-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
added secret regeneration script into Keycloak
- Loading branch information
1 parent
bac0bd9
commit 31b481c
Showing
8 changed files
with
303 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #!/bin/bash | ||
|
|
||
| # let's begin 2 tasks: | ||
| # the first task waits the Keycloak readyness to generate and print the Keycloak client secret | ||
| # the second task is the default entry point of Keycloak | ||
| # the first task will be started in background (thanks to the '&'), so the second task will start at the same time | ||
| cd /opt/keycloak/bin/ | ||
| ./regenerate-client-secret.sh & | ||
| ./kc.sh start --optimized --import-realm --http-enabled true --proxy-headers xforwarded | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| #!/bin/bash | ||
|
|
||
| ########################################################################## | ||
|
|
||
| # ## Goal | ||
|
|
||
| # This script will replace the 'admin-cli' client default secret by | ||
| # a freshly generated one and then print it in the logs. | ||
|
|
||
| # In the second part of the script, the permissions needed to regenerate | ||
| # this secret will be removed. | ||
|
|
||
| # ## Usage | ||
|
|
||
| # This script is not intended to be ran manually, but it is executed | ||
| # during the Keycloak boot sequence and will regenerate the new | ||
| # secret only if the read value is the default one. | ||
|
|
||
| # ## Notes | ||
|
|
||
| # This script being executed to avoid a remaining default secret, | ||
| # all the ids needed in the commands are hardcoded. | ||
| # It would be more elegant to use grep and other bash tools to parse | ||
| # the json answers, but this will be done only if really needed (feel | ||
| # the pain as one says). | ||
|
|
||
| ########################################################################## | ||
|
|
||
| cd /opt/keycloak/bin/ | ||
|
|
||
| # wait till Keycloak is ready | ||
|
|
||
| READY=0 | ||
|
|
||
| while [ $READY -eq 0 ]; do | ||
| # Try to authenticate and capture response | ||
| RESPONSE=$(./kcadm.sh config credentials --server http://localhost:8080 --realm orthanc --client admin-cli --secret NPtsEUenl6nw8gJmM886TbvzuGPzvgt9 2>&1) | ||
|
|
||
| # Wait till Keycloak is ready | ||
| echo "$RESPONSE" | grep -q "Connection refused" | ||
| if [ $? -eq 0 ]; then | ||
| echo "### Keycloak is not ready (Connection refused). Retrying..." | ||
| sleep 3 | ||
| continue | ||
| fi | ||
|
|
||
| # If 'Invalid' is part of the response, the secret is already regenerated, so exit | ||
| echo "$RESPONSE" | grep -q "Invalid" | ||
| if [ $? -eq 0 ]; then | ||
| echo "### Access denied with the default secret, probably already regenerated. Exiting script..." | ||
| exit 0 | ||
| else | ||
| echo "### Keycloak is ready, script authenticated..." | ||
| READY=1 | ||
| fi | ||
| done | ||
|
|
||
| # from here, some lines are commented out (###) | ||
| # indeed, as explained above, everything is hardcoded for simplicity purposes | ||
| # but if there is a need to improve the script or to get new ids, the logic is here... | ||
|
|
||
| # get 'admin-cli' client id: | ||
| ###./kcadm.sh get clients -r orthanc --fields clientId,id | ||
|
|
||
| # regenerate the secret | ||
| RESPONSE=$(./kcadm.sh create clients/74a99b9d-221a-4dd1-9ba4-ec4f249c3e0a/client-secret -r orthanc 2>&1) | ||
|
|
||
| # if 'error' is part of the response, there is a problem, so warning message | ||
| if [[ "$RESPONSE" == *"error"* ]]; then | ||
| echo "### ERROR! Unable to regenerate the secret, maybe some missing permissions..." | ||
| fi | ||
|
|
||
| # get this new secret | ||
| RESPONSE=$(./kcadm.sh get clients/74a99b9d-221a-4dd1-9ba4-ec4f249c3e0a/client-secret -r orthanc 2>&1) | ||
|
|
||
| # print the secret | ||
| echo -e "\n##########################################################################################" | ||
| echo -e "Here is the secret to use for the KEYCLOAK_CLIENT_SECRET env var in the auth service:" | ||
| echo -e "$RESPONSE" | grep -o '"value" : "[^"]*"' | sed 's/"value" : "\(.*\)"/\1/' | ||
| echo -e "##########################################################################################\n" | ||
|
|
||
| # get service account user (a kind of account behind the account) | ||
| ###./kcadm.sh get clients/74a99b9d-221a-4dd1-9ba4-ec4f249c3e0a/service-account-user -r orthanc | ||
|
|
||
| # get roles for this account user | ||
| ###./kcadm.sh get users/35704d57-da75-4d73-81f4-85cd605398f4/role-mappings -r orthanc | ||
|
|
||
| # get clientMapping only | ||
| ###./kcadm.sh get users/35704d57-da75-4d73-81f4-85cd605398f4/role-mappings/clients/34c7489b-ad3c-4483-a523-e578c1c6dc45 -r orthanc | ||
|
|
||
| # remove permission manage-clients | ||
| RESPONSE=$(./kcadm.sh delete users/35704d57-da75-4d73-81f4-85cd605398f4/role-mappings/clients/34c7489b-ad3c-4483-a523-e578c1c6dc45 -r orthanc -b '[{"id": "f1360e68-78d5-4df1-a7f9-de0db0de8eb7", "name": "manage-clients"}, {"id": "098dc91c-18f2-4b22-a522-cf5ed10315a5", "name": "manage-users"}]' 2>&1) | ||
|
|
||
| # error case | ||
| if [ ${#RESPONSE} -ne 0 ]; then | ||
| echo -e "\n\n##### WARNING ! WARNING ! WARNING !" | ||
| echo -e "\n##### Unable to remove the permissions! Keycloak shoulnd t be used as it is!!\n\n" | ||
| exit 1 | ||
| fi | ||
|
|
||
| exit 0 |
Oops, something went wrong.