-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: quarkus version of keyloak - RHBK 24.0.5 (#363)
* feat: dockerfile for 22.0.8 and action for build * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: in progress * feat: updated dockerfile * feat: updated initial keycloak configuration * feat: addded quotes in keycloak configuration * feat: removed quotes for exception-output-type * feat: added quarkus.log.file.path * feat: commented some config * feat: using env.hostname for logfile name * feat: removed double quotes for some config * feat: create log file from keycloak.conf * feat: updated log file path * feat: updated log file path * feat: updated log file path * feat: updated log file path * feat: updated log file path * feat: updated log file path * feat: updated log file path * feat: enabled health check * feat: added custom fields to provider config * feat: removing override * feat: updated model with new attribute * feat: removed added attribute * feat: enabled legacy logout redirect URI * feat: removed double quotes from log file suffix * feat: rm legacy logout switch and update cache settings * feat: using replicated cache * feat: enabled cache * feat: trying cache stack kubernetes * feat: renamed file cache ispn * feat: use distributed cache * feat: use default cache settings * feat: removed keystore settings * feat: use cache stack tcp * feat: rollback cache settings * feat: turning on debug level * feat: using community version of keycloak 24 * feat: using cache stack kubernetes * feat: using cache stack kubernetes with rhbk * feat: update image tag to 22-10 * feat: using custom cache configuration * feat: using distributed cache configuration * feat: setting db pool min and max sizes * feat: migrating idp userinfo changes * feat: import base64 package * feat: initial commit of rhbk-24 * feat: removed cache conf for kc24 * feat: set forwarded proxy headers * feat: enable http * feat: migration to KC24 document * feat: updated developer guide * feat: updated kc24 migration guide * feat: update migration document * feat: IDP Userinfo multi attrs and validate sign * feat: add user session removed ext * feat: minor syntax fix * feat: default user profile config * feat: JWS signature verification by IDP Userinfo * feat: ensure userinfo is not null * feat: updated user profile json path * feat: upgrade to RHBK 24.0.5 * feat: improved error message to handle bcsc * fix: regex to handle hypens inside provider names * test: remove JS logic to update username to debug error * test: remove JS logic to update username to debug error * fix: handle special chars in username for error message * fix: use single quotes for username in error message * feat: support encryption for IDP userinfo mapper * fix: target 24-10 tag to build rhbk image * feat: remove 22 folder and updated git action to publish rhbk * feat: handle xss vulnerability in js --------- Co-authored-by: Marco Villeneuve <[email protected]>
- Loading branch information
1 parent
f8963a4
commit cc723e9
Showing
86 changed files
with
4,524 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| name: Create and publish Keycloak Docker image - Dev | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - 'feature/quarkus' | ||
|
|
||
| env: | ||
| GITHUB_REGISTRY: ghcr.io | ||
| REDHAT_REGISTRY: registry.redhat.io | ||
| IMAGE_NAME: bcgov/sso | ||
|
|
||
| jobs: | ||
| build-and-push-image: | ||
| runs-on: ubuntu-20.04 | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Log in to the GitHub Container registry | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ env.GITHUB_REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Log in to the REDHAT Container registry | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ env.REDHAT_REGISTRY }} | ||
