JanssenProject · yuriyz · Apr 8, 2024 · Apr 8, 2024 · Apr 8, 2024 · Apr 8, 2024
@@ -144,7 +144,13 @@ def create_clients(self):
     def install_keycloack(self):
         self.logIt("Installing KC", pbar=self.service_name)
         base.unpack_zip(self.source_files[3][0], self.idp_config_data_dir, with_par_dir=False)
+
+        # retreive auth config
+        _, jans_auth_config = self.dbUtils.get_oxAuthConfDynamic()
+        Config.templateRenderingDict['jans_auth_token_endpoint'] = jans_auth_config['tokenEndpoint']
+
         self.update_rendering_dict()
+
         self.renderTemplateInOut(self.idp_config_fn, self.templates_folder, os.path.join(self.idp_config_data_dir, 'conf'))
         self.chown(self.idp_config_data_dir, Config.jetty_user, Config.jetty_group, recursive=True)
 
@@ -178,10 +184,9 @@ def config_api_idp_plugin_config(self):
            jans_api_user_fn = 'jans.api-user.json'
         jans_browser_auth_flow_fn = 'jans.browser-auth-flow.json'
         jans_execution_config_jans_fn = 'jans.execution-config-jans.json'
+        jans_userstorage_provider_component_fn = 'jans.userstorage-provider-component.json'
 
-        self.idp_config_fn = os.path.join(self.templates_folder, 'keycloak.conf')
-
-        for tmp_fn in (jans_api_openid_client_fn, jans_api_realm_fn, jans_api_user_fn, jans_browser_auth_flow_fn):
+        for tmp_fn in (jans_api_openid_client_fn, jans_api_realm_fn, jans_api_user_fn, jans_browser_auth_flow_fn, jans_userstorage_provider_component_fn):
             self.renderTemplateInOut(os.path.join(jans_api_tmp_dir, tmp_fn), jans_api_tmp_dir, jans_api_output_dir, pystring=True)
 
         self.logIt("Starting KC for config api idp plugin configurations")
@@ -225,7 +230,7 @@ def config_api_idp_plugin_config(self):
             self.run([kcadm_cmd, 'set-password', '-r', Config.jans_idp_realm, '--username', Config.jans_idp_user_name, '--new-password', Config.jans_idp_user_password, '--config', kc_tmp_config], env=env)
 
             # assign roles to jans-api-user
-            self.run([kcadm_cmd, 'add-roles', '-r', Config.jans_idp_realm, '--uusername', Config.jans_idp_user_name, '--cclientid', 'realm-management', '--rolename', 'manage-identity-providers', '--rolename', 'view-identity-providers', '--rolename', 'view-identity-providers', '--config', kc_tmp_config], env=env)
+            self.run([kcadm_cmd, 'add-roles', '-r', Config.jans_idp_realm, '--uusername', Config.jans_idp_user_name, '--cclientid', 'realm-management', '--rolename', 'manage-identity-providers', '--rolename', 'view-identity-providers', '--rolename', 'query-realms', '--rolename', 'view-realm', '--rolename', 'view-clients', '--rolename', 'manage-clients', '--rolename', 'query-clients', '--rolename', 'query-users', '--rolename', 'view-users', '--config', kc_tmp_config], env=env)
 
             # Create authentication flow in the jans-api realm used for saml clients
             _, result = self.run([kcadm_cmd, 'create', 'authentication/flows', '-r',  Config.jans_idp_realm, '-f', os.path.join(jans_api_output_dir, jans_browser_auth_flow_fn), '--config', kc_tmp_config], env=env, get_stderr=True)
@@ -246,4 +251,5 @@ def config_api_idp_plugin_config(self):
             # Configure the jans auth execution step in realm jans-api
             self.run([kcadm_cmd, 'create', f'authentication/executions/{jans_execution_auth_jans_id}/config', '-r', Config.jans_idp_realm, '-f', os.path.join(jans_api_output_dir, jans_execution_config_jans_fn), '--config', kc_tmp_config], env=env)
 
-
+            # create userstorage provider component
+            self.run([kcadm_cmd, 'create', 'components', '-r', Config.jans_idp_realm, '-f', os.path.join(jans_api_output_dir, jans_userstorage_provider_component_fn), '--config', kc_tmp_config], env=env)
@@ -143,7 +143,7 @@ def generate_configuration(self):
                 'jansAccessTknSigAlg': ['RS256'],
                 'jansAppTyp': ['native'],
                 'jansAttrs': ['{}'],
-                'jansGrantTyp':	['client_credentials'],
+                'jansGrantTyp': ['client_credentials'],
                 'jansScope': scopes_dn,
                 'jansSubjectTyp': ['pairwise'],
                 'jansTknEndpointAuthMethod': ['client_secret_basic'],

@@ -2,9 +2,9 @@
     "name":"jans-user-federation",
     "providerId": "kc-jans-storage",
     "providerType": "org.keycloak.storage.UserStorageProvider",
-    "parentId": "${jans_idp_realm_id}",
+    "parentId": "${jans_idp_realm}",
     "config": {
       "cachePolicy": ["DEFAULT"],
       "enabled": ["true"]
     }
-  }
+  }
@@ -44,20 +44,20 @@
 # Storage SPI Configuration (SCIM)
 
 # janssen-auth token endpoint 
-spi-storage-kc-jans-storage-auth-token-endpoint=
+spi-storage-kc-jans-storage-auth-token-endpoint=https://%(hostname)s/%(jans_auth_token_endpoint)s
 
 # janssen scim user fetch endpoint 
 # usually of the format https://<server>/jans-scim/restv1/v2/Users
-spi-storage-kc-jans-storage-scim-user-endpoint=
+spi-storage-kc-jans-storage-scim-user-endpoint=https://%(hostname)s/jans-scim/restv1/v2/Users
 
 # scim user search endpoint 
-spi-storage-kc-jans-storage-scim-user-search-endpoint=
+spi-storage-kc-jans-storage-scim-user-search-endpoint=https://%(hostname)s/jans-scim/restv1/v2/Users/.search
 
 # scim oauth scopes
 spi-storage-kc-jans-storage-scim-oauth-scopes=https://jans.io/scim/users.read https://jans.io/scim/users.write
 
 #scim client id 
-spi-storage-kc-jans-storage-scim-client-id=
+spi-storage-kc-jans-storage-scim-client-id=%(saml_scim_client_id)s
 
 #scim client secret
-spi-storage-kc-jans-storage-scim-client-secret=
+spi-storage-kc-jans-storage-scim-client-secret=%(saml_scim_client_pw)s