2martens/terraform
1
0
Fork 0
mirror of https://github.com/2martens/terraform.git synced 2026-10-17 19:26:51 +02:00
Code Issues Activity

change: Enable refresh tokens for grafana and switch to PUBLIC with pkce
continuous-integration/drone/push Build is passing
Details

Browse Source
This commit is contained in:
2martens
2025-07-26 16:20:45 +02:00
parent 3a0fa35c25
commit 2025eb86a6
1 changed files with 23 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/keycloak.tf
+23 -22
View File
@@ -17,7 +17,7 @@ resource "keycloak_realm" "twomartens_realm" {
login_theme = "keycloak.v2" login_theme = "keycloak.v2"
account_theme = "keycloak.v3" account_theme = "keycloak.v3"
admin_theme = "keycloak.v2" admin_theme = "keycloak.v2"
email_theme = "keycloak" email_theme = "keycloak"
# Security settings # Security settings
password_policy = "upperCase(1) and length(12) and forceExpiredPasswordChange(365) and notUsername" password_policy = "upperCase(1) and length(12) and forceExpiredPasswordChange(365) and notUsername"
@@ -38,12 +38,12 @@ resource "keycloak_realm" "twomartens_realm" {
refresh_token_max_reuse = 0 refresh_token_max_reuse = 0
web_authn_policy { web_authn_policy {
signature_algorithms = ["ES256"] signature_algorithms = ["ES256"]
avoid_same_authenticator_register = true avoid_same_authenticator_register = true
} }
web_authn_passwordless_policy { web_authn_passwordless_policy {
signature_algorithms = ["ES256"] signature_algorithms = ["ES256"]
avoid_same_authenticator_register = true avoid_same_authenticator_register = true
} }
} }
@@ -52,15 +52,15 @@ resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider"
realm = keycloak_realm.twomartens_realm.id realm = keycloak_realm.twomartens_realm.id
alias = "github" alias = "github"
display_name = "GitHub" display_name = "GitHub"
provider_id = "github" provider_id = "github"
# OAuth App Configuration # OAuth App Configuration
client_id = var.github_identity_provider_client_id client_id = var.github_identity_provider_client_id
client_secret = var.github_identity_provider_client_secret client_secret = var.github_identity_provider_client_secret
# OAuth Endpoints # OAuth Endpoints
authorization_url = "https://github.com/login/oauth/authorize" authorization_url = "https://github.com/login/oauth/authorize"
token_url = "https://github.com/login/oauth/access_token" token_url = "https://github.com/login/oauth/access_token"
# Detailed User Mapping # Detailed User Mapping
extra_config = { extra_config = {
@@ -172,14 +172,14 @@ resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" {
} }
resource "keycloak_openid_client" "twomartens_wahlrecht_backend" { resource "keycloak_openid_client" "twomartens_wahlrecht_backend" {
realm_id = keycloak_realm.twomartens_realm.id realm_id = keycloak_realm.twomartens_realm.id
name = "Wahlrecht Backend" name = "Wahlrecht Backend"
enabled = true enabled = true
access_type = "CONFIDENTIAL" access_type = "CONFIDENTIAL"
client_id = "wahlrecht" client_id = "wahlrecht"
standard_flow_enabled = true standard_flow_enabled = true
use_refresh_tokens = false use_refresh_tokens = false
full_scope_allowed = false full_scope_allowed = false
valid_redirect_uris = [ valid_redirect_uris = [
"http://localhost:12000/*", "http://localhost:12000/*",
@@ -254,14 +254,15 @@ resource "keycloak_openid_client_optional_scopes" "argocd_monitoring_optional_sc
# from here Grafana # from here Grafana
resource "keycloak_openid_client" "twomartens_grafana_monitoring" { resource "keycloak_openid_client" "twomartens_grafana_monitoring" {
realm_id = keycloak_realm.twomartens_realm.id realm_id = keycloak_realm.twomartens_realm.id
name = "Grafana Monitoring Cluster" name = "Grafana Monitoring Cluster"
enabled = true enabled = true
access_type = "CONFIDENTIAL" access_type = "PUBLIC"
client_id = "grafana-oauth" client_id = "grafana-oauth"
standard_flow_enabled = true standard_flow_enabled = true
use_refresh_tokens = false use_refresh_tokens = true
full_scope_allowed = false full_scope_allowed = false
pkce_code_challenge_method = "S256"
valid_redirect_uris = [ valid_redirect_uris = [
"https://grafana.k8s.monitoring.2martens.de/login/generic_oauth" "https://grafana.k8s.monitoring.2martens.de/login/generic_oauth"