Fix Generali

2026-07-25 18:40:29 +02:00
parent 1326a3c887
commit 5855352c8c
11 changed files with 171 additions and 21 deletions
@@ -0,0 +1,98 @@
+#!/bin/sh
+# Corregge due impostazioni che l'import di realm-export.json non copre (vedi CLAUDE.md):
+# 1. il client-scope built-in "organization" (creato da Keycloak con organizationsEnabled:true,
+#    non presente nel JSON) di default non include l'id dell'org nel claim JWT
+# 2. il service account di scouthub-home-be non ha i client role di realm-management necessari
+#    a operare sulla Admin API (organizations, users, roles)
+#
+# Idempotente: eseguibile ad ogni avvio senza effetti collaterali se già a posto.
+set -eu
+
+KEYCLOAK_URL="http://keycloak:8080"
+REALM="scouthub"
+SA_CLIENT_ID="scouthub-home-be"
+REQUIRED_REALM_MANAGEMENT_ROLES="manage-organizations manage-users view-realm view-users"
+
+echo "[keycloak-init] attendo che $KEYCLOAK_URL sia pronto..."
+until curl -sf "$KEYCLOAK_URL/realms/master/.well-known/openid-configuration" >/dev/null 2>&1; do
+  sleep 2
+done
+
+echo "[keycloak-init] attendo che il realm '$REALM' sia importato..."
+until curl -sf "$KEYCLOAK_URL/realms/$REALM/.well-known/openid-configuration" >/dev/null 2>&1; do
+  sleep 2
+done
+
+get_admin_token() {
+  curl -sf -X POST "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" \
+    -d "client_id=admin-cli" \
+    -d "username=$KEYCLOAK_ADMIN" \
+    -d "password=$KEYCLOAK_ADMIN_PASSWORD" \
+    -d "grant_type=password" | jq -r '.access_token'
+}
+
+TOKEN="$(get_admin_token)"
+if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
+  echo "[keycloak-init] impossibile ottenere il token admin, esco." >&2
+  exit 1
+fi
+
+auth_get() { curl -sf -H "Authorization: Bearer $TOKEN" "$KEYCLOAK_URL$1"; }
+
+# --- 1. client-scope "organization": abilita addOrganizationId -------------------------------
+SCOPE_ID="$(auth_get "/admin/realms/$REALM/client-scopes" | jq -r '.[] | select(.name=="organization") | .id')"
+
+if [ -z "$SCOPE_ID" ]; then
+  echo "[keycloak-init] client-scope 'organization' non trovato, salto." >&2
+else
+  MAPPER_JSON="$(auth_get "/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models" \
+    | jq -c '.[] | select(.name=="organization")')"
+  MAPPER_ID="$(echo "$MAPPER_JSON" | jq -r '.id')"
+  ALREADY_SET="$(echo "$MAPPER_JSON" | jq -r '.config.addOrganizationId // "false"')"
+
+  if [ "$ALREADY_SET" = "true" ]; then
+    echo "[keycloak-init] mapper 'organization': addOrganizationId già attivo."
+  else
+    UPDATED_MAPPER="$(echo "$MAPPER_JSON" | jq '.config.addOrganizationId = "true"')"
+    curl -sf -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+      "$KEYCLOAK_URL/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models/$MAPPER_ID" \
+      -d "$UPDATED_MAPPER" >/dev/null
+    echo "[keycloak-init] mapper 'organization': addOrganizationId attivato."
+  fi
+fi
+
+# --- 2. service account di scouthub-home-be: ruoli realm-management ---------------------------
+SA_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=$SA_CLIENT_ID" | jq -r '.[0].id')"
+if [ -z "$SA_UUID" ] || [ "$SA_UUID" = "null" ]; then
+  echo "[keycloak-init] client '$SA_CLIENT_ID' non trovato, salto." >&2
+else
+  SA_USER_ID="$(auth_get "/admin/realms/$REALM/clients/$SA_UUID/service-account-user" | jq -r '.id')"
+  RM_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=realm-management" | jq -r '.[0].id')"
+
+  GIA_ASSEGNATI="$(auth_get "/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" | jq -r '.[].name')"
+  DISPONIBILI="$(auth_get "/admin/realms/$REALM/clients/$RM_UUID/roles")"
+
+  DA_ASSEGNARE="[]"
+  for ROLE in $REQUIRED_REALM_MANAGEMENT_ROLES; do
+    if echo "$GIA_ASSEGNATI" | grep -qx "$ROLE"; then
+      continue
+    fi
+    ROLE_REPR="$(echo "$DISPONIBILI" | jq -c --arg name "$ROLE" '.[] | select(.name==$name)')"
+    if [ -z "$ROLE_REPR" ]; then
+      echo "[keycloak-init] ruolo '$ROLE' non esiste su questa versione di Keycloak, salto." >&2
+      continue
+    fi
+    DA_ASSEGNARE="$(echo "$DA_ASSEGNARE" | jq -c --argjson r "$ROLE_REPR" '. + [$r]')"
+  done
+
+  if [ "$(echo "$DA_ASSEGNARE" | jq 'length')" = "0" ]; then
+    echo "[keycloak-init] service account '$SA_CLIENT_ID': ruoli realm-management già a posto."
+  else
+    curl -sf -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+      "$KEYCLOAK_URL/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" \
+      -d "$DA_ASSEGNARE" >/dev/null
+    echo "[keycloak-init] service account '$SA_CLIENT_ID': assegnati $(echo "$DA_ASSEGNARE" | jq -r '[.[].name] | join(", ")')."
+  fi
+fi
+
+echo "[keycloak-init] completato."