Skip to content

Commit

Permalink
clean up example tf
Browse files Browse the repository at this point in the history
  • Loading branch information
@mrparkers
mrparkers committed Jun 1, 2020
1 parent 7ffdbf8 commit 213ec9a
Show file tree
Hide file tree
Showing 4 changed files with 263 additions and 257 deletions.
56 changes: 28 additions & 28 deletions example/client_authorization_policys.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ resource keycloak_realm test_authorization {
resource keycloak_openid_client test {
client_id = "test-openid-client"
name = "test-openid-client"
realm_id = "${keycloak_realm.test_authorization.id}"
realm_id = keycloak_realm.test_authorization.id
description = "a test openid client"
standard_flow_enabled = true
service_accounts_enabled = true
Expand All @@ -28,61 +28,61 @@ resource keycloak_openid_client test {
#

resource keycloak_role test_authorization {
realm_id = "${keycloak_realm.test_authorization.id}"
realm_id = keycloak_realm.test_authorization.id
name = "aggregate_policy_role"
}

resource keycloak_openid_client_role_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "keycloak_openid_client_role_policy"
decision_strategy = "UNANIMOUS"
logic = "POSITIVE"
type = "role"
role {
id = "${keycloak_role.test_authorization.id}"
id = keycloak_role.test_authorization.id
required = false
}
}

resource keycloak_openid_client_aggregate_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "keycloak_openid_client_aggregate_policy"
decision_strategy = "UNANIMOUS"
logic = "POSITIVE"
policies = ["${keycloak_openid_client_role_policy.test.id}"]
policies = [keycloak_openid_client_role_policy.test.id]
}

#
# create client policy
#

resource keycloak_openid_client_client_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "keycloak_openid_client_client_policy"
decision_strategy = "AFFIRMATIVE"
logic = "POSITIVE"
clients = ["${keycloak_openid_client.test.resource_server_id}"]
clients = [keycloak_openid_client.test.resource_server_id]
}

#
# create group policy
#

resource keycloak_group test {
realm_id = "${keycloak_realm.test_authorization.id}"
realm_id = keycloak_realm.test_authorization.id
name = "foo"
}

resource keycloak_openid_client_group_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "client_group_policy_test"
groups {
id = "${keycloak_group.test.id}"
path = "${keycloak_group.test.path}"
id = keycloak_group.test.id
path = keycloak_group.test.path
extend_children = false
}
logic = "POSITIVE"
Expand All @@ -95,8 +95,8 @@ resource keycloak_openid_client_group_policy test {
#

resource keycloak_openid_client_js_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "client_js_policy_test"
logic = "POSITIVE"
decision_strategy = "UNANIMOUS"
Expand All @@ -110,19 +110,19 @@ resource keycloak_openid_client_js_policy test {
#

resource keycloak_role test_authorization2 {
realm_id = "${keycloak_realm.test_authorization.id}"
realm_id = keycloak_realm.test_authorization.id
name = "new_role"
}

resource keycloak_openid_client_role_policy test1 {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "keycloak_openid_client_role_policy1"
decision_strategy = "AFFIRMATIVE"
logic = "POSITIVE"
type = "role"
role {
id = "${keycloak_role.test_authorization2.id}"
id = keycloak_role.test_authorization2.id
required = false
}
}
Expand All @@ -132,8 +132,8 @@ resource keycloak_openid_client_role_policy test1 {
#

resource keycloak_openid_client_time_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "%s"
not_on_or_after = "2500-12-12 01:01:11"
not_before = "2400-12-12 01:01:11"
Expand All @@ -156,7 +156,7 @@ resource keycloak_openid_client_time_policy test {
#

resource keycloak_user test {
realm_id = "${keycloak_realm.test_authorization.id}"
realm_id = keycloak_realm.test_authorization.id
username = "test-user"

email = "[email protected]"
Expand All @@ -165,10 +165,10 @@ resource keycloak_user test {
}

