e20ff4cb60
keycloak_openid_user_client_role_protocol_mapper.grafana_role_mapper was missing. It is configured to make the client roles for this Application (and only those for this application) available in the grafana_roles claim. We can also disable full scope, as we're not interested in other role mappings. The Terraform files are a bit reorganized, everything configuring the Grafana client lives in grafana.tf (and vice-versa for Forgejo, Buildkite and Gerrit). The only thing left in permissions.tf is global groups, their memberships and mappings. Change-Id: I37b0755f4f8658518083353ec6cc0193e805d5c2 Reviewed-on: https://cl.snix.dev/c/snix/+/30476 Tested-by: besadii Autosubmit: Florian Klink <flokli@flokli.de> Reviewed-by: Jonas Chevalier <zimbatm@zimbatm.com>
60 lines
1.4 KiB
HCL
60 lines
1.4 KiB
HCL
# This sets the permissions for various groups and users.
|
|
|
|
# TODO: Realm-level composite roles
|
|
# resource "keycloak_role" "is_local_admin" {
|
|
# composite_roles = [
|
|
# keycloak_role.blablabla.id
|
|
# ]
|
|
# }
|
|
#
|
|
# resource "keycloak_role" "can_manage_trusted_contributors" {
|
|
# }
|
|
#
|
|
# # WARNING: This give PII access to the user.
|
|
# resource "keycloak_role" "can_manage_snix" {
|
|
# }
|
|
|
|
# Realm-level groups to bestow to users.
|
|
resource "keycloak_group" "snix_core_team" {
|
|
realm_id = keycloak_realm.snix.id
|
|
name = "snix core team"
|
|
}
|
|
|
|
resource "keycloak_group_roles" "snix_core_team_roles" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.snix_core_team.id
|
|
|
|
role_ids = [
|
|
# keycloak_role.is_local_admin,
|
|
# keycloak_role.can_manage_snix,
|
|
keycloak_role.grafana_admin.id,
|
|
# keycloak_role.forgejo_admin.id,
|
|
# keycloak_role.gerrit_admin.id
|
|
]
|
|
}
|
|
|
|
resource "keycloak_group_memberships" "snix_core_team_members" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.snix_core_team.id
|
|
|
|
members = [
|
|
"edef",
|
|
"flokli",
|
|
"raitobezarius"
|
|
]
|
|
}
|
|
|
|
resource "keycloak_group" "trusted_contributors" {
|
|
name = "trusted contributors"
|
|
realm_id = keycloak_realm.snix.id
|
|
|
|
}
|
|
|
|
resource "keycloak_group_roles" "trusted_contributors_roles" {
|
|
realm_id = keycloak_realm.snix.id
|
|
group_id = keycloak_group.trusted_contributors.id
|
|
|
|
role_ids = [
|
|
keycloak_role.grafana_editor.id
|
|
]
|
|
}
|