Skip to content

Commit cf3de77

Browse files
dougkirkleydougkirkley
committed
feat: Add ability to add Permissions to KeycloakRealmIdentityProvider
Signed-off-by: Douglass Kirkley <doug.kirkley@gmail.com>
1 parent 86424d4 commit cf3de77

17 files changed

+864
-101
lines changed

‎api/v1/keycloakrealmidentityprovider_types.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,17 @@ type KeycloakRealmIdentityProviderSpec struct {
5959
// +nullable
6060
// +optional
6161
Mappers []IdentityProviderMapper `json:"mappers,omitempty"`
62+
63+
// AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider.
64+
// Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
65+
// Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.
66+
// +optional
67+
AdminFineGrainedPermissionsEnabled bool `json:"adminFineGrainedPermissionsEnabled,omitempty"`
68+
69+
// Permission is a identity provider permissions configuration
70+
// +nullable
71+
// +optional
72+
Permission *AdminFineGrainedPermission `json:"permission,omitempty"`
6273
}
6374

6475
type IdentityProviderMapper struct {

‎api/v1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func main() {
308308
os.Exit(1)
309309
}
310310

311-
if err = keycloakrealmidentityprovider.NewReconcile(mgr.GetClient(), h, secretref.NewSecretRef(mgr.GetClient())).
311+
if err = keycloakrealmidentityprovider.NewReconcile(mgr.GetClient(), h).
312312
SetupWithManager(mgr, successReconcileTimeoutValue); err != nil {
313313
setupLog.Error(err, "unable to create keycloak-realm-identity-provider controller")
314314
os.Exit(1)

‎config/crd/bases/v1.edp.epam.com_keycloakrealmidentityproviders.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ spec:
5050
description: AddReadTokenRoleOnCreate is a flag to add read token
5151
role on create.
5252
type: boolean
53+
adminFineGrainedPermissionsEnabled:
54+
description: |-
55+
AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider.
56+
Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
57+
Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.
58+
type: boolean
5359
alias:
5460
description: Alias is a alias of identity provider.
5561
type: string
@@ -102,6 +108,26 @@ spec:
102108
type: object
103109
nullable: true
104110
type: array
111+
permission:
112+
description: Permission is a identity provider permissions configuration
113+
nullable: true
114+
properties:
115+
scopePermissions:
116+
description: ScopePermissions mapping of scope and the policies
117+
attached
118+
items:
119+
properties:
120+
name:
121+
type: string
122+
policies:
123+
items:
124+
type: string
125+
type: array
126+
required:
127+
- name
128+
type: object
129+
type: array
130+
type: object
105131
providerId:
106132
description: ProviderID is a provider ID of identity provider.
107133
type: string

‎deploy-templates/crds/v1.edp.epam.com_keycloakrealmidentityproviders.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ spec:
5050
description: AddReadTokenRoleOnCreate is a flag to add read token
5151
role on create.
5252
type: boolean
53+
adminFineGrainedPermissionsEnabled:
54+
description: |-
55+
AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider.
56+
Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
57+
Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.
58+
type: boolean
5359
alias:
5460
description: Alias is a alias of identity provider.
5561
type: string
@@ -102,6 +108,26 @@ spec:
102108
type: object
103109
nullable: true
104110
type: array
111+
permission:
112+
description: Permission is a identity provider permissions configuration
113+
nullable: true
114+
properties:
115+
scopePermissions:
116+
description: ScopePermissions mapping of scope and the policies
117+
attached
118+
items:
119+
properties:
120+
name:
121+
type: string
122+
policies:
123+
items:
124+
type: string
125+
type: array
126+
required:
127+
- name
128+
type: object
129+
type: array
130+
type: object
105131
providerId:
106132
description: ProviderID is a provider ID of identity provider.
107133
type: string

‎docs/api.md

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4342,6 +4342,15 @@ Any value can be a reference to k8s secret, in this case value should be in form
43424342
AddReadTokenRoleOnCreate is a flag to add read token role on create.<br/>
43434343
</td>
43444344
<td>false</td>
4345+
</tr><tr>
4346+
<td><b>adminFineGrainedPermissionsEnabled</b></td>
4347+
<td>boolean</td>
4348+
<td>
4349+
AdminFineGrainedPermissionsEnabled enable/disable fine-grained admin permissions for an identity provider.
4350+
Feature flag admin-fine-grained-authz:v1 should be enabled in Keycloak server.
4351+
Important: FGAP:V1 Keycloak feature remains in preview and may be deprecated and removed in a future releases.<br/>
4352+
</td>
4353+
<td>false</td>
43454354
</tr><tr>
43464355
<td><b>authenticateByDefault</b></td>
43474356
<td>boolean</td>
@@ -4377,6 +4386,13 @@ Any value can be a reference to k8s secret, in this case value should be in form
43774386
Mappers is a list of identity provider mappers.<br/>
43784387
</td>
43794388
<td>false</td>
4389+
</tr><tr>
4390+
<td><b><a href="#keycloakrealmidentityproviderspecpermission">permission</a></b></td>
4391+
<td>object</td>
4392+
<td>
4393+
Permission is a identity provider permissions configuration<br/>
4394+
</td>
4395+
<td>false</td>
43804396
</tr><tr>
43814397
<td><b>storeToken</b></td>
43824398
<td>boolean</td>
@@ -4480,6 +4496,67 @@ RealmRef is reference to Realm custom resource.
44804496
</table>
44814497