resource keycloak_openid_client_user_policy test {
resource_server_id = "${keycloak_openid_client.test.resource_server_id}"
realm_id = "${keycloak_realm.test_authorization.id}"
resource_server_id = keycloak_openid_client.test.resource_server_id
realm_id = keycloak_realm.test_authorization.id
name = "client_user_policy_test"
users = ["${keycloak_user.test.id}"]
users = [keycloak_user.test.id]
logic = "POSITIVE"
decision_strategy = "UNANIMOUS"
}
32 changes: 16 additions & 16 deletions example/federated_user_example.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ resource "keycloak_realm" "source_realm" {
}

resource "keycloak_openid_client" "destination_client" {
realm_id = "${keycloak_realm.source_realm.id}"
realm_id = keycloak_realm.source_realm.id
name = "destination_client"
client_id = "destination_client"
client_secret = "secret"
Expand All @@ -18,7 +18,7 @@ resource "keycloak_openid_client" "destination_client" {

//do not get confused this just to have multiple federate idps on the destination realm
resource "keycloak_openid_client" "destination_double_client" {
realm_id = "${keycloak_realm.source_realm.id}"
realm_id = keycloak_realm.source_realm.id
name = "destination_double_client"
client_id = "destination_double_client"
client_secret = "secret2"
Expand All @@ -31,7 +31,7 @@ resource "keycloak_openid_client" "destination_double_client" {
}

resource "keycloak_user" "source_user" {
realm_id = "${keycloak_realm.source_realm.id}"
realm_id = keycloak_realm.source_realm.id
username = "source"
email = "[email protected]"
first_name = "source"
Expand All @@ -48,48 +48,48 @@ resource "keycloak_realm" "destination_realm" {
}

resource keycloak_oidc_identity_provider source_oidc_idp {
realm = "${keycloak_realm.destination_realm.id}"
realm = keycloak_realm.destination_realm.id
alias = "source"
authorization_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/auth"
token_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/token"
user_info_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/userinfo"
jwks_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/certs"
validate_signature = true
client_id = "${keycloak_openid_client.destination_client.client_id}"
client_secret = "${keycloak_openid_client.destination_client.client_secret}"
client_id = keycloak_openid_client.destination_client.client_id
client_secret = keycloak_openid_client.destination_client.client_secret
default_scopes = "openid"
}

//do not get confused this second idp towards source_realm, this could a completly different idp
resource keycloak_oidc_identity_provider second_source_oidc_idp {
realm = "${keycloak_realm.destination_realm.id}"
realm = keycloak_realm.destination_realm.id
alias = "source2"
authorization_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/auth"
token_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/token"
user_info_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/userinfo"
jwks_url = "http://localhost:8080/auth/realms/${keycloak_realm.source_realm.id}/protocol/openid-connect/certs"
validate_signature = true
client_id = "${keycloak_openid_client.destination_double_client.client_id}"
client_secret = "${keycloak_openid_client.destination_double_client.client_secret}"
client_id = keycloak_openid_client.destination_double_client.client_id
client_secret = keycloak_openid_client.destination_double_client.client_secret
default_scopes = "openid"
}

resource "keycloak_user" "destination_user" {
realm_id = "${keycloak_realm.destination_realm.id}"
realm_id = keycloak_realm.destination_realm.id
username = "my_destination_username"
email = "[email protected]"
first_name = "Destination_source"
last_name = "Destination_source"
//federated link through source idp
federated_identity {
identity_provider = "${keycloak_oidc_identity_provider.source_oidc_idp.alias}"
user_id = "${keycloak_user.source_user.id}"
user_name = "${keycloak_user.source_user.username}"
identity_provider = keycloak_oidc_identity_provider.source_oidc_idp.alias
user_id = keycloak_user.source_user.id
user_name = keycloak_user.source_user.username
}
//federated link through second source idp
federated_identity {
identity_provider = "${keycloak_oidc_identity_provider.second_source_oidc_idp.alias}"
user_id = "${keycloak_user.source_user.id}"
user_name = "${keycloak_user.source_user.username}"
identity_provider = keycloak_oidc_identity_provider.second_source_oidc_idp.alias
user_id = keycloak_user.source_user.id
user_name = keycloak_user.source_user.username
}
}
Loading

0 comments on commit 213ec9a

Please sign in to comment.