Z65166977LMZl04C ++8NqN1GLwPK3CjQsDjd+ZxHdXF5h/KrNlzzQTtNIpDAbYoUudF0AE+SOITtTc9JR +Wa00uWvmE3SZ4qGLBUp2EjiIb6SbaL3G+DWEVub3wX9kwpQ4fbAlPLOLNBQU9DuZ +JckCggEAMhRvRhR62fRV7VEwtrd4xt9tbv66zU7M+zRk7F6g7W1sWhvqQbQ9jSe9 +5y9IJ7g9kQT+d5mdIkEbNA5RstbHA/e1zxDWkSM71+TrxoysqwJBorx5Qpiw3SLS +1UxZ1XvgLsrAQEE/M7qMo6rhyqBhGshIBpM7nEwEDZeV9FOfLLHfJAwObYT7TtXu +pSxurqps1swMXb1802am/yEWDSx2Tnp8E0vjk0YEU0MclMQ3VQCHSnlOId3ZKYuM +P8HL26pQEnfcPEV1UHlxa7BvjQ3e/QuX2hdBLDc+E5eXs752Scrq5mn+LIlZpPqS +OwtOG44jL4ASwTrlWMxS3W4rn3C8pA== +-----END PRIVATE KEY----- diff --git a/inventory.yml b/inventory.yml new file mode 100644 index 0000000..bd294ec --- /dev/null +++ b/inventory.yml @@ -0,0 +1,3 @@ +mforcen.dev: + ansible_user: forcen + ansible_port: 9022 diff --git a/templates/compose.yml b/templates/compose.yml new file mode 100644 index 0000000..3fd1a37 --- /dev/null +++ b/templates/compose.yml @@ -0,0 +1,100 @@ +services: + database: + + image: postgres:17 + container_name: infra-db + restart: unless-stopped + environment: + POSTGRES_PASSWORD: {{ postgres_pass }} + logging: + driver: local + networks: + infra-network: + ipv4_address: 172.28.0.2 + volumes: + - type: bind + source: ./postgres/init-scripts + target: /docker-entrypoint-initdb.d + - type: volume + source: psql-data + target: /var/lib/postgresql/data + + keycloak: + build: + context: ./keycloak + dockerfile: Containerfile + container_name: infra-keycloak + restart: unless-stopped + logging: + driver: local + networks: + infra-network: + ipv4_address: 172.28.0.3 + aliases: + - sso.mforcen.dev + environment: + KC_DB: postgres + KC_DB_URL: jdbc:postgresql://infra-db/keycloak + KC_DB_USERNAME: keycloak + KC_DB_PASSWORD: {{ keycloak_pass }} + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: Radiola.123 + KC_HOSTNAME: sso.mforcen.dev + KC_HTTPS_PORT: 443 + depends_on: + - database + + grafana: + container_name: infra-grafana + image: grafana/grafana:latest + restart: unless-stopped + volumes: + - grafana-storage:/var/lib/grafana + - type: bind + source: ./grafana/mforcen.crt + target: /etc/ssl/mforcen.crt + - type: bind + source: ./grafana/ssl + target: /ssl + logging: + driver: local + depends_on: + - keycloak + networks: + infra-network: + ipv4_address: 172.28.0.4 + environment: + GF_DATABASE_TYPE: postgres + GF_DATABASE_HOST: infra-db:5432 + GF_DATABASE_NAME: grafana + GF_DATABASE_USER: grafana + GF_DATABASE_PASSWORD: {{ grafana_pass }} + GF_SERVER_PROTOCOL: https + GF_SERVER_PORT: 443 + GF_SERVER_DOMAIN: grafana.mforcen.dev + GF_SERVER_CERT_FILE: /ssl/grafana.mforcen.dev.fullchain.pem + GF_SERVER_KEY_FILE: /ssl/grafana.mforcen.dev.key + GF_AUTH_GENERIC_OAUTH_NAME: SSO + GF_AUTH_GENERIC_OAUTH_ENABLED: true + GF_AUTH_GENERIC_OAUTH_CLIENT_ID: grafana + GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: {{ grafana_kc_client_secret }} + GF_AUTH_GENERIC_OAUTH_EMAIL_ATTRIBUTE_PATH: email + GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH: username + GF_AUTH_GENERIC_OAUTH_NAME_ATTRIBUTE_PATH: full_name + GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer' + GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://sso.mforcen.dev/realms/infra/protocol/openid-connect/auth + GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://sso.mforcen.dev/realms/infra/protocol/openid-connect/token + GF_AUTH_GENERIC_OAUTH_API_URL: https://sso.mforcen.dev/realms/infra/protocol/openid-connect/userinfo + +volumes: + psql-data: + grafana-storage: +networks: + infra-network: + ipam: + driver: default + config: + - subnet: 172.28.0.0/24 + ip_range: 172.28.0.0/24 + gateway: 172.28.0.254 + name: infra-network diff --git a/templates/grafana.ini b/templates/grafana.ini new file mode 100644 index 0000000..0fb75ba --- /dev/null +++ b/templates/grafana.ini @@ -0,0 +1,1907 @@ +##################### Grafana Configuration Example ##################### +# +# Everything has defaults so you only need to uncomment things you want to +# change + +# possible values : production, development +;app_mode = production + +# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty +;instance_name = ${HOSTNAME} + +#################################### Paths #################################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +;data = /var/lib/grafana + +# Temporary files in `data` directory older than given duration will be removed +;temp_data_lifetime = 24h + +# Directory where grafana can store logs +;logs = /var/log/grafana + +# Directory where grafana will automatically scan and look for plugins +;plugins = /var/lib/grafana/plugins + +# folder that contains provisioning config files that grafana will apply on startup and while running. +;provisioning = conf/provisioning + +#################################### Server #################################### +[server] +# Protocol (http, https, h2, socket) +protocol = https + +# Minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.2, TLS1.3. If nothing is set TLS1.2 would be taken +;min_tls_version = "" + +# The ip address to bind to, empty will bind to all interfaces +;http_addr = + +# The http port to use +http_port = 443 + +# The public facing domain name used to access grafana from a browser +domain = grafana.mforcen.dev + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +;enforce_domain = false + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +;root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. +;serve_from_sub_path = false + +# Log web requests +;router_logging = false + +# the path relative working path +;static_root_path = public + +# enable gzip +;enable_gzip = false + +# https certs & key file +cert_file = /ssl/grafana.mforcen.dev.fullchain.pem +cert_key = /ssl/grafana.mforcen.dev.key + +# optional password to be used to decrypt key file +;cert_pass = + +# Certificates file watch interval +;certs_watch_interval = + +# Unix socket gid +# Changing the gid of a file without privileges requires that the target group is in the group of the process and that the process is the file owner +# It is recommended to set the gid as http server user gid +# Not set when the value is -1 +;socket_gid = + +# Unix socket mode +;socket_mode = + +# Unix socket path +;socket = + +# CDN Url +;cdn_url = + +# Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections. +# `0` means there is no timeout for reading the request. +;read_timeout = 0 + +# This setting enables you to specify additional headers that the server adds to HTTP(S) responses. +[server.custom_response_headers] +#exampleHeader1 = exampleValue1 +#exampleHeader2 = exampleValue2 + +[environment] +# Sets whether the local file system is available for Grafana to use. Default is true for backward compatibility. +;local_file_system_available = true + +#################################### GRPC Server ######################### +;[grpc_server] +;network = "tcp" +;address = "127.0.0.1:10000" +;use_tls = false +;cert_file = +;key_file = +;max_recv_msg_size = +;max_send_msg_size = +# this will log the request and response for each unary gRPC call +;enable_logging = false + +#################################### Database #################################### +[database] +# You can configure the database connection by specifying type, host, name, user and password +# as separate properties or as on string using the url properties. + +# Either "mysql", "postgres" or "sqlite3", it's your choice +type = postgres +host = infra-db +name = grafana +user = grafana +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +password = {{ grafana_pass }} +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +;url = + +# Max idle conn setting default is 2 +;max_idle_conn = 2 + +# Max conn setting default is 0 (mean not set) +;max_open_conn = + +# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) +;conn_max_lifetime = 14400 + +# Set to true to log the sql calls and execution times. +;log_queries = + +# For "postgres", use either "disable", "require" or "verify-full" +# For "mysql", use either "true", "false", or "skip-verify". +;ssl_mode = disable + +# For "postgres", use either "1" to enable or "0" to disable SNI +;ssl_sni = + +# Database drivers may support different transaction isolation levels. +# Currently, only "mysql" driver supports isolation levels. +# If the value is empty - driver's default isolation level is applied. +# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE". +;isolation_level = + +;ca_cert_path = +;client_key_path = +;client_cert_path = +;server_cert_name = + +# For "sqlite3" only, path relative to data_path setting +;path = grafana.db + +# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) +;cache_mode = private + +# For "sqlite3" only. Enable/disable Write-Ahead Logging, https://sqlite.org/wal.html. Default is false. +;wal = false + +# For "mysql" and "postgres" only. Lock the database for the migrations, default is true. +;migration_locking = true + +# For "mysql" and "postgres" only. How many seconds to wait before failing to lock the database for the migrations, default is 0. +;locking_attempt_timeout_sec = 0 + +# For "sqlite" only. How many times to retry query in case of database is locked failures. Default is 0 (disabled). +;query_retries = 0 + +# For "sqlite" only. How many times to retry transaction in case of database is locked failures. Default is 5. +;transaction_retries = 5 + +# Set to true to add metrics and tracing for database queries. +;instrument_queries = false + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +;type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +;connstr = + +# prefix prepended to all the keys in the remote cache +; prefix = + +# This enables encryption of values stored in the remote cache +;encryption = + +#################################### Data proxy ########################### +[dataproxy] + +# This enables data proxy logging, default is false +;logging = false + +# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds. +# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set. +;timeout = 30 + +# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds. +;dialTimeout = 10 + +# How many seconds the data proxy waits before sending a keepalive probe request. +;keep_alive_seconds = 30 + +# How many seconds the data proxy waits for a successful TLS Handshake before timing out. +;tls_handshake_timeout_seconds = 10 + +# How many seconds