feat: Configuration Keycloak avec realm dédié
- Création du realm 'lions-user-manager' dédié à l'application - Configuration du client frontend uniquement (lions-user-manager-client) - Backend utilise directement l'Admin API (admin/admin) sans client séparé - Création de l'utilisateur de test: testuser/test123 - Création des rôles: admin, user_manager, user_viewer, auditor, sync_manager - Mise à jour des configurations pour utiliser le bon realm - Scripts de setup: setup-keycloak-correct.sh - Documentation: KEYCLOAK_SETUP.md Corrections par rapport à la première tentative: - Utilisation d'un realm dédié au lieu de 'master' - Pas de client pour le backend (utilise directement Admin API) - Configuration OIDC correcte pour le frontend
This commit is contained in:
lionsdev
177
setup-keycloak-correct.sh
Normal file
177
setup-keycloak-correct.sh
Normal file
@@ -0,0 +1,177 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Script de configuration Keycloak pour lions-user-manager
|
||||
# Configuration CORRECTE avec realm dédié et client uniquement pour le frontend
|
||||
|
||||
KEYCLOAK_URL="http://localhost:8180"
|
||||
MASTER_REALM="master"
|
||||
APP_REALM="lions-user-manager"
|
||||
ADMIN_USER="admin"
|
||||
ADMIN_PASS="admin"
|
||||
|
||||
echo "=== Configuration Keycloak pour lions-user-manager ==="
|
||||
echo ""
|
||||
|
||||
# 1. Obtenir le token d'administration
|
||||
echo "1. Connexion à Keycloak (realm master)..."
|
||||
TOKEN_RESPONSE=$(curl -s -X POST "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-d "username=${ADMIN_USER}" \
|
||||
-d "password=${ADMIN_PASS}" \
|
||||
-d "grant_type=password" \
|
||||
-d "client_id=admin-cli")
|
||||
|
||||
TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
|
||||
|
||||
if [ -z "$TOKEN" ]; then
|
||||
echo "❌ Erreur: Impossible d'obtenir le token d'accès"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Connexion réussie"
|
||||
|
||||
# 2. Créer le realm dédié pour l'application
|
||||
echo ""
|
||||
echo "2. Création du realm dédié '${APP_REALM}'..."
|
||||
RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${KEYCLOAK_URL}/admin/realms" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{
|
||||
\"realm\": \"${APP_REALM}\",
|
||||
\"displayName\": \"Lions User Manager\",
|
||||
\"enabled\": true,
|
||||
\"sslRequired\": \"none\",
|
||||
\"registrationAllowed\": false,
|
||||
\"loginWithEmailAllowed\": true,
|
||||
\"duplicateEmailsAllowed\": false,
|
||||
\"resetPasswordAllowed\": true,
|
||||
\"editUsernameAllowed\": false,
|
||||
\"bruteForceProtected\": true,
|
||||
\"accessTokenLifespan\": 3600,
|
||||
\"ssoSessionIdleTimeout\": 1800,
|
||||
\"ssoSessionMaxLifespan\": 36000
|
||||
}")
|
||||
|
||||
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
|
||||
if [ "$HTTP_CODE" == "201" ] || [ "$HTTP_CODE" == "409" ]; then
|
||||
echo "✅ Realm '${APP_REALM}' créé ou existe déjà"
|
||||
else
|
||||
echo "⚠️ Statut HTTP: $HTTP_CODE"
|
||||
fi
|
||||
|
||||
# 3. Créer UNIQUEMENT le client frontend
|
||||
echo ""
|
||||
echo "3. Création du client frontend 'lions-user-manager-client'..."
