jochen
b9104454f9
mesh/merge-gate head b9104454f9a5 merged into trunk 954f84ea19b5 — pass: builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person; every machine …
mesh/repo-check head b9104454f9a5 merged into trunk 954f84ea19b5 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivering: 0 machine step(s) passed
mesh-mail-web, grafana and car-hunter are not moved, so keycloak wanted nothing for them: it never made mesh_novox_mail_web, and held mesh_ace_grafana and mesh_ace_carhunt for retirement. Keycloak's moved spec now asks for the grant file's consumers too (WithGrants: true), and the moved harness reads MESH_RECEIVES exactly as the grant path does and as postgres's moved harness already did.
59 lines
3.0 KiB
Go
59 lines
3.0 KiB
Go
package main
|
|
|
|
// keycloak handed to the provisioner (novox/hq ADR 0373, ADR 0349 clause 12, issue 805): where its consumers file
|
|
// is set, keycloak runs on the SDK's provider helper instead of the harness reading the controller's grant files.
|
|
//
|
|
// The helper learns who binds keycloak from the plans, composes each consumer's entry and reads its credential
|
|
// through ConsumersFile, the file this machine's provisioner client fills. It leaves the rest to the two hooks
|
|
// here: Make brings the consumer's OIDC client into being exactly as the harness's adapter does, and Gone leaves
|
|
// retirement to the harness's guards (the SDK's harness retirement): the client is disabled and marked to delete, never removed.
|
|
|
|
import (
|
|
"git.novox.be/novox/mesh-sdk/go/provider"
|
|
"git.novox.be/novox/mesh-sdk/go/provider/harness"
|
|
)
|
|
|
|
// ProvisionName is what keycloak provides, as its manifest says.
|
|
const ProvisionName = "oidc-client"
|
|
|
|
// servedValues is what its manifest serves (`serves.oidc-client`): the paths as they are, and the issuer as its own
|
|
// config says, which is the one the code reads (Issuer), not a value the helper reads from the manifest.
|
|
func servedValues(issuer string) map[string]any {
|
|
return map[string]any{
|
|
"issuer": issuer,
|
|
"authorization-path": "/protocol/openid-connect/auth",
|
|
"token-path": "/protocol/openid-connect/token",
|
|
"userinfo-path": "/protocol/openid-connect/userinfo",
|
|
}
|
|
}
|
|
|
|
// valuesOf is what the consumer's grant file gave the harness as its values: what it contributes (label, endpoint,
|
|
// callback), with the names the controller composed for it (name, internal-name) over them (issue 792).
|
|
func valuesOf(e provider.Entry) map[string]any {
|
|
values := map[string]any{}
|
|
for k, v := range e.Contributes {
|
|
values[k] = v
|
|
}
|
|
for k, name := range e.Names {
|
|
values[k] = name
|
|
}
|
|
return values
|
|
}
|
|
|
|
// moved is keycloak handed to the provisioner: the SDK's moved path (harness.Moved) answering its consumers, and the
|
|
// harness (never run) whose retirement and tools it shares. What differs from postgres is only this declaration
|
|
// (issue 849).
|
|
//
|
|
// **A consumer not moved is still the grant file's** (issue 937, ADR 0349 clause 17, fixed here by issue 1332):
|
|
// only a moved consumer's plan names keycloak as its provider, so the controller still gives every other consumer
|
|
// through keycloak's grant file (MESH_RECEIVES) until R1 (issue 682) — mesh-mail-web, grafana and car-hunter among
|
|
// them. Each client it gives is made and checked by the harness's grant pass exactly as on the grant path; a client
|
|
// a plan names is the helper's alone.
|
|
func moved(consumersFile string, h *harness.Harness, issuer string) (*harness.Moved, *provider.Provider, provider.Bus, error) {
|
|
return harness.NewMoved(consumersFile, h, harness.MovedSpec{Module: "keycloak", Provision: ProvisionName,
|
|
Offer: provider.Offer{Credential: provider.PerConsumer, Serves: servedValues(issuer)},
|
|
Login: func(e provider.Entry) string { return e.As },
|
|
Values: valuesOf,
|
|
Noun: "client id", Made: "client", Backend: "Keycloak", WithGrants: true})
|
|
}
|