124 lines
4.6 KiB
Bash
Executable File
124 lines
4.6 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
. /vault/secrets/keycloak-admin-env.sh
|
|
|
|
CLIENT_NAME="hermes-dashboard"
|
|
PUBLIC_URL="https://agent.bstein.dev"
|
|
KC_URL="http://keycloak.sso.svc.cluster.local"
|
|
|
|
ACCESS_TOKEN=""
|
|
for attempt in 1 2 3 4 5 6 7 8 9 10; do
|
|
if curl -fsS "${KC_URL}/realms/master" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
echo "Waiting for Keycloak to be reachable (attempt ${attempt})" >&2
|
|
sleep $((attempt * 2))
|
|
done
|
|
|
|
for attempt in 1 2 3 4 5; do
|
|
TOKEN_JSON="$(curl -sS -X POST "$KC_URL/realms/master/protocol/openid-connect/token" \
|
|
-H 'Content-Type: application/x-www-form-urlencoded' \
|
|
-d "grant_type=password" \
|
|
-d "client_id=admin-cli" \
|
|
-d "username=${KEYCLOAK_ADMIN}" \
|
|
-d "password=${KEYCLOAK_ADMIN_PASSWORD}" || true)"
|
|
ACCESS_TOKEN="$(echo "$TOKEN_JSON" | jq -r '.access_token' 2>/dev/null || true)"
|
|
if [ -n "$ACCESS_TOKEN" ] && [ "$ACCESS_TOKEN" != "null" ]; then
|
|
break
|
|
fi
|
|
echo "Keycloak token request failed (attempt ${attempt})" >&2
|
|
sleep $((attempt * 2))
|
|
done
|
|
if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
|
|
echo "Failed to fetch Keycloak admin token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
client_payload="$(jq -nc \
|
|
--arg client_id "${CLIENT_NAME}" \
|
|
--arg redirect_uri "${PUBLIC_URL}/auth/callback" \
|
|
--arg web_origin "${PUBLIC_URL}" \
|
|
'{
|
|
clientId:$client_id,
|
|
enabled:true,
|
|
protocol:"openid-connect",
|
|
publicClient:true,
|
|
standardFlowEnabled:true,
|
|
implicitFlowEnabled:false,
|
|
directAccessGrantsEnabled:false,
|
|
serviceAccountsEnabled:false,
|
|
redirectUris:[$redirect_uri],
|
|
webOrigins:[$web_origin],
|
|
rootUrl:$web_origin,
|
|
baseUrl:"/",
|
|
attributes:{
|
|
"pkce.code.challenge.method":"S256",
|
|
"post.logout.redirect.uris":$web_origin
|
|
}
|
|
}')"
|
|
|
|
CLIENT_QUERY="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients?clientId=${CLIENT_NAME}" || true)"
|
|
CLIENT_ID="$(echo "$CLIENT_QUERY" | jq -r '.[0].id' 2>/dev/null || true)"
|
|
|
|
if [ -z "$CLIENT_ID" ] || [ "$CLIENT_ID" = "null" ]; then
|
|
status="$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
|
|
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "${client_payload}" \
|
|
"$KC_URL/admin/realms/atlas/clients")"
|
|
if [ "$status" != "201" ] && [ "$status" != "204" ] && [ "$status" != "409" ]; then
|
|
echo "Keycloak client create failed (status ${status})" >&2
|
|
exit 1
|
|
fi
|
|
CLIENT_QUERY="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients?clientId=${CLIENT_NAME}" || true)"
|
|
CLIENT_ID="$(echo "$CLIENT_QUERY" | jq -r '.[0].id' 2>/dev/null || true)"
|
|
fi
|
|
|
|
if [ -z "$CLIENT_ID" ] || [ "$CLIENT_ID" = "null" ]; then
|
|
echo "Keycloak client ${CLIENT_NAME} not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
status="$(curl -sS -o /dev/null -w "%{http_code}" -X PUT \
|
|
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "${client_payload}" \
|
|
"$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}")"
|
|
if [ "$status" != "204" ]; then
|
|
echo "Keycloak client update failed (status ${status})" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SCOPE_ID="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/client-scopes?search=groups" | jq -r '.[] | select(.name=="groups") | .id' 2>/dev/null | head -n1 || true)"
|
|
if [ -z "$SCOPE_ID" ] || [ "$SCOPE_ID" = "null" ]; then
|
|
echo "Keycloak client scope groups not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
DEFAULT_SCOPES="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/default-client-scopes" || true)"
|
|
OPTIONAL_SCOPES="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes" || true)"
|
|
|
|
if ! echo "$DEFAULT_SCOPES" | jq -e '.[] | select(.name=="groups")' >/dev/null 2>&1 \
|
|
&& ! echo "$OPTIONAL_SCOPES" | jq -e '.[] | select(.name=="groups")' >/dev/null 2>&1; then
|
|
status="$(curl -sS -o /dev/null -w "%{http_code}" -X PUT \
|
|
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes/${SCOPE_ID}")"
|
|
if [ "$status" != "200" ] && [ "$status" != "201" ] && [ "$status" != "204" ]; then
|
|
status="$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
|
|
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
|
"$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes/${SCOPE_ID}")"
|
|
if [ "$status" != "200" ] && [ "$status" != "201" ] && [ "$status" != "204" ]; then
|
|
echo "Failed to attach groups client scope to ${CLIENT_NAME} (status ${status})" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
echo "Hermes dashboard OIDC client ready"
|