autonomic-bot
f283a371bb
Sanitized single-commit public mirror of recipe-maintainer. - Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders. - Removed plans/ and planned-updates/ (deployment-planning docs) so no client/ deployment domains appear in the public repo. - All other secret stores were already gitignored. - docs.coopcloud.tech retained as a submodule (public upstream).
117 lines
4.3 KiB
Python
117 lines
4.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Setup Keycloak OIDC integration for La Suite Meet.
|
|
|
|
Creates a Keycloak realm, OIDC client, and two test users, then inserts
|
|
the client secret and updates the Meet env file with OIDC settings.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
|
|
|
|
from lib.abra import app_secret_insert
|
|
from lib.env import apply_env_overrides, get_abra_env_path, read_env_file
|
|
from lib.keycloak import KeycloakAdmin
|
|
from lib.models import load_default_instance
|
|
from lib.secrets import load_secrets
|
|
|
|
# Configuration
|
|
REALM = "lasuite-meet"
|
|
CLIENT_ID = "meet"
|
|
TEST_USER = "testuser"
|
|
TEST_PASS = "testpass123"
|
|
TEST_EMAIL = f"{TEST_USER}@test.example.com"
|
|
TEST_USER2 = "testuser2"
|
|
TEST_PASS2 = "testpass456"
|
|
TEST_EMAIL2 = f"{TEST_USER2}@test.example.com"
|
|
|
|
|
|
def main():
|
|
inst = load_default_instance()
|
|
meet_domain = inst.default_domain("lasuite-meet")
|
|
kc_domain = inst.default_domain("keycloak")
|
|
|
|
# Get Keycloak admin password from synced secrets
|
|
kc_secrets = load_secrets(kc_domain)
|
|
kc_admin_pass = kc_secrets["admin_password"]
|
|
|
|
kc = KeycloakAdmin(f"https://{kc_domain}", "admin", kc_admin_pass)
|
|
|
|
# Step 1: Create realm
|
|
kc.ensure_realm(REALM)
|
|
|
|
# Step 2: Create OIDC client
|
|
_, client_secret = kc.ensure_client(
|
|
REALM, CLIENT_ID,
|
|
redirect_uris=[f"https://{meet_domain}/*"],
|
|
web_origins=[f"https://{meet_domain}"],
|
|
)
|
|
|
|
# Step 3: Create test users
|
|
kc.ensure_user(REALM, TEST_USER, TEST_EMAIL, TEST_PASS)
|
|
kc.ensure_user(REALM, TEST_USER2, TEST_EMAIL2, TEST_PASS2,
|
|
last_name="User Two")
|
|
|
|
# Step 4: Insert client secret via abra
|
|
print("=== Insert OIDC client secret into Meet ===", flush=True)
|
|
env_path = get_abra_env_path(inst.server, meet_domain)
|
|
env_data = read_env_file(env_path)
|
|
current_version = env_data.get("SECRET_OIDC_RPCS_VERSION", "v1")
|
|
next_num = int(current_version.lstrip("v")) + 1
|
|
next_version = f"v{next_num}"
|
|
print(f" Current secret version: {current_version}", flush=True)
|
|
print(f" Inserting as: {next_version}", flush=True)
|
|
app_secret_insert(meet_domain, "oidc_rpcs", next_version, client_secret)
|
|
|
|
# Step 5: Update Meet env with OIDC settings
|
|
print("=== Update Meet OIDC settings in env file ===", flush=True)
|
|
apply_env_overrides(env_path, {
|
|
"SECRET_OIDC_RPCS_VERSION": next_version,
|
|
"OIDC_REALM": REALM,
|
|
"AUTH_DOMAIN": kc_domain,
|
|
"OIDC_RP_CLIENT_ID": CLIENT_ID,
|
|
})
|
|
|
|
# Step 6: Write credentials file
|
|
script_dir = os.path.dirname(os.path.abspath(__file__))
|
|
creds_file = os.path.join(script_dir, f"keycloak-test-credentials.{inst.domain_suffix}.toml")
|
|
print(f"=== Write credentials to {creds_file} ===", flush=True)
|
|
with open(creds_file, "w") as f:
|
|
f.write(f'# Keycloak OIDC credentials for lasuite-meet test instance\n')
|
|
f.write(f'#\n')
|
|
f.write(f'# Keycloak instance: {kc_domain}\n')
|
|
f.write(f'# Realm: {REALM}\n')
|
|
f.write(f'# Created by: setup_keycloak_integration.py\n')
|
|
f.write(f'\n')
|
|
f.write(f'# Keycloak admin (master realm)\n')
|
|
f.write(f'kc_admin_user = "admin"\n')
|
|
f.write(f'kc_admin_pass = "{kc_admin_pass}"\n')
|
|
f.write(f'\n')
|
|
f.write(f'# OIDC client\n')
|
|
f.write(f'kc_realm = "{REALM}"\n')
|
|
f.write(f'kc_client_id = "{CLIENT_ID}"\n')
|
|
f.write(f'kc_client_secret = "{client_secret}"\n')
|
|
f.write(f'\n')
|
|
f.write(f'# Test user 1 (in {REALM} realm)\n')
|
|
f.write(f'kc_test_user = "{TEST_USER}"\n')
|
|
f.write(f'kc_test_pass = "{TEST_PASS}"\n')
|
|
f.write(f'kc_test_email = "{TEST_EMAIL}"\n')
|
|
f.write(f'\n')
|
|
f.write(f'# Test user 2 (in {REALM} realm)\n')
|
|
f.write(f'kc_test_user2 = "{TEST_USER2}"\n')
|
|
f.write(f'kc_test_pass2 = "{TEST_PASS2}"\n')
|
|
f.write(f'kc_test_email2 = "{TEST_EMAIL2}"\n')
|
|
print(f" Written to {creds_file}", flush=True)
|
|
|
|
print("", flush=True)
|
|
print("=== Keycloak integration setup complete ===", flush=True)
|
|
print("", flush=True)
|
|
print("Next steps:", flush=True)
|
|
print(f" 1. Redeploy Meet: abra app deploy {meet_domain} --chaos --force --no-input", flush=True)
|
|
print(f" 2. Run OIDC test: python3 recipe-info/lasuite-meet/tests/oidc_login.py", flush=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|