Nasim SadatandClaude Opus 5.5
78a498f1ce
Keycloak import for realm petrolyst: two clients, petrolyst with MFA for Superset and Traefik, petrolyst-app password only. It lists only app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this repository is public. public.v_operator shows each customer's group. Dashboards overview and site, role Petrolyst Guest, filtered by row. Superset refuses a user with no mapped role. The realm travels with the release: each release's compose files name their realm and secret file, and a rollback needs only its target's secret. Not deployed. Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards import twice, column drift 0, compose config on old and new trees, the secret check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real deploy or rollback; shellcheck not installed today, clean when last run. Codex inspected once; its fixes are not re-inspected, on the owner's word. Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
115 lines
4.2 KiB
JSON
115 lines
4.2 KiB
JSON
{
|
|
"clients": [
|
|
{
|
|
"clientId": "petrolyst",
|
|
"name": "Petrolyst administration",
|
|
"description": "Superset and the Traefik dashboard (oauth2-proxy), for our own people, with MFA (browser flow override petrolyst-mfa, set by hand). Managed from petrolyst-infra/keycloak/.",
|
|
"enabled": true,
|
|
"protocol": "openid-connect",
|
|
"publicClient": false,
|
|
"clientAuthenticatorType": "client-secret",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"baseUrl": "https://app.petrolyst.com/",
|
|
"redirectUris": [
|
|
"https://app.petrolyst.com/oauth-authorized/keycloak",
|
|
"https://traefik.petrolyst.com/oauth2/callback"
|
|
],
|
|
"webOrigins": ["+"],
|
|
"attributes": {
|
|
"pkce.code.challenge.method": "S256",
|
|
"post.logout.redirect.uris": "https://app.petrolyst.com/*##https://traefik.petrolyst.com/*"
|
|
},
|
|
"protocolMappers": [
|
|
{
|
|
"name": "petrolyst client roles",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-client-role-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"usermodel.clientRoleMapping.clientId": "petrolyst",
|
|
"multivalued": "true",
|
|
"claim.name": "petrolyst_roles",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "true",
|
|
"introspection.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"clientId": "petrolyst-app",
|
|
"name": "Petrolyst",
|
|
"description": "The Petrolyst app (petrolyst-platform server/), for customers' users. Password only (PD-21). The customer comes from the person's top-level group. Managed from petrolyst-infra/keycloak/.",
|
|
"enabled": true,
|
|
"protocol": "openid-connect",
|
|
"publicClient": false,
|
|
"clientAuthenticatorType": "client-secret",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"baseUrl": "https://app.petrolyst.com/app/",
|
|
"redirectUris": [
|
|
"https://app.petrolyst.com/app/auth/callback"
|
|
],
|
|
"webOrigins": [],
|
|
"attributes": {
|
|
"pkce.code.challenge.method": "S256",
|
|
"post.logout.redirect.uris": "https://app.petrolyst.com/app/*"
|
|
},
|
|
"protocolMappers": [
|
|
{
|
|
"name": "petrolyst client roles",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-client-role-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"usermodel.clientRoleMapping.clientId": "petrolyst-app",
|
|
"multivalued": "true",
|
|
"claim.name": "petrolyst_roles",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "false",
|
|
"userinfo.token.claim": "false",
|
|
"introspection.token.claim": "false"
|
|
}
|
|
},
|
|
{
|
|
"name": "petrolyst groups",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-group-membership-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"full.path": "true",
|
|
"claim.name": "petrolyst_groups",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "false",
|
|
"userinfo.token.claim": "false",
|
|
"introspection.token.claim": "false"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"roles": {
|
|
"client": {
|
|
"petrolyst": [
|
|
{ "name": "superset-admin", "description": "Superset Admin" },
|
|
{ "name": "superset-editor", "description": "Superset Alpha: build charts and dashboards" },
|
|
{ "name": "superset-viewer", "description": "Superset Gamma: view dashboards shared with the role" },
|
|
{ "name": "traefik-admin", "description": "Traefik dashboard at traefik.petrolyst.com" }
|
|
],
|
|
"petrolyst-app": [
|
|
{ "name": "reader", "description": "Reads their customer's data in the Petrolyst app; no role in Superset. Mapped onto each customer's group." }
|
|
]
|
|
}
|
|
}
|
|
}
|