feat: add built-in Keycloak scopes for OpenID Connect to enhance client scope management (2f61a707) · Commits · OOP / deploy / helm

oop-platform-chart/charts/keycloak/files/keycloak-builtin-scopes.json

0 → 100644

+584 −0

Changes for oop-platform-chart/charts/keycloak/files/keycloak-builtin-scopes.json: 584 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		[
		{
		"name": "profile",
		"description": "OpenID Connect built-in scope: profile",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"consent.screen.text": "${profileScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "zoneinfo",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "zoneinfo",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "zoneinfo",
		"jsonType.label": "String"
		}
		},
		{
		"name": "username",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "username",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "preferred_username",
		"jsonType.label": "String"
		}
		},
		{
		"name": "birthdate",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "birthdate",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "birthdate",
		"jsonType.label": "String"
		}
		},
		{
		"name": "middle name",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "middleName",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "middle_name",
		"jsonType.label": "String"
		}
		},
		{
		"name": "family name",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "lastName",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "family_name",
		"jsonType.label": "String"
		}
		},
		{
		"name": "locale",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "locale",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "locale",
		"jsonType.label": "String"
		}
		},
		{
		"name": "given name",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "firstName",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "given_name",
		"jsonType.label": "String"
		}
		},
		{
		"name": "nickname",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "nickname",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "nickname",
		"jsonType.label": "String"
		}
		},
		{
		"name": "website",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "website",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "website",
		"jsonType.label": "String"
		}
		},
		{
		"name": "updated at",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "updatedAt",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "updated_at",
		"jsonType.label": "long"
		}
		},
		{
		"name": "full name",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-full-name-mapper",
		"consentRequired": false,
		"config": {
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"userinfo.token.claim": "true"
		}
		},
		{
		"name": "gender",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "gender",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "gender",
		"jsonType.label": "String"
		}
		},
		{
		"name": "picture",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "picture",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "picture",
		"jsonType.label": "String"
		}
		},
		{
		"name": "profile",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "profile",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "profile",
		"jsonType.label": "String"
		}
		}
		]
		},
		{
		"name": "email",
		"description": "OpenID Connect built-in scope: email",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"consent.screen.text": "${emailScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "email verified",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-property-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "emailVerified",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "email_verified",
		"jsonType.label": "boolean"
		}
		},
		{
		"name": "email",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "email",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "email",
		"jsonType.label": "String"
		}
		}
		]
		},
		{
		"name": "roles",
		"description": "OpenID Connect scope for add user roles to the access token",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "false",
		"consent.screen.text": "${rolesScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "audience resolve",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-audience-resolve-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"access.token.claim": "true"
		}
		},
		{
		"name": "realm roles",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-realm-role-mapper",
		"consentRequired": false,
		"config": {
		"user.attribute": "foo",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "realm_access.roles",
		"jsonType.label": "String",
		"multivalued": "true"
		}
		},
		{
		"name": "client roles",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-client-role-mapper",
		"consentRequired": false,
		"config": {
		"user.attribute": "foo",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "resource_access.${client_id}.roles",
		"jsonType.label": "String",
		"multivalued": "true"
		}
		}
		]
		},
		{
		"name": "web-origins",
		"description": "OpenID Connect scope for add allowed web origins to the access token",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "false",
		"consent.screen.text": "",
		"display.on.consent.screen": "false"
		},
		"protocolMappers": [
		{
		"name": "allowed web origins",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-allowed-origins-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"access.token.claim": "true"
		}
		}
		]
		},
		{
		"name": "acr",
		"description": "OpenID Connect scope for add acr (authentication context class reference) to the token",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "false",
		"display.on.consent.screen": "false"
		},
		"protocolMappers": [
		{
		"name": "acr loa level",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-acr-mapper",
		"consentRequired": false,
		"config": {
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true"
		}
		}
		]
		},
		{
		"name": "basic",
		"description": "OpenID Connect scope for add all basic claims to the token",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "false",
		"display.on.consent.screen": "false"
		},
		"protocolMappers": [
		{
		"name": "sub",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-sub-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"access.token.claim": "true"
		}
		},
		{
		"name": "auth_time",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usersessionmodel-note-mapper",
		"consentRequired": false,
		"config": {
		"user.session.note": "AUTH_TIME",
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "auth_time",
		"jsonType.label": "long"
		}
		}
		]
		},
		{
		"name": "address",
		"description": "OpenID Connect built-in scope: address",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"consent.screen.text": "${addressScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "address",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-address-mapper",
		"consentRequired": false,
		"config": {
		"user.attribute.formatted": "formatted",
		"user.attribute.country": "country",
		"introspection.token.claim": "true",
		"user.attribute.postal_code": "postal_code",
		"userinfo.token.claim": "true",
		"user.attribute.street": "street",
		"id.token.claim": "true",
		"user.attribute.region": "region",
		"access.token.claim": "true",
		"user.attribute.locality": "locality"
		}
		}
		]
		},
		{
		"name": "phone",
		"description": "OpenID Connect built-in scope: phone",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"consent.screen.text": "${phoneScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "phone number",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "phoneNumber",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "phone_number",
		"jsonType.label": "String"
		}
		},
		{
		"name": "phone number verified",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "phoneNumberVerified",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "phone_number_verified",
		"jsonType.label": "boolean"
		}
		}
		]
		},
		{
		"name": "microprofile-jwt",
		"description": "Microprofile - JWT built-in scope",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"display.on.consent.screen": "false"
		},
		"protocolMappers": [
		{
		"name": "groups",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-realm-role-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"multivalued": "true",
		"user.attribute": "foo",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "groups",
		"jsonType.label": "String"
		}
		},
		{
		"name": "upn",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usermodel-attribute-mapper",
		"consentRequired": false,
		"config": {
		"introspection.token.claim": "true",
		"userinfo.token.claim": "true",
		"user.attribute": "username",
		"id.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "upn",
		"jsonType.label": "String"
		}
		}
		]
		},
		{
		"name": "organization",
		"description": "Additional claims about the organization a subject belongs to",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "true",
		"consent.screen.text": "${organizationScopeConsentText}",
		"display.on.consent.screen": "true"
		},
		"protocolMappers": [
		{
		"name": "organization",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-organization-membership-mapper",
		"consentRequired": false,
		"config": {
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "organization",
		"jsonType.label": "String",
		"multivalued": "true"
		}
		}
		]
		},
		{
		"name": "service_account",
		"description": "Specific scope for a client enabled for service accounts",
		"protocol": "openid-connect",
		"attributes": {
		"include.in.token.scope": "false",
		"display.on.consent.screen": "false"
		},
		"protocolMappers": [
		{
		"name": "Client ID",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usersessionmodel-note-mapper",
		"consentRequired": false,
		"config": {
		"user.session.note": "client_id",
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "client_id",
		"jsonType.label": "String"
		}
		},
		{
		"name": "Client IP Address",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usersessionmodel-note-mapper",
		"consentRequired": false,
		"config": {
		"user.session.note": "clientAddress",
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "clientAddress",
		"jsonType.label": "String"
		}
		},
		{
		"name": "Client Host",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-usersessionmodel-note-mapper",
		"consentRequired": false,
		"config": {
		"user.session.note": "clientHost",
		"id.token.claim": "true",
		"introspection.token.claim": "true",
		"access.token.claim": "true",
		"claim.name": "clientHost",
		"jsonType.label": "String"
		}
		}
		]
		}
		]

oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml

+11 −2

Changes for oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml: 11 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -85,13 +85,22 @@ data:
		*/ -}}
		{{- $camaraScopes := $.Files.Get "files/camara-scopes.yaml" \| fromYamlArray }}
		{{- $camaraScopeNames := list }}
		{{- /*
		A realm import that lists clientScopes gets none of Keycloak's built-ins (profile,
		email, roles, ...), so they are listed too, as exported from Keycloak 26.7.3.
		*/ -}}
		"clientScopes": [
		{{- range (($.Files.Get "files/keycloak-builtin-scopes.json" \| fromJsonArray)) }}
		{{ toJson . }},
		{{- end }}
		{{- range $i, $sc := $camaraScopes }}
		{{- $camaraScopeNames = append $camaraScopeNames $sc.name }}
		{{- if $i }},{{ end }}
		{ "name": {{ $sc.name \| toJson }}, "protocol": "openid-connect", "description": {{ $sc.description \| toJson }} }
		{{- end }}
		],
		"defaultDefaultClientScopes": ["profile", "email", "roles", "web-origins", "acr", "basic"],
		"defaultOptionalClientScopes": ["offline_access", "address", "phone", "microprofile-jwt", "organization"],
		"clients": [
		{
		"clientId": {{ .portal.clientId \| toJson }},
		@@ -113,8 +122,8 @@ data:
		"post.logout.redirect.uris": {{ printf "%s/*" $portalUrl \| toJson }}
		},
		{{- /*
		Explicit, not omitted: Keycloak's own built-ins (web-origins/acr/profile/roles/
		basic/email) are listed here alongside the CAMARA scopes above so this list is
		Explicit, not omitted: the built-ins (web-origins/acr/profile/roles/basic/email)
		defined above are listed here alongside the CAMARA scopes so this list is
		additive, not a silent replacement -- dropping "roles" here would break every
		role check in the platform (realm_access.roles would stop being issued).
		*/ -}}