| username: ${{ secrets.REDHAT_USERNAME }} | ||
| password: ${{ secrets.REDHAT_PASSWORD }} | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v1 | ||
|
|
||
| - name: Cache Docker layers | ||
| uses: actions/cache@v2 | ||
| with: | ||
| path: /tmp/.buildx-cache | ||
| key: ${{ runner.os }}-buildx-${{ github.sha }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-buildx- | ||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v3 | ||
| with: | ||
| context: docker/keycloak | ||
| push: true | ||
| tags: ${{ env.GITHUB_REGISTRY }}/${{env.IMAGE_NAME}}:dev-rhbk-24 | ||
| file: docker/keycloak/Dockerfile-24 | ||
| cache-from: type=local,src=/tmp/.buildx-cache | ||
| cache-to: type=local,dest=/tmp/.buildx-cache-new | ||
|
|
||
| # Temp fix | ||
| # https://github.com/docker/build-push-action/issues/252 | ||
| # https://github.com/moby/buildkit/issues/1896 | ||
| - name: Move cache | ||
| run: | | ||
| rm -rf /tmp/.buildx-cache | ||
| mv /tmp/.buildx-cache-new /tmp/.buildx-cache |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| FROM maven:3.8.5-openjdk-17-slim AS extensions-builder | ||
|
|
||
| COPY ./extensions-24 /tmp/ | ||
| WORKDIR /tmp/ | ||
| RUN mvn -B clean package --file pom.xml | ||
|
|
||
| FROM registry.redhat.io/rhbk/keycloak-rhel9:24-10 as builder | ||
|
|
||
| # Enable health and metrics support | ||
| ENV KC_HEALTH_ENABLED=true | ||
| ENV KC_METRICS_ENABLED=true | ||
|
|
||
| # Configure a database vendor | ||
| ENV KC_DB=postgres | ||
|
|
||
| COPY --from=extensions-builder /tmp/services/target/bcgov-services-1.0.0.jar /opt/keycloak/providers/ | ||
|
|
||
| WORKDIR /opt/keycloak | ||
|
|
||
| RUN /opt/keycloak/bin/kc.sh build | ||
|
|
||
| FROM registry.redhat.io/rhbk/keycloak-rhel9:24-10 | ||
|
|
||
| COPY --from=builder /opt/keycloak/ /opt/keycloak/ | ||
|
|
||
| # copy the theme directory to `/opt/keycloak/themes/` for now, but we can consider to archive to be deployed later. | ||
| COPY ./extensions-24/themes/src/main/resources/theme /opt/keycloak/themes | ||
|
|
||
| COPY ./configuration/24/keycloak.conf /opt/keycloak/conf | ||
|
|
||
| COPY ./configuration/24/quarkus.properties /opt/keycloak/conf | ||
|
|
||
| COPY ./configuration/24/keycloak-default-user-profile.json /tmp | ||
|
|
||
| # change these values to point to a running postgres instance | ||
| ENTRYPOINT ["/opt/keycloak/bin/kc.sh"] |
61 changes: 61 additions & 0 deletions
61
docker/keycloak/configuration/24/keycloak-default-user-profile.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| { | ||
| "unmanagedAttributePolicy": "ENABLED", | ||
| "attributes": [ | ||
| { | ||
| "name": "username", | ||
| "displayName": "${username}", | ||
| "permissions": { | ||
| "view": ["admin", "user"], | ||
| "edit": ["admin", "user"] | ||
| }, | ||
| "validations": { | ||
| "length": { "min": 3, "max": 255 }, | ||
| "username-prohibited-characters": {}, | ||
| "up-username-not-idn-homograph": {} | ||
| } | ||
| }, | ||
| { | ||
| "name": "email", | ||
| "displayName": "${email}", | ||
| "permissions": { | ||
| "view": ["admin", "user"], | ||
| "edit": ["admin", "user"] | ||
| }, | ||
| "validations": { | ||
| "email": {}, | ||
| "length": { "max": 255 } | ||
| } | ||
| }, | ||
| { | ||
| "name": "firstName", | ||
| "displayName": "${firstName}", | ||
| "permissions": { | ||
| "view": ["admin", "user"], | ||
| "edit": ["admin", "user"] | ||
| }, | ||
| "validations": { | ||
| "length": { "max": 255 }, | ||
| "person-name-prohibited-characters": {} | ||
| } | ||
| }, | ||
| { | ||
| "name": "lastName", | ||
| "displayName": "${lastName}", | ||
| "permissions": { | ||
| "view": ["admin", "user"], | ||
