Commit d43ffe48 authored by Dimitrios Gogos's avatar Dimitrios Gogos
Browse files

feat: update Keycloak admin user setup to require new password and email on first login

parent 9eea2bd4

README.md

+2 −1
Changes for README.md: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -111,7 +111,8 @@ Keycloak (`charts/keycloak`) runs as a platform service in `oop`, backed by the 
  Logged-in users change their own password through the portal (`kc_action=UPDATE_PASSWORD`).

- Every install creates a first `platform-admin` user, `oop-admin`, so someone can log in and manage

  users on a cluster without sample users. Its password is generated into `keycloak-credentials` →

  `initial-admin-password` and is temporary: the first login asks for a new one. Turn it off with

  `initial-admin-password` and is temporary: the first login asks for a new password, and for an email

  address since it has none. Turn it off with

  `keycloak.realms.oop.initialAdmin.enabled: false`.

- The admin password and the `oop-portal` client secret are generated on first install into Secret

  `keycloak-credentials`, which is kept on `helm uninstall` because the realms keep using them. Pin them

oop-platform-chart/Chart.lock

+2 −2
Changes for oop-platform-chart/Chart.lock: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -23,5 +23,5 @@ dependencies: 
- name: nats

  repository: https://nats-io.github.io/k8s/helm/charts/

  version: 1.2.10

digest: sha256:7138b0459ac2999c638b9090e83bc096c518e88ebde0f8f8b8d9132802e61e32

generated: "2026-09-12T21:40:09.436761398+03:00"
 
digest: sha256:7ca197be9b2d2b7c7826398016c8cc6628a968fcbfc077e46b1cca48d29f5863

generated: "2026-09-14T16:53:21.241543984+03:00"

oop-platform-chart/charts/keycloak/README.md

+1 −1
Changes for oop-platform-chart/charts/keycloak/README.md: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -167,7 +167,7 @@ organization's job ([section 9](#9-organizations-and-tenants)). 


| User | When | Roles | Password |

|---|---|---|---|

| `oop-admin` | Every install (turn off with `realms.oop.initialAdmin.enabled: false`) | `app-provider`, `platform-admin` | Generated, **temporary**: the first login asks for a new one. |

| `oop-admin` | Every install (turn off with `realms.oop.initialAdmin.enabled: false`) | `app-provider`, `platform-admin` | Generated, **temporary**: the first login asks for a new password, and for an email address since it has none. |

| `dev-provider`, `dev-operator`, `dev-admin` | Only when `realms.oop.sampleUsers.enabled: true` (the kind environment turns this on) | one per role | One shared generated password. All three are in organization `dev-org`. |



Sample users have a shared, well-known-to-the-team password, so the chart **refuses to render** them

oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml

+1 −0
Changes for oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -160,6 +160,7 @@ data: 
          "firstName": "Platform",

          "lastName": "Admin",

          "credentials": [ { "type": "password", "value": "${INITIAL_ADMIN_PASSWORD}", "temporary": true } ],

          "requiredActions": ["UPDATE_PASSWORD"],

          "realmRoles": ["default-roles-oop", "platform-admin"]

        }

        {{- end }}

oop-platform-chart/charts/keycloak/values.yaml

+1 −1
Changes for oop-platform-chart/charts/keycloak/values.yaml: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -88,7 +88,7 @@ realms: 
    # First platform-admin user, created on every install so someone can log in and manage

    # users (the sample users below only exist on local environments). Its password is

    # generated into the credentials Secret as initial-admin-password and is temporary:

    # the first login asks for a new one.

    # the first login asks for a new password, and for an email address since it has none.

    initialAdmin:

      enabled: true

      username: oop-admin