{
  "clients": [
    {
      "clientId": "petrolyst",
      "name": "Petrolyst administration",
      "description": "Superset and the Traefik dashboard (oauth2-proxy), for our own people, with MFA (browser flow override petrolyst-mfa, set by hand). Managed from petrolyst-infra/keycloak/.",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "clientAuthenticatorType": "client-secret",
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
      "frontchannelLogout": true,
      "baseUrl": "https://app.petrolyst.com/",
      "redirectUris": [
        "https://app.petrolyst.com/oauth-authorized/keycloak",
        "https://traefik.petrolyst.com/oauth2/callback"
      ],
      "webOrigins": ["+"],
      "attributes": {
        "pkce.code.challenge.method": "S256",
        "post.logout.redirect.uris": "https://app.petrolyst.com/*##https://traefik.petrolyst.com/*"
      },
      "protocolMappers": [
        {
          "name": "petrolyst client roles",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-client-role-mapper",
          "consentRequired": false,
          "config": {
            "usermodel.clientRoleMapping.clientId": "petrolyst",
            "multivalued": "true",
            "claim.name": "petrolyst_roles",
            "jsonType.label": "String",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "userinfo.token.claim": "true",
            "introspection.token.claim": "true"
          }
        }
      ]
    },
    {
      "clientId": "petrolyst-app",
      "name": "Petrolyst",
      "description": "The Petrolyst app (petrolyst-platform server/), for customers' users. Password only (PD-21). The customer comes from the person's top-level group. Managed from petrolyst-infra/keycloak/.",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "clientAuthenticatorType": "client-secret",
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
      "frontchannelLogout": true,
      "baseUrl": "https://app.petrolyst.com/app/",
      "redirectUris": [
        "https://app.petrolyst.com/app/auth/callback"
      ],
      "webOrigins": [],
      "attributes": {
        "pkce.code.challenge.method": "S256",
        "post.logout.redirect.uris": "https://app.petrolyst.com/app/*"
      },
      "protocolMappers": [
        {
          "name": "petrolyst client roles",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-client-role-mapper",
          "consentRequired": false,
          "config": {
            "usermodel.clientRoleMapping.clientId": "petrolyst-app",
            "multivalued": "true",
            "claim.name": "petrolyst_roles",
            "jsonType.label": "String",
            "id.token.claim": "true",
            "access.token.claim": "false",
            "userinfo.token.claim": "false",
            "introspection.token.claim": "false"
          }
        },
        {
          "name": "petrolyst groups",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-group-membership-mapper",
          "consentRequired": false,
          "config": {
            "full.path": "true",
            "claim.name": "petrolyst_groups",
            "id.token.claim": "true",
            "access.token.claim": "false",
            "userinfo.token.claim": "false",
            "introspection.token.claim": "false"
          }
        }
      ]
    }
  ],
  "roles": {
    "client": {
      "petrolyst": [
        { "name": "superset-admin", "description": "Superset Admin" },
        { "name": "superset-editor", "description": "Superset Alpha: build charts and dashboards" },
        { "name": "superset-viewer", "description": "Superset Gamma: view dashboards shared with the role" },
        { "name": "traefik-admin", "description": "Traefik dashboard at traefik.petrolyst.com" }
      ],
      "petrolyst-app": [
        { "name": "reader", "description": "Reads their customer's data in the Petrolyst app; no role in Superset. Mapped onto each customer's group." }
      ]
    }
  }
}