| "edit": ["admin", "user"] | ||
| }, | ||
| "validations": { | ||
| "length": { "max": 255 }, | ||
| "person-name-prohibited-characters": {} | ||
| } | ||
| } | ||
| ], | ||
| "groups": [ | ||
| { | ||
| "name": "user-metadata", | ||
| "displayHeader": "User metadata", | ||
| "displayDescription": "Attributes, which refer to user metadata" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| health-enabled=true | ||
| metrics-enabled=true | ||
|
|
||
| # database | ||
| db-pool-min-size=5 | ||
| db-pool-max-size=20 | ||
|
|
||
| # theme | ||
| spi-theme-static-max-age=2592000 | ||
| spi-theme-cache-themes=true | ||
| spi-theme-cache-templates=true | ||
|
|
||
| # logging | ||
| log=console,file | ||
| log-console-color=false | ||
| log-file=/var/log/eap/${HOSTNAME}.log | ||
|
|
||
| # root-logger-level:INFO | ||
| log-level=info,com.arjuna:warn,io.jaegertracing.Configuration:warn,org.jboss.as.config:debug,org.keycloak.events:debug,sun.rmi:warn | ||
| log-console-output=json | ||
| log-file-output=json | ||
|
|
||
| # SPIs | ||
| spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true | ||
| spi-user-profile-declarative-user-profile-config-file=/tmp/keycloak-default-user-profile.json | ||
|
|
||
| # cache | ||
| cache=ispn | ||
| # DNS_PING is particularly useful in environments like Kubernetes and Red Hat OpenShift where UDP multicast, a different cluster discovery method, might not be available. This is because DNS is a standard service that's always available, making DNS_PING a reliable way for Infinispan nodes to discover each other. | ||
| # The below option requires passing -Djgroups.dns.query=sso-keycloak-ping.<NAMESPACE>.svc.cluster.local to start command | ||
| cache-stack=kubernetes | ||
| #cache-config-file=cache-ispn-custom.xml | ||
|
|
||
| # tls | ||
| # https-key-store-file=server.keystore | ||
| # https-key-store-password=password | ||
|
|
||
| http-enabled=true | ||
| proxy-headers=forwarded |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| quarkus.log.console.json.exception-output-type=formatted | ||
| quarkus.log.console.json.key-overrides=timestamp=@timestamp | ||
| quarkus.log.console.json.additional-field."@version".value=1 | ||
| quarkus.log.file.json.exception-output-type=formatted | ||
| quarkus.log.file.json.key-overrides=timestamp=@timestamp | ||
| quarkus.log.file.json.additional-field."@version".value=1 | ||
| quarkus.log.file.rotation.file-suffix=.yyyy-MM-dd | ||
| # Optional: Disable rotation by size (adjust value as needed) | ||
| quarkus.log.handler.file.rotation.max-file-size="10000M" | ||
| quarkus.log.handler.file.rotation.max-backup-index="100" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| { | ||
| "java.configuration.updateBuildConfiguration": "interactive" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
|
|
||
| <groupId>com.github.bcgov.keycloak</groupId> | ||
| <artifactId>extensions-parent</artifactId> | ||
| <version>1.0.0</version> | ||
| <packaging>pom</packaging> | ||
|
|
||
| <properties> | ||
| <maven.compiler.source>17</maven.compiler.source> | ||
| <maven.compiler.target>17</maven.compiler.target> | ||
| <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> | ||
| <keycloak.version>24.0.5</keycloak.version> | ||
| </properties> | ||
|
|
||
| <build> | ||
| <pluginManagement> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.apache.maven.plugins</groupId> | ||
| <artifactId>maven-jar-plugin</artifactId> | ||
| <version>3.2.0</version> | ||
| </plugin> | ||
| </plugins> | ||
| </pluginManagement> | ||
| </build> | ||
|
|
||
| <modules> | ||
| <module>services</module> | ||
| <module>themes</module> | ||
| </modules> | ||
| </project> |
Oops, something went wrong.