maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ops/keycloak): fix assigning grafana_roles

Browse source 
keycloak_openid_user_client_role_protocol_mapper.grafana_role_mapper was
missing. It is configured to make the client roles for this Application
(and only those for this application) available in the grafana_roles
claim.

We can also disable full scope, as we're not interested in other role
mappings.

The Terraform files are a bit reorganized, everything configuring the
Grafana client lives in grafana.tf (and vice-versa for Forgejo,
Buildkite and Gerrit). The only thing left in permissions.tf is global
groups, their memberships and mappings.

Change-Id: I37b0755f4f8658518083353ec6cc0193e805d5c2
Reviewed-on: https://cl.snix.dev/c/snix/+/30476
Tested-by: besadii
Autosubmit: Florian Klink <flokli@flokli.de>
Reviewed-by: Jonas Chevalier <zimbatm@zimbatm.com>
This commit is contained in:
Florian Klink 2025-05-05 00:34:23 +03:00 • committed by clbot
parent 018f3b38a6
commit e20ff4cb60
7 changed files with 144 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

31
ops/keycloak/buildkite.tf Normal file
View file

@ -0,0 +1,31 @@
# resource "keycloak_saml_client" "buildkite" {
# realm_id = keycloak_realm.snix.id
# client_id = "https://buildkite.com"
# name = "Buildkite"
# base_url = "https://buildkite.com/sso/snix"
# client_signature_required = false
# assertion_consumer_post_url = "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
# valid_redirect_uris = [
# "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
# ]
# }
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_email" {
# realm_id = keycloak_realm.snix.id
# client_id = keycloak_saml_client.buildkite.id
# name = "buildkite-email-mapper"
# user_attribute = "email"
# saml_attribute_name = "email"
# saml_attribute_name_format = "Unspecified"
# }
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_name" {
# realm_id = keycloak_realm.snix.id
# client_id = keycloak_saml_client.buildkite.id
# name = "buildkite-name-mapper"
# user_attribute = "displayName"
# saml_attribute_name = "name"
# saml_attribute_name_format = "Unspecified"
# }