Sonchau/keycloak (#513)

* remove old files

* add new files

* Update keycloak_setup.sh

* Update docker-compose.yml

* Update .gitignore

* Update example.env

* clean up old instructions

* update Tyk logout to work with new keycloak

docs/install-candig.md

@@ -344,8 +344,6 @@ cp -i etc/env/example.env .env
 LOCAL_IP_ADDR=xxx.xx.x.x
 # change OS
 VENV_OS=arm64mac
-# change keycloak
-KEYCLOAK_BASE_IMAGE=quay.io/c3genomics/keycloak:${KEYCLOAK_VERSION}.arm64
 ```
 
 Edit /etc/hosts on the machine (`sudo nano /etc/hosts`):

etc/env/example.env

@@ -175,23 +175,18 @@ CACHE_TIME=0
 
 
 # keycloak service
-KEYCLOAK_VERSION=16.1.1
-#KEYCLOAK_BASE_IMAGE=quay.io/c3genomics/keycloak:${KEYCLOAK_VERSION}.arm64
-KEYCLOAK_BASE_IMAGE=quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}
+KEYCLOAK_VERSION=24.0.0
 KEYCLOAK_REALM=candig
 KEYCLOAK_CLIENT_ID=local_candig
 KEYCLOAK_LOGIN_REDIRECT_PATH=/auth/login
 KEYCLOAK_PORT=8080
-KEYCLOAK_CONTAINER_PORT=8080
-KEYCLOAK_HOST=0.0.0.0
 KEYCLOAK_PUBLIC_PROTO=http
 KEYCLOAK_PRIVATE_PROTO=http
 KEYCLOAK_ENABLE_PROXY=false
 KEYCLOAK_PUBLIC_URL=${KEYCLOAK_PUBLIC_PROTO}://${CANDIG_AUTH_DOMAIN}:${KEYCLOAK_PORT}
 KEYCLOAK_PUBLIC_URL_PROD=${KEYCLOAK_PUBLIC_PROTO}://${CANDIG_AUTH_DOMAIN}
-KEYCLOAK_PRIVATE_URL=${KEYCLOAK_PRIVATE_PROTO}://${CANDIG_AUTH_DOMAIN}:${KEYCLOAK_CONTAINER_PORT}
+KEYCLOAK_PRIVATE_URL=${KEYCLOAK_PRIVATE_PROTO}://${CANDIG_AUTH_DOMAIN}:${KEYCLOAK_PORT}
 KEYCLOAK_REALM_URL=${KEYCLOAK_PUBLIC_URL}/auth/realms/${KEYCLOAK_REALM}
-
 KEYCLOAK_GENERATE_TEST_USER=1
 
 # query service

lib/keycloak/client_setup.sh

@@ -0,0 +1,38 @@
+# This script creates and configures a client within a Keycloak realm
+
+echo
+echo -e "${BLUE}Creating client: $KEYCLOAK_CLIENT_ID${DEFAULT}"
+
+CREATE_OUTPUT=$(KCADM create clients -r "$KEYCLOAK_REALM" \
+    -s clientId="$KEYCLOAK_CLIENT_ID" \
+    -s enabled=true \
+    -s protocol=openid-connect \
+    -s publicClient=false \
+    -s clientAuthenticatorType=client-secret \
+    -s standardFlowEnabled=true \
+    -s directAccessGrantsEnabled=true \
+    -s 'redirectUris=["'"$TYK_LOGIN_TARGET_URL$KEYCLOAK_LOGIN_REDIRECT_PATH"'"]' \
+    -s 'webOrigins=["'"$TYK_LOGIN_TARGET_URL"'"]' 2>&1)
+# uncomment the line beblow to see the output
+# echo $CREATE_OUTPUT
+
+# Extract the client ID from the output
+CLIENT_ID=$(echo $CREATE_OUTPUT | grep -oE '[0-9a-fA-F-]{36}')
+
+# Create client scopes
+SCOPE_NAME="${KEYCLOAK_CLIENT_ID}-audience"
+CREATE_OUTPUT=$(KCADM create clients/$CLIENT_ID/protocol-mappers/models -r $KEYCLOAK_REALM \
+    -s name=$SCOPE_NAME \
+    -s protocol=openid-connect \
+    -s protocolMapper=oidc-audience-mapper \
+    -s config="{\"included.client.audience\" : \"$KEYCLOAK_CLIENT_ID\",\"id.token.claim\" : \"true\",\"access.token.claim\" : \"true\"}" 2>&1)
+# uncomment the line beblow to see the output
+# echo $CREATE_OUTPUT
+
+# EXPORT: Get the client secret and save it to secrets
+CLIENT_SECRET=$(KCADM get clients/"$CLIENT_ID"/client-secret -r "$KEYCLOAK_REALM" | jq -r '.value')
+echo "$CLIENT_SECRET" > tmp/secrets/keycloak-client-$KEYCLOAK_CLIENT_ID-secret
+
+# EXPORT: Encode the Keycloak client ID in base64 and save it to secrets
+KEYCLOAK_CLIENT_ID_64=$(echo -n "${KEYCLOAK_CLIENT_ID}" | base64)
+echo "$KEYCLOAK_CLIENT_ID_64" > "tmp/secrets/keycloak-client-${KEYCLOAK_CLIENT_ID}-id-64"