the data proxy will wait for a server's first response headers after +# fully writing the request headers if the request has an "Expect: 100-continue" +# header. A value of 0 will result in the body being sent immediately, without +# waiting for the server to approve. +;expect_continue_timeout_seconds = 1 + +# Optionally limits the total number of connections per host, including connections in the dialing, +# active, and idle states. On limit violation, dials will block. +# A value of zero (0) means no limit. +;max_conns_per_host = 0 + +# The maximum number of idle connections that Grafana will keep alive. +;max_idle_connections = 100 + +# How many seconds the data proxy keeps an idle connection open before timing out. +;idle_conn_timeout_seconds = 90 + +# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. +;send_user_header = false + +# Limit the amount of bytes that will be read/accepted from responses of outgoing HTTP requests. +;response_limit = 0 + +# Limits the number of rows that Grafana will process from SQL data sources. +;row_limit = 1000000 + +# Sets a custom value for the `User-Agent` header for outgoing data proxy requests. If empty, the default value is `Grafana/` (for example `Grafana/9.0.0`). +;user_agent = + +#################################### Analytics #################################### +[analytics] +# Server reporting, sends usage counters to stats.grafana.org every 24 hours. +# No ip addresses are being tracked, only simple counters to track +# running instances, dashboard and error counts. It is very helpful to us. +# Change this option to false to disable reporting. +reporting_enabled = false + +# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs +;reporting_distributor = grafana-labs + +# Set to false to disable all checks to https://grafana.com +# for new versions of grafana. The check is used +# in some UI views to notify that a grafana update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version. +;check_for_updates = true + +# Set to false to disable all checks to https://grafana.com +# for new versions of plugins. The check is used +# in some UI views to notify that a plugin update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://grafana.com to get the latest versions. +;check_for_plugin_updates = true + +# Google Analytics universal tracking code, only enabled if you specify an id here +;google_analytics_ua_id = + +# Google Analytics 4 tracking code, only enabled if you specify an id here +;google_analytics_4_id = + +# When Google Analytics 4 Enhanced event measurement is enabled, we will try to avoid sending duplicate events and let Google Analytics 4 detect navigation changes, etc. +;google_analytics_4_send_manual_page_views = false + +# Google Tag Manager ID, only enabled if you specify an id here +;google_tag_manager_id = + +# Rudderstack write key, enabled only if rudderstack_data_plane_url is also set +;rudderstack_write_key = + +# Rudderstack data plane url, enabled only if rudderstack_write_key is also set +;rudderstack_data_plane_url = + +# Rudderstack SDK url, optional, only valid if rudderstack_write_key and rudderstack_data_plane_url is also set +;rudderstack_sdk_url = + +# Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config +;rudderstack_config_url = + +# Rudderstack Integrations URL, optional. Only valid if you pass the SDK version 1.1 or higher +;rudderstack_integrations_url = + +# Intercom secret, optional, used to hash user_id before passing to Intercom via Rudderstack +;intercom_secret = + +# Application Insights connection string. Specify an URL string to enable this feature. +;application_insights_connection_string = + +# Optional. Specifies an Application Insights endpoint URL where the endpoint string is wrapped in backticks ``. +;application_insights_endpoint_url = + +# Controls if the UI contains any links to user feedback forms +;feedback_links_enabled = true + +# Static context that is being added to analytics events +;reporting_static_context = grafanaInstance=12, os=linux + +#################################### Security #################################### +[security] +# disable creation of admin user on first start of grafana +disable_initial_admin_creation = false + +# default admin user, created on startup +;admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +;admin_password = admin + +# default admin email, created on startup +;admin_email = admin@localhost + +# used for signing +;secret_key = SW2YcwTIb9zpOOhoPsMm + +# current key provider used for envelope encryption, default to static value specified by secret_key +;encryption_provider = secretKey.v1 + +# list of configured key providers, space separated (Enterprise only): e.g., awskms.v1 azurekv.v1 +;available_encryption_providers = + +# disable gravatar profile images +;disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +;data_source_proxy_whitelist = + +# disable protection against brute force login attempts +;disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +;cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +;cookie_samesite = lax + +# set to true if you want to allow browsers to render Grafana in a ,