53 lines
2.5 KiB
Go
53 lines
2.5 KiB
Go
package main
|
|
|
|
// keycloak handed to the provisioner (novox/hq ADR 0373, ADR 0349 clause 12, issue 805): where its consumers file
|
|
// is set, keycloak runs on the SDK's provider helper instead of the harness reading the controller's grant files.
|
|
//
|
|
// The helper learns who binds keycloak from the plans, composes each consumer's entry and reads its credential
|
|
// through ConsumersFile, the file this machine's provisioner client fills. It leaves the rest to the two hooks
|
|
// here: Make brings the consumer's OIDC client into being exactly as the harness's adapter does, and Gone leaves
|
|
// retirement to the harness's guards (the SDK's harness retirement): the client is disabled and marked to delete, never removed.
|
|
|
|
import (
|
|
"git.novox.be/novox/mesh-sdk/go/provider"
|
|
"git.novox.be/novox/mesh-sdk/go/provider/harness"
|
|
)
|
|
|
|
// ProvisionName is what keycloak provides, as its manifest says.
|
|
const ProvisionName = "oidc-client"
|
|
|
|
// servedValues is what its manifest serves (`serves.oidc-client`): the paths as they are, and the issuer as its own
|
|
// config says, which is the one the code reads (Issuer), not a value the helper reads from the manifest.
|
|
func servedValues(issuer string) map[string]any {
|
|
return map[string]any{
|
|
"issuer": issuer,
|
|
"authorization-path": "/protocol/openid-connect/auth",
|
|
"token-path": "/protocol/openid-connect/token",
|
|
"userinfo-path": "/protocol/openid-connect/userinfo",
|
|
}
|
|
}
|
|
|
|
// valuesOf is what the consumer's grant file gave the harness as its values: what it contributes (label, endpoint,
|
|
// callback), with the names the controller composed for it (name, internal-name) over them (issue 792).
|
|
func valuesOf(e provider.Entry) map[string]any {
|
|
values := map[string]any{}
|
|
for k, v := range e.Contributes {
|
|
values[k] = v
|
|
}
|
|
for k, name := range e.Names {
|
|
values[k] = name
|
|
}
|
|
return values
|
|
}
|
|
|
|
// moved is keycloak handed to the provisioner: the SDK's moved path (harness.Moved) answering its consumers, and the
|
|
// harness (never run) whose retirement and tools it shares. What differs from postgres is only this declaration
|
|
// (issue 849).
|
|
func moved(consumersFile string, h *harness.Harness, issuer string) (*harness.Moved, *provider.Provider, provider.Bus, error) {
|
|
return harness.NewMoved(consumersFile, h, harness.MovedSpec{Module: "keycloak", Provision: ProvisionName,
|
|
Offer: provider.Offer{Credential: provider.PerConsumer, Serves: servedValues(issuer)},
|
|
Login: func(e provider.Entry) string { return e.As },
|
|
Values: valuesOf,
|
|
Noun: "client id", Made: "client", Backend: "Keycloak", WithGrants: false})
|
|
}
|