bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

keycloak: disable PKCE for Gitea Veles OIDC

Browse Source
This commit is contained in:
jenkins 2026-06-20 14:19:47 -03:00
parent dc97e3b70e
commit 29d89880ca
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
services/keycloak/oneoffs/veles-gitea-oidc-secret-ensure-job.yaml
View File

@ -1,12 +1,12 @@
# services/keycloak/oneoffs/veles-gitea-oidc-secret-ensure-job.yaml # services/keycloak/oneoffs/veles-gitea-oidc-secret-ensure-job.yaml
# One-off job for sso/veles-gitea-oidc-secret-ensure-1. # One-off job for sso/veles-gitea-oidc-secret-ensure-2.
# Purpose: create/update the Veles realm Gitea OIDC client and write the # Purpose: create/update the Veles realm Gitea OIDC client and write the
# matching Gitea auth-source secret to Vault. # matching Gitea auth-source secret to Vault.
# Keep suspended until the Vault policy change has reconciled, then unsuspend once. # Keep suspended until the Vault policy change has reconciled, then unsuspend once.
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:
name: veles-gitea-oidc-secret-ensure-1 name: veles-gitea-oidc-secret-ensure-2
namespace: sso namespace: sso
spec: spec:
suspend: true suspend: true

2
services/keycloak/scripts/veles_gitea_oidc_secret_ensure.sh
View File

@ -157,7 +157,7 @@ client_payload="$(jq -nc \
--arg client_id "${CLIENT_ID}" \ --arg client_id "${CLIENT_ID}" \
--arg root_url "${PUBLIC_BASE_URL}" \ --arg root_url "${PUBLIC_BASE_URL}" \
--arg callback "${PUBLIC_BASE_URL}/user/oauth2/${AUTH_SOURCE_NAME}/callback" \ --arg callback "${PUBLIC_BASE_URL}/user/oauth2/${AUTH_SOURCE_NAME}/callback" \
'{clientId:$client_id,enabled:true,protocol:"openid-connect",publicClient:false,standardFlowEnabled:true,implicitFlowEnabled:false,directAccessGrantsEnabled:false,serviceAccountsEnabled:false,redirectUris:[$callback],webOrigins:[$root_url],rootUrl:$root_url,baseUrl:"/",attributes:{"pkce.code.challenge.method":"S256","post.logout.redirect.uris":($root_url + "/*")}}')" '{clientId:$client_id,enabled:true,protocol:"openid-connect",publicClient:false,standardFlowEnabled:true,implicitFlowEnabled:false,directAccessGrantsEnabled:false,serviceAccountsEnabled:false,redirectUris:[$callback],webOrigins:[$root_url],rootUrl:$root_url,baseUrl:"/",attributes:{"post.logout.redirect.uris":($root_url + "/*")}}')"
if [ -z "$CLIENT_UUID" ] || [ "$CLIENT_UUID" = "null" ]; then if [ -z "$CLIENT_UUID" ] || [ "$CLIENT_UUID" = "null" ]; then
status="$(curl -sS -o /tmp/keycloak-client-create.json -w "%{http_code}" -X POST \ status="$(curl -sS -o /tmp/keycloak-client-create.json -w "%{http_code}" -X POST \