|
||||
RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/clients" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"clientId": "lions-user-manager-client",
|
||||
"name": "Lions User Manager Client",
|
||||
"description": "Interface web pour la gestion des utilisateurs",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"authorizationServicesEnabled": false,
|
||||
"secret": "client-secret-lions-2025",
|
||||
"redirectUris": [
|
||||
"http://localhost:8080/*",
|
||||
"http://localhost:8081/*"
|
||||
],
|
||||
"webOrigins": ["*"],
|
||||
"attributes": {
|
||||
"access.token.lifespan": "3600",
|
||||
"pkce.code.challenge.method": "S256"
|
||||
}
|
||||
}')
|
||||
|
||||
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
|
||||
if [ "$HTTP_CODE" == "201" ] || [ "$HTTP_CODE" == "409" ]; then
|
||||
echo "✅ Client frontend créé ou existe déjà"
|
||||
else
|
||||
echo "⚠️ Statut HTTP: $HTTP_CODE"
|
||||
fi
|
||||
|
||||
# 4. Créer les rôles realm dans le nouveau realm
|
||||
echo ""
|
||||
echo "4. Création des rôles dans le realm '${APP_REALM}'..."
|
||||
for role in admin user_manager user_viewer auditor sync_manager; do
|
||||
curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/roles" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"${role}\", \"description\": \"Rôle ${role}\"}" > /dev/null 2>&1
|
||||
echo " ✅ Rôle '${role}' créé"
|
||||
done
|
||||
|
||||
# 5. Créer un utilisateur de test dans le nouveau realm
|
||||
echo ""
|
||||
echo "5. Création d'un utilisateur de test dans le realm '${APP_REALM}'..."
|
||||
RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/users" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"username": "testuser",
|
||||
"email": "test@lions.dev",
|
||||
"firstName": "Test",
|
||||
"lastName": "User",
|
||||
"enabled": true,
|
||||
"emailVerified": true,
|
||||
"credentials": [{
|
||||
"type": "password",
|
||||
"value": "test123",
|
||||
"temporary": false
|
||||
}]
|
||||
}')
|
||||
|
||||
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
|
||||
if [ "$HTTP_CODE" == "201" ] || [ "$HTTP_CODE" == "409" ]; then
|
||||
echo "✅ Utilisateur 'testuser' créé (mot de passe: test123)"
|
||||
else
|
||||
echo "⚠️ Statut HTTP: $HTTP_CODE"
|
||||
fi
|
||||
|
||||
# 6. Récupérer et attribuer les rôles
|
||||
echo ""
|
||||
echo "6. Attribution des rôles à l'utilisateur..."
|
||||
USER_RESPONSE=$(curl -s -X GET "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/users?username=testuser" \
|
||||
-H "Authorization: Bearer ${TOKEN}")
|
||||
|
||||
USER_ID=$(echo "$USER_RESPONSE" | grep -o '"id":"[^"]*' | head -1 | cut -d'"' -f4)
|
||||
|
||||
if [ -n "$USER_ID" ]; then
|
||||
for role in admin user_manager; do
|
||||
ROLE_DATA=$(curl -s -X GET "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/roles/${role}" \
|
||||
-H "Authorization: Bearer ${TOKEN}")
|
||||
|
||||
curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${APP_REALM}/users/${USER_ID}/role-mappings/realm" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "[${ROLE_DATA}]" > /dev/null 2>&1
|
||||
|
||||
echo " ✅ Rôle '${role}' attribué à testuser"
|
||||
done
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Configuration terminée ==="
|
||||
echo ""
|
||||
echo "📋 Récapitulatif:"
|
||||
echo " • Realm dédié: ${APP_REALM}"
|
||||
echo " • Client Frontend: client_id=lions-user-manager-client, secret=client-secret-lions-2025"
|
||||
echo " • Backend: Utilise directement l'Admin API avec admin/admin (pas de client séparé)"
|
||||
echo " • Utilisateur de test: testuser / test123"
|
||||
echo " • Rôles créés: admin, user_manager, user_viewer, auditor, sync_manager"
|
||||
echo ""
|
||||
echo "🌐 Accès:"
|
||||
echo " • Backend: http://localhost:8081"
|
||||
echo " • Frontend: http://localhost:8080"
|
||||
echo " • Keycloak: http://localhost:8180"
|
||||
echo " • Admin Console: http://localhost:8180/admin (admin/admin)"
|
||||
echo ""
|
||||
echo "⚙️ Prochaines étapes:"
|
||||
echo " 1. Mettre à jour application-dev.properties avec realm=${APP_REALM}"
|
||||
echo " 2. Redémarrer les applications"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user