44824498

4499+
### KeycloakRealmIdentityProvider.spec.permission
4500+
<sup><sup>[↩ Parent](#keycloakrealmidentityproviderspec)</sup></sup>
4501+
4502+
4503+
4504+
Permission is a identity provider permissions configuration
4505+
4506+
<table>
4507+
<thead>
4508+
<tr>
4509+
<th>Name</th>
4510+
<th>Type</th>
4511+
<th>Description</th>
4512+
<th>Required</th>
4513+
</tr>
4514+
</thead>
4515+
<tbody><tr>
4516+
<td><b><a href="#keycloakrealmidentityproviderspecpermissionscopepermissionsindex">scopePermissions</a></b></td>
4517+
<td>[]object</td>
4518+
<td>
4519+
ScopePermissions mapping of scope and the policies attached<br/>
4520+
</td>
4521+
<td>false</td>
4522+
</tr></tbody>
4523+
</table>
4524+
4525+
4526+
### KeycloakRealmIdentityProvider.spec.permission.scopePermissions[index]
4527+
<sup><sup>[↩ Parent](#keycloakrealmidentityproviderspecpermission)</sup></sup>
4528+
4529+
4530+
4531+
4532+
4533+
<table>
4534+
<thead>
4535+
<tr>
4536+
<th>Name</th>
4537+
<th>Type</th>
4538+
<th>Description</th>
4539+
<th>Required</th>
4540+
</tr>
4541+
</thead>
4542+
<tbody><tr>
4543+
<td><b>name</b></td>
4544+
<td>string</td>
4545+
<td>
4546+
<br/>
4547+
</td>
4548+
<td>true</td>
4549+
</tr><tr>
4550+
<td><b>policies</b></td>
4551+
<td>[]string</td>
4552+
<td>
4553+
<br/>
4554+
</td>
4555+
<td>false</td>
4556+
</tr></tbody>
4557+
</table>
4558+
4559+
44834560
### KeycloakRealmIdentityProvider.status
44844561
<sup><sup>[↩ Parent](#keycloakrealmidentityprovider)</sup></sup>
44854562

‎internal/controller/keycloakrealmidentityprovider/chain/chain.go

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
package chain
2+
3+
import (
4+
"context"
5+
"fmt"
6+
7+
ctrl "sigs.k8s.io/controller-runtime"
8+
"sigs.k8s.io/controller-runtime/pkg/client"
9+
10+
keycloakApi "github.com/epam/edp-keycloak-operator/api/v1"
11+
"github.com/epam/edp-keycloak-operator/pkg/client/keycloak"
12+
"github.com/epam/edp-keycloak-operator/pkg/secretref"
13+
)
14+
15+
type ClientHandler interface {
16+
Serve(
17+
ctx context.Context,
18+
keycloakRealmIDP *keycloakApi.KeycloakRealmIdentityProvider,
19+
realmName string,
20+
) error
21+
}
22+
23+
type Chain struct {
24+
handlers []ClientHandler
25+
}
26+
27+
func (ch *Chain) Use(handlers ...ClientHandler) {
28+
ch.handlers = append(ch.handlers, handlers...)
29+
}
30+
31+
func (ch *Chain) Serve(
32+
ctx context.Context,
33+
keycloakRealmIDP *keycloakApi.KeycloakRealmIdentityProvider,
34+
realmName string,
35+
) error {
36+
log := ctrl.LoggerFrom(ctx)
37+
38+
log.Info("Starting KeycloakIDP chain")
39+
40+
for i := 0; i < len(ch.handlers); i++ {
41+
h := ch.handlers[i]
42+
43+
err := h.Serve(ctx, keycloakRealmIDP, realmName)
44+
if err != nil {
45+
log.Info("KeycloakIDP chain finished with error")
46+
47+
return fmt.Errorf("failed to serve handler: %w", err)
48+
}
49+
}
50+
51+
log.Info("Handling of KeycloakIDP has been finished")
52+
53+
return nil
54+
}
55+
56+
func MakeChain(
57+
keycloakApiClient keycloak.Client,
58+
k8sClient client.Client,
59+
) *Chain {
60+
c := &Chain{}
61+
62+
c.Use(
63+
NewPutIDP(keycloakApiClient, k8sClient, secretref.NewSecretRef(k8sClient)),
64+
NewPutIDPMappers(keycloakApiClient, k8sClient, secretref.NewSecretRef(k8sClient)),
65+
NewPutAdminFineGrainedPermissions(keycloakApiClient),
66+
)
67+
68+
return c
69+
}

0 commit comments

Comments
 (0)