diff --git a/terraform/imports.tf b/terraform/imports.tf index e69de29..1728300 100644 --- a/terraform/imports.tf +++ b/terraform/imports.tf @@ -0,0 +1,14 @@ +import { + id = "twomartens/70b117f6-1212-4c30-95ec-21b4b4ed47ea" + to = keycloak_openid_client.account +} + +import { + id = "twomartens/7598dba2-de04-4493-83a0-8b85e4496895" + to = keycloak_role.account_view_profile +} + +import { + id = "twomartens/client/44ceab76-cb8f-4883-8093-0bcb8b6d5064/scope-mappings/70b117f6-1212-4c30-95ec-21b4b4ed47ea/7598dba2-de04-4493-83a0-8b85e4496895" + to = keycloak_generic_role_mapper.timetable_frontend_view_profile +} \ No newline at end of file diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf index c4ebf31..4a557dd 100644 --- a/terraform/keycloak.tf +++ b/terraform/keycloak.tf @@ -48,6 +48,29 @@ resource "keycloak_realm" "twomartens_realm" { } } +resource "keycloak_openid_client" "account" { + realm_id = keycloak_realm.twomartens_realm.id + client_id = "account" + access_type = "PUBLIC" + name = "$${client_account}" + root_url = "$${authBaseUrl}" + base_url = "/realms/twomartens/account/" + valid_redirect_uris = [ + "/realms/twomartens/account/*" + ] + valid_post_logout_redirect_uris = [ + "+" + ] + standard_flow_enabled = true + backchannel_logout_session_required = true +} + +resource "keycloak_role" "account_view_profile" { + realm_id = keycloak_realm.twomartens_realm.id + client_id = keycloak_openid_client.account.id + name = "view-profile" +} + resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider" { realm = keycloak_realm.twomartens_realm.id alias = "github" @@ -145,13 +168,20 @@ resource "keycloak_openid_client" "twomartens_timetable_frontend" { full_scope_allowed = false valid_redirect_uris = [ - "http://localhost:8100/*" + "http://localhost:8100/*", + "https://timetable.2martens.de/*" ] web_origins = [ "+" ] } +resource "keycloak_generic_role_mapper" "timetable_frontend_view_profile" { + realm_id = keycloak_realm.twomartens_realm.id + client_id = keycloak_openid_client.twomartens_timetable_frontend.id + role_id = keycloak_role.account_view_profile.id +} + resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" { realm_id = keycloak_realm.twomartens_realm.id name = "Wahlrecht Frontend"