e20ff4cb60
keycloak_openid_user_client_role_protocol_mapper.grafana_role_mapper was missing. It is configured to make the client roles for this Application (and only those for this application) available in the grafana_roles claim. We can also disable full scope, as we're not interested in other role mappings. The Terraform files are a bit reorganized, everything configuring the Grafana client lives in grafana.tf (and vice-versa for Forgejo, Buildkite and Gerrit). The only thing left in permissions.tf is global groups, their memberships and mappings. Change-Id: I37b0755f4f8658518083353ec6cc0193e805d5c2 Reviewed-on: https://cl.snix.dev/c/snix/+/30476 Tested-by: besadii Autosubmit: Florian Klink <flokli@flokli.de> Reviewed-by: Jonas Chevalier <zimbatm@zimbatm.com>
31 lines
1.2 KiB
HCL
31 lines
1.2 KiB
HCL
# resource "keycloak_saml_client" "buildkite" {
|
|
# realm_id = keycloak_realm.snix.id
|
|
# client_id = "https://buildkite.com"
|
|
# name = "Buildkite"
|
|
# base_url = "https://buildkite.com/sso/snix"
|
|
|
|
# client_signature_required = false
|
|
# assertion_consumer_post_url = "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
|
|
|
|
# valid_redirect_uris = [
|
|
# "https://buildkite.com/sso/~/1531aca5-f49c-4151-8832-a451e758af4c/saml/consume"
|
|
# ]
|
|
# }
|
|
|
|
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_email" {
|
|
# realm_id = keycloak_realm.snix.id
|
|
# client_id = keycloak_saml_client.buildkite.id
|
|
# name = "buildkite-email-mapper"
|
|
# user_attribute = "email"
|
|
# saml_attribute_name = "email"
|
|
# saml_attribute_name_format = "Unspecified"
|
|
# }
|
|
|
|
# resource "keycloak_saml_user_attribute_protocol_mapper" "buildkite_name" {
|
|
# realm_id = keycloak_realm.snix.id
|
|
# client_id = keycloak_saml_client.buildkite.id
|
|
# name = "buildkite-name-mapper"
|
|
# user_attribute = "displayName"
|
|
# saml_attribute_name = "name"
|
|
# saml_attribute_name_format = "Unspecified"
|
|
# }
|