Commit f53a7673 authored by Dimitrios Gogos's avatar Dimitrios Gogos
Browse files

feat: refine descriptions in Keycloak realm roles and API product management

parent e6da0e5b

README.md

+1 −1
Changes for README.md: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ Keycloak (`charts/keycloak`) runs as a platform service in `oop`, backed by the 
| `oop` | Portal users, app providers, OEG | `oop-portal` (confidential, Auth Code + PKCE), `oeg` (audience only) |

| `federation` | FM, partner OPs (ADR-0042) | `originating-op-1`, `originating-op-2` (client credentials, scope `fed-mgmt`; `fed-mgmt-notif` optional, for callbacks) |



- Realm roles in `oop` (ADR-0048): `app-provider` (developers; given to every new user, including

- Realm roles in `oop`: `app-provider` (developers; given to every new user, including

  self-registered ones), `operator` (runs the platform) and `platform-admin` (manages users). None

  implies another; one person can hold several.

- Client `oop-portal-admin` is the portal backend's user-management account: its service account holds

oop-platform-chart/charts/keycloak/README.md

+0 −1
Changes for oop-platform-chart/charts/keycloak/README.md: 0 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -146,7 +146,6 @@ Where things are defined: 
| `platform-admin` | A few trusted people. | Manage users through the Portal: reset passwords, grant and remove roles. |



No role includes another. One person can hold several (for example `operator` and `platform-admin`).

The source of this model is ADR-0048.



Roles say **what** someone may do. They do not say **whose data** they may see; that is the

organization's job ([section 9](#9-organizations-and-tenants)).

oop-platform-chart/charts/keycloak/files/realm-setup.py

+2 −2
Changes for oop-platform-chart/charts/keycloak/files/realm-setup.py: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line 
"""Finishes realm oop after Keycloak imported it from this chart (ADR-0048).

"""Finishes realm oop after Keycloak imported it from this chart.



The import cannot create the provisioner's fine-grained permissions or change Keycloak's

registration policies, and never runs again, so a product added to global.apiProducts later
@@ -110,7 +110,7 @@ def ensure_product_roles(kc: Keycloak, oeg: str, cfg: dict) -> None: 
        if product["name"] in have:

            say("ok", f"role {product['name']}")

            continue

        description = f"API product {product['name']} (ADR-0048)"

        description = f"API product {product['name']}"

        kc.call(

            "POST", f"/clients/{oeg}/roles", {"name": product["name"], "description": description}

        )

oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml

+4 −4
Changes for oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml: 4 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -56,7 +56,7 @@ data: 
        "realm": [

          { "name": "app-provider", "description": "Calls CAMARA/TMF APIs, registers apps, sees own operations" },

          { "name": "operator", "description": "Manages catalog, zones, domains and federation; sees all operations" },

          { "name": "platform-admin", "description": "Manages users through the portal: resets passwords, grants and revokes roles (ADR-0048)" },

          { "name": "platform-admin", "description": "Manages users through the portal: resets passwords, grants and revokes roles" },

          { "name": "offline_access", "description": "Offline access" },

          { "name": "uma_authorization", "description": "UMA authorization" },

          {
@@ -73,7 +73,7 @@ data: 
          "oeg": [

            {{- range $i, $product := $apiProducts }}

            {{- if $i }},{{ end }}

            { "name": {{ $product.name | toJson }}, "description": {{ printf "API product %s (ADR-0048)" $product.name | toJson }} }

            { "name": {{ $product.name | toJson }}, "description": {{ printf "API product %s" $product.name | toJson }} }

            {{- end }}

          ]

        }
@@ -196,7 +196,7 @@ data: 
        {

          "clientId": {{ .portalAdmin.clientId | toJson }},

          "name": "OOP Portal user management",

          "description": "Service account for the portal backend's user-management pages (ADR-0048); no login flows.",

          "description": "Service account for the portal backend's user-management pages; no login flows.",

          "enabled": true,

          "protocol": "openid-connect",

          "publicClient": false,
@@ -210,7 +210,7 @@ data: 
        {

          "clientId": {{ .provisioner.clientId | toJson }},

          "name": "OOP Portal API client provisioning",

          "description": "Service account for creating API clients (ADR-0048); no login flows.",

          "description": "Service account for creating API clients; no login flows.",

          "enabled": true,

          "protocol": "openid-connect",

          "publicClient": false,