99 lines
4.4 KiB
Bash
99 lines
4.4 KiB
Bash
#!/bin/sh
|
|
# Corregge due impostazioni che l'import di realm-export.json non copre (vedi CLAUDE.md):
|
|
# 1. il client-scope built-in "organization" (creato da Keycloak con organizationsEnabled:true,
|
|
# non presente nel JSON) di default non include l'id dell'org nel claim JWT
|
|
# 2. il service account di scouthub-home-be non ha i client role di realm-management necessari
|
|
# a operare sulla Admin API (organizations, users, roles)
|
|
#
|
|
# Idempotente: eseguibile ad ogni avvio senza effetti collaterali se già a posto.
|
|
set -eu
|
|
|
|
KEYCLOAK_URL="http://keycloak:8080"
|
|
REALM="scouthub"
|
|
SA_CLIENT_ID="scouthub-home-be"
|
|
REQUIRED_REALM_MANAGEMENT_ROLES="manage-organizations manage-users view-realm view-users"
|
|
|
|
echo "[keycloak-init] attendo che $KEYCLOAK_URL sia pronto..."
|
|
until curl -sf "$KEYCLOAK_URL/realms/master/.well-known/openid-configuration" >/dev/null 2>&1; do
|
|
sleep 2
|
|
done
|
|
|
|
echo "[keycloak-init] attendo che il realm '$REALM' sia importato..."
|
|
until curl -sf "$KEYCLOAK_URL/realms/$REALM/.well-known/openid-configuration" >/dev/null 2>&1; do
|
|
sleep 2
|
|
done
|
|
|
|
get_admin_token() {
|
|
curl -sf -X POST "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" \
|
|
-d "client_id=admin-cli" \
|
|
-d "username=$KEYCLOAK_ADMIN" \
|
|
-d "password=$KEYCLOAK_ADMIN_PASSWORD" \
|
|
-d "grant_type=password" | jq -r '.access_token'
|
|
}
|
|
|
|
TOKEN="$(get_admin_token)"
|
|
if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
|
|
echo "[keycloak-init] impossibile ottenere il token admin, esco." >&2
|
|
exit 1
|
|
fi
|
|
|
|
auth_get() { curl -sf -H "Authorization: Bearer $TOKEN" "$KEYCLOAK_URL$1"; }
|
|
|
|
# --- 1. client-scope "organization": abilita addOrganizationId -------------------------------
|
|
SCOPE_ID="$(auth_get "/admin/realms/$REALM/client-scopes" | jq -r '.[] | select(.name=="organization") | .id')"
|
|
|
|
if [ -z "$SCOPE_ID" ]; then
|
|
echo "[keycloak-init] client-scope 'organization' non trovato, salto." >&2
|
|
else
|
|
MAPPER_JSON="$(auth_get "/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models" \
|
|
| jq -c '.[] | select(.name=="organization")')"
|
|
MAPPER_ID="$(echo "$MAPPER_JSON" | jq -r '.id')"
|
|
ALREADY_SET="$(echo "$MAPPER_JSON" | jq -r '.config.addOrganizationId // "false"')"
|
|
|
|
if [ "$ALREADY_SET" = "true" ]; then
|
|
echo "[keycloak-init] mapper 'organization': addOrganizationId già attivo."
|
|
else
|
|
UPDATED_MAPPER="$(echo "$MAPPER_JSON" | jq '.config.addOrganizationId = "true"')"
|
|
curl -sf -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
|
|
"$KEYCLOAK_URL/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models/$MAPPER_ID" \
|
|
-d "$UPDATED_MAPPER" >/dev/null
|
|
echo "[keycloak-init] mapper 'organization': addOrganizationId attivato."
|
|
fi
|
|
fi
|
|
|
|
# --- 2. service account di scouthub-home-be: ruoli realm-management ---------------------------
|
|
SA_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=$SA_CLIENT_ID" | jq -r '.[0].id')"
|
|
if [ -z "$SA_UUID" ] || [ "$SA_UUID" = "null" ]; then
|
|
echo "[keycloak-init] client '$SA_CLIENT_ID' non trovato, salto." >&2
|
|
else
|
|
SA_USER_ID="$(auth_get "/admin/realms/$REALM/clients/$SA_UUID/service-account-user" | jq -r '.id')"
|
|
RM_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=realm-management" | jq -r '.[0].id')"
|
|
|
|
GIA_ASSEGNATI="$(auth_get "/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" | jq -r '.[].name')"
|
|
DISPONIBILI="$(auth_get "/admin/realms/$REALM/clients/$RM_UUID/roles")"
|
|
|
|
DA_ASSEGNARE="[]"
|
|
for ROLE in $REQUIRED_REALM_MANAGEMENT_ROLES; do
|
|
if echo "$GIA_ASSEGNATI" | grep -qx "$ROLE"; then
|
|
continue
|
|
fi
|
|
ROLE_REPR="$(echo "$DISPONIBILI" | jq -c --arg name "$ROLE" '.[] | select(.name==$name)')"
|
|
if [ -z "$ROLE_REPR" ]; then
|
|
echo "[keycloak-init] ruolo '$ROLE' non esiste su questa versione di Keycloak, salto." >&2
|
|
continue
|
|
fi
|
|
DA_ASSEGNARE="$(echo "$DA_ASSEGNARE" | jq -c --argjson r "$ROLE_REPR" '. + [$r]')"
|
|
done
|
|
|
|
if [ "$(echo "$DA_ASSEGNARE" | jq 'length')" = "0" ]; then
|
|
echo "[keycloak-init] service account '$SA_CLIENT_ID': ruoli realm-management già a posto."
|
|
else
|
|
curl -sf -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
|
|
"$KEYCLOAK_URL/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" \
|
|
-d "$DA_ASSEGNARE" >/dev/null
|
|
echo "[keycloak-init] service account '$SA_CLIENT_ID': assegnati $(echo "$DA_ASSEGNARE" | jq -r '[.[].name] | join(", ")')."
|
|
fi
|
|
fi
|
|
|
|
echo "[keycloak-init] completato."
|