Kratos pm4ml providers

terraform/gitops/generate-files/templates/ory/keycloak-realm-cr.yaml.tpl

@@ -324,6 +324,52 @@ spec:
       - phone
       - offline_access
       - microprofile-jwt
+# %{ for pm4ml in pm4mls ~}
+    - clientId: '${pm4ml.pm4ml} provider'
+      name: '${pm4ml.pm4ml}-provider-client'
+      description: ''
+      rootUrl: ''
+      adminUrl: ''
+      baseUrl: ''
+      surrogateAuthRequired: false
+      enabled: true
+      alwaysDisplayInConsole: false
+      clientAuthenticatorType: client-secret
+      secret: ${pm4ml.pm4ml}_oidc_provider_secret
+      redirectUris:
+      - "*"
+      webOrigins:
+      - "*"
+      notBefore: 0
+      bearerOnly: false
+      consentRequired: false
+      standardFlowEnabled: true
+      implicitFlowEnabled: false
+      directAccessGrantsEnabled: true
+      serviceAccountsEnabled: false
+      publicClient: true
+      frontchannelLogout: true
+      protocol: openid-connect
+      attributes:
+        oidc.ciba.grant.enabled: 'false'
+        oauth2.device.authorization.grant.enabled: 'false'
+        backchannel.logout.session.required: 'true'
+        backchannel.logout.revoke.offline.tokens: 'false'
+      authenticationFlowBindingOverrides: {}
+      fullScopeAllowed: true
+      nodeReRegistrationTimeout: -1
+      defaultClientScopes:
+      - web-origins
+      - acr
+      - roles
+      - profile
+      - email
+      optionalClientScopes:
+      - address
+      - phone
+      - offline_access
+      - microprofile-jwt
+# %{ endfor ~}
     - id: ce8b8b2d-71b8-4ecc-a306-ba657c9e8403
       clientId: realm-management
       name: '$${client_realm-management}'

terraform/gitops/generate-files/templates/ory/vault-secret.yaml.tpl

@@ -162,6 +162,15 @@ spec:
             name: default
       name: kratosoidcsecret
       path: ${hubop_oidc_client_secret_secret_path}/${hubop_oidc_client_secret_secret}
+%{ for pm4ml in pm4mls ~}
+    - authentication:
+        path: kubernetes
+        role: policy-admin
+        serviceAccount:
+            name: default
+      name: ${pm4ml.pm4ml}
+      path: ${hubop_oidc_client_secret_secret_path}/${pm4ml.pm4ml}-oidc-provider-secret
+%{ endfor ~}
   output:
     name: kratos-oidc-providers
     stringData:
@@ -175,5 +184,16 @@ spec:
             "mapper_url":"base64://bG9jYWwgY2xhaW1zID0gc3RkLmV4dFZhcignY2xhaW1zJyk7Cgp7CiAgaWRlbnRpdHk6IHsKICAgIHRyYWl0czogewogICAgICBlbWFpbDogY2xhaW1zLmVtYWlsLAogICAgICBuYW1lOiBjbGFpbXMuZW1haWwsCiAgICAgIHN1YmplY3Q6IGNsYWltcy5zdWIKICAgIH0sCiAgfSwKfQ==",
             "issuer_url":"https://${keycloak_fqdn}/realms/${keycloak_hubop_realm_name}"
           }
+%{ for pm4ml in pm4mls ~}
+          ,{
+            "id":"${pm4ml.pm4ml}",
+            "provider":"generic",
+            "client_id":"${pm4ml.pm4ml}-provider-client",
+            "client_secret":"{{ .${pm4ml.pm4ml}.secret }}",
+            "scope":["openid", "profile", "email"],
+            "mapper_url":"base64://bG9jYWwgY2xhaW1zID0gc3RkLmV4dFZhcignY2xhaW1zJyk7Cgp7CiAgaWRlbnRpdHk6IHsKICAgIHRyYWl0czogewogICAgICBlbWFpbDogY2xhaW1zLmVtYWlsLAogICAgICBuYW1lOiBjbGFpbXMuZW1haWwsCiAgICAgIHN1YmplY3Q6IGNsYWltcy5zdWIKICAgIH0sCiAgfSwKfQ==",
+            "issuer_url":"https://${keycloak_fqdn}/realms/${pm4ml.pm4ml}"
+          }
+%{ endfor ~}
         ]'
     type: Opaque

terraform/gitops/k8s-cluster-config/app-deploy.tf

@@ -200,6 +200,11 @@ locals {
   pm4ml_keycloak_realm_env_secret_map = { for key, pm4ml in local.pm4ml_var_map :
     "${var.pm4ml_oidc_client_secret_secret}-${key}" => var.pm4ml_oidc_client_secret_secret_key
   }
+
+  pm4ml_provider_secret_map = { for key, pm4ml in local.pm4ml_var_map :
+    "${key}-oidc-provider-secret" => var.pm4ml_oidc_client_secret_secret_key
+  }
+
   hubop_keycloak_realm_env_secret_map = {
     "${var.hubop_oidc_client_secret_secret}"        = var.hubop_oidc_client_secret_secret_key
     "${var.hubop_realm_role_assign_service_secret}" = var.hubop_realm_role_assign_service_secret_key
@@ -240,7 +245,11 @@ locals {
   pm4ml_internal_gateway_hosts = concat(local.pm4ml_internal_wildcard_portal_hosts, local.pm4ml_internal_wildcard_exp_hosts, values(local.pm4ml_ttk_frontend_fqdns), values(local.pm4ml_ttk_backend_fqdns), values(local.test_fqdns))
   pm4ml_external_gateway_hosts = concat(local.pm4ml_external_wildcard_portal_hosts, local.pm4ml_external_wildcard_exp_hosts)
 
-  keycloak_realm_env_secret_map = merge(var.common_var_map.mojaloop_enabled ? local.mojaloop_keycloak_realm_env_secret_map : local.pm4ml_keycloak_realm_env_secret_map, local.hubop_keycloak_realm_env_secret_map)
+  keycloak_realm_env_secret_map = merge(
+    var.common_var_map.mojaloop_enabled ? local.mojaloop_keycloak_realm_env_secret_map : local.pm4ml_keycloak_realm_env_secret_map,
+    local.hubop_keycloak_realm_env_secret_map,
+    local.pm4ml_provider_secret_map
+  )
 
   internal_gateway_hosts = concat([local.keycloak_admin_fqdn],
     local.vault_wildcard_gateway == "internal" ? [local.vault_public_fqdn] : [],

terraform/gitops/k8s-cluster-config/ory.tf

@@ -43,6 +43,7 @@ module "generate_ory_files" {
     hubop_role_assignment_svc_username    = var.hubop_realm_role_assignment_svc_user
     portal_admin_secret_name              = join("$", ["", "{${replace(var.hubop_realm_portal_admin_secret, "-", "_")}}"])
     portal_admin                          = var.hubop_realm_portal_admin_user
+    pm4mls                                = var.app_var_map.pm4mls
   }
   file_list       = [for f in fileset(local.ory_template_path, "**/*.tpl") : trimsuffix(f, ".tpl") if !can(regex(local.ory_app_file, f))]
   template_path   = local.ory_template_path