maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/keycloak): configure Buildkite SAML

Browse source 
This enables logging in to Buildkite with SAML.

Fixes #95.

Change-Id: Ieaa87c660692953305619c2bd8270d2329bd7545
Reviewed-on: https://cl.snix.dev/c/snix/+/30478
Autosubmit: Florian Klink <flokli@flokli.de>
Tested-by: besadii
Reviewed-by: Jonas Chevalier <zimbatm@zimbatm.com>
This commit is contained in:
Florian Klink 2025-05-05 02:59:36 +03:00 • committed by clbot
parent d9ca20a5cc
commit c706826aa9
1 changed files with 31 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

58
ops/keycloak/buildkite.tf
View file

@ -1,31 +1,35 @@
# resource "keycloak_saml_client" "buildkite" {
# realm_id = keycloak_realm.snix.id
# client_id = "https://buildkite.com"
# name = "Buildkite"
# base_url = "https://buildkite.com/sso/snix"
# On the Buildkite site, first create manually, then use
# $BUILDKITE_URL/realms/$realm/protocol/saml/descriptor as Meta Data URL
resource "keycloak_saml_client" "buildkite" {
realm_id = keycloak_realm.snix.id
client_id = "https://buildkite.com"
name = "Buildkite"
base_url = "https://buildkite.com/sso/snix"
# client_signature_required = false
# assertion_consumer_post_url = "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
client_signature_required = false
assertion_consumer_post_url = "https://buildkite.com/sso/~/01969dae-b653-4e3e-8056-eff685823c6f/saml/consume"
# valid_redirect_uris = [
# "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
# ]
# }
valid_redirect_uris = [
"https://buildkite.com/sso/~/01969dae-b653-4e3e-8056-eff685823c6f/saml/consume"
]
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_email" {
# realm_id = keycloak_realm.snix.id
# client_id = keycloak_saml_client.buildkite.id
# name = "buildkite-email-mapper"
# user_attribute = "email"
# saml_attribute_name = "email"
# saml_attribute_name_format = "Unspecified"
# }
full_scope_allowed = false
}
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_name" {
# realm_id = keycloak_realm.snix.id
# client_id = keycloak_saml_client.buildkite.id
# name = "buildkite-name-mapper"
# user_attribute = "displayName"
# saml_attribute_name = "name"
# saml_attribute_name_format = "Unspecified"
# }
resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_email" {
realm_id = keycloak_realm.snix.id
client_id = keycloak_saml_client.buildkite.id
name = "buildkite-email-mapper"
user_attribute = "email"
saml_attribute_name = "email"
saml_attribute_name_format = "Unspecified"
}
resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_name" {
realm_id = keycloak_realm.snix.id
client_id = keycloak_saml_client.buildkite.id
name = "buildkite-name-mapper"
user_attribute = "displayName"
saml_attribute_name = "name"
saml_attribute_name_format = "Unspecified"
}