From 2025eb86a68c1bd6d1ef4a9051bf332228f06447 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sat, 26 Jul 2025 16:20:45 +0200
Subject: [PATCH] change: Enable refresh tokens for grafana and switch to
 PUBLIC with pkce

---
 terraform/keycloak.tf | 45 ++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf
index f1390e3..c4ebf31 100644
--- a/terraform/keycloak.tf
+++ b/terraform/keycloak.tf
@@ -17,7 +17,7 @@ resource "keycloak_realm" "twomartens_realm" {
   login_theme   = "keycloak.v2"
   account_theme = "keycloak.v3"
   admin_theme   = "keycloak.v2"
-  email_theme = "keycloak"
+  email_theme   = "keycloak"
 
   # Security settings
   password_policy = "upperCase(1) and length(12) and forceExpiredPasswordChange(365) and notUsername"
@@ -38,12 +38,12 @@ resource "keycloak_realm" "twomartens_realm" {
   refresh_token_max_reuse     = 0
 
   web_authn_policy {
-    signature_algorithms = ["ES256"]
+    signature_algorithms              = ["ES256"]
     avoid_same_authenticator_register = true
   }
 
   web_authn_passwordless_policy {
-    signature_algorithms = ["ES256"]
+    signature_algorithms              = ["ES256"]
     avoid_same_authenticator_register = true
   }
 }
@@ -52,15 +52,15 @@ resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider"
   realm        = keycloak_realm.twomartens_realm.id
   alias        = "github"
   display_name = "GitHub"
-  provider_id = "github"
+  provider_id  = "github"
 
   # OAuth App Configuration
-  client_id = var.github_identity_provider_client_id
+  client_id     = var.github_identity_provider_client_id
   client_secret = var.github_identity_provider_client_secret
 
   # OAuth Endpoints
   authorization_url = "https://github.com/login/oauth/authorize"
-  token_url = "https://github.com/login/oauth/access_token"
+  token_url         = "https://github.com/login/oauth/access_token"
 
   # Detailed User Mapping
   extra_config = {
@@ -172,14 +172,14 @@ resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" {
 }
 
 resource "keycloak_openid_client" "twomartens_wahlrecht_backend" {
-  realm_id                 = keycloak_realm.twomartens_realm.id
-  name                     = "Wahlrecht Backend"
-  enabled                  = true
-  access_type              = "CONFIDENTIAL"
-  client_id                = "wahlrecht"
-  standard_flow_enabled    = true
-  use_refresh_tokens       = false
-  full_scope_allowed       = false
+  realm_id              = keycloak_realm.twomartens_realm.id
+  name                  = "Wahlrecht Backend"
+  enabled               = true
+  access_type           = "CONFIDENTIAL"
+  client_id             = "wahlrecht"
+  standard_flow_enabled = true
+  use_refresh_tokens    = false
+  full_scope_allowed    = false
 
   valid_redirect_uris = [
     "http://localhost:12000/*",
@@ -254,14 +254,15 @@ resource "keycloak_openid_client_optional_scopes" "argocd_monitoring_optional_sc
 # from here Grafana
 
 resource "keycloak_openid_client" "twomartens_grafana_monitoring" {
-  realm_id              = keycloak_realm.twomartens_realm.id
-  name                  = "Grafana Monitoring Cluster"
-  enabled               = true
-  access_type           = "CONFIDENTIAL"
-  client_id             = "grafana-oauth"
-  standard_flow_enabled = true
-  use_refresh_tokens    = false
-  full_scope_allowed    = false
+  realm_id                   = keycloak_realm.twomartens_realm.id
+  name                       = "Grafana Monitoring Cluster"
+  enabled                    = true
+  access_type                = "PUBLIC"
+  client_id                  = "grafana-oauth"
+  standard_flow_enabled      = true
+  use_refresh_tokens         = true
+  full_scope_allowed         = false
+  pkce_code_challenge_method = "S256"
 
   valid_redirect_uris = [
     "https://grafana.k8s.monitoring.2martens.de/login/generic_oauth"