Manage Keycloak realm
Change-Id: Ifc27ca5788a52205a247e0811dbd1f9ece1d080f
diff --git a/docker/swarm/stack/keycloak.yml b/docker/swarm/stack/keycloak.yml
index c712fda..e613637 100644
--- a/docker/swarm/stack/keycloak.yml
+++ b/docker/swarm/stack/keycloak.yml
@@ -2,7 +2,7 @@
_param:
docker_keycloak_server_replicas: 1
docker_keycloak_proxy_replicas: 1
- docker_image_keycloak_server: jboss/keycloak:3.4.2.Final
+ docker_image_keycloak_server: jboss/keycloak:4.5.0.Final
docker_image_keycloak_proxy: jboss/keycloak-proxy:3.4.2.Final
keycloak_bind_port: ${_param:haproxy_keycloak_bind_port}
keycloak_proxy_bind_port: ${_param:haproxy_keycloak_proxy_bind_port}
@@ -16,6 +16,7 @@
environment:
KEYCLOAK_USER: ${_param:keycloak_admin_username}
KEYCLOAK_PASSWORD: ${_param:keycloak_admin_password}
+ KEYCLOAK_IMPORT: "/app/realms.json"
service:
keycloak-server:
image: ${_param:docker_image_keycloak_server}
diff --git a/keycloak/server/realm/drivetrain.yml b/keycloak/server/realm/drivetrain.yml
new file mode 100644
index 0000000..42b3473
--- /dev/null
+++ b/keycloak/server/realm/drivetrain.yml
@@ -0,0 +1,76 @@
+parameters:
+ _param:
+ keycloak_drivetrain_users_dn: ou=people,dc=cicd,dc=local
+ keycloak_drivetrain_bind_dn: cn=admin,dc=cicd,dc=local
+ keycloak_drivetrain_connection_url: ldap://${_param:single_address}:1389
+ keycloak_drivetrain_provider_display_name: drivetrain-ldap
+ keycloak:
+ server:
+ realm:
+ drivetrain-realm:
+ enabled: true
+ client:
+ operations-api:
+ enabled: true
+ base_url: /operations-api-portal
+ redirect_uris:
+ - /operations-api-portal/*
+ admin_url: /operations-api-portal
+ direct_access_grants_enabled: true
+ secret: ${_param:keycloak_operations_api_client_secret}
+ protocol_mapper:
+ oidc-usermodel-property-mapper:
+ username:
+ name: username
+ user_attribute: username
+ claim_name: preferred_username
+ given_name:
+ name: given name
+ user_attribute: firstName
+ claim_name: given_name
+ family_name:
+ name: family name
+ user_attribute: lastName
+ claim_name: family_name
+ email:
+ name: email
+ user_attribute: email
+ claim_name: email
+ oidc-full-name-mapper:
+ full_name:
+ name: full_name
+ federation_provider:
+ ldap:
+ display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ users_dn: ${_param:keycloak_drivetrain_users_dn}
+ bind_dn: ${_param:keycloak_drivetrain_bind_dn}
+ bind_credential: ${_param:keycloak_drivetrain_bind_credential}
+ connection_url: ${_param:keycloak_drivetrain_connection_url}
+ federation_mapper:
+ user-attribute-ldap-mapper:
+ username:
+ name: username
+ provider_display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ ldap_attribute: uid
+ model_attribute: username
+ first_name:
+ name: first name
+ provider_display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ ldap_attribute: givenName
+ model_attribute: firstName
+ last_name:
+ name: last name
+ provider_display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ ldap_attribute: sn
+ model_attribute: lastName
+ email:
+ name: email
+ provider_display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ ldap_attribute: mail
+ model_attribute: email
+ mandatory: false
+ role-ldap-mapper:
+ realm_roles:
+ name: realm roles
+ provider_display_name: ${_param:keycloak_drivetrain_provider_display_name}
+ roles_dn: ou=groups,dc=cicd,dc=local
diff --git a/keycloak/server/single.yml b/keycloak/server/single.yml
new file mode 100644
index 0000000..504532b
--- /dev/null
+++ b/keycloak/server/single.yml
@@ -0,0 +1,3 @@
+classes:
+- service.keycloak.server
+- system.keycloak.server.realm.drivetrain
diff --git a/salt/master/formula/pkg/oss.yml b/salt/master/formula/pkg/oss.yml
index 45739d2..aade8cf 100644
--- a/salt/master/formula/pkg/oss.yml
+++ b/salt/master/formula/pkg/oss.yml
@@ -10,3 +10,6 @@
rundeck:
source: pkg
name: salt-formula-rundeck
+ keycloak:
+ source: pkg
+ name: salt-formula-keycloak