Merge pull request #207 from cyberark/feature/ONYX-17901

Added operation calls for authenticating and fetching authentication …

Author: telday

CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Nothing should go in this section, please add to the latest unreleased version
   (and update the corresponding date), or add a new version.
 
+## [5.3.9] - 2022-05-12
+
+### Changed
+- Adding operation call to fetch authentication providers
+  [cyberark/conjur-api-ruby#206](https://github.com/cyberark/conjur-api-ruby/pull/206)
+
 ## [5.3.8] - 2022-04-26
 
 ### Changed

ci/configure_v5.sh

@@ -1,5 +1,7 @@
 #!/bin/bash -e
 
+source ./ci/oauth/keycloak/keycloak_functions.sh
+
 cat << "CONFIGURE" | docker exec -i $(docker-compose ps -q conjur_5) bash
 set -e
 
@@ -12,3 +14,6 @@ done
 # So we fail if the server isn't up yet:
 curl -o /dev/null -fs -X OPTIONS http://localhost > /dev/null
 CONFIGURE
+
+fetch_keycloak_certificate
+create_keycloak_users

ci/oauth/keycloak/create_client

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+
+keycloak/bin/kcreg.sh config credentials \
+  --server http://localhost:8080/auth \
+  --realm master \
+  --user "$KEYCLOAK_USER" \
+  --password "$KEYCLOAK_PASSWORD"
+
+keycloak/bin/kcreg.sh create \
+  -s clientId="$KEYCLOAK_CLIENT_ID" \
+  -s "redirectUris=[\"$KEYCLOAK_REDIRECT_URI\"]" \
+  -s "secret=$KEYCLOAK_CLIENT_SECRET"
+
+# Enable direct access to get an id token with username & password
+keycloak/bin/kcreg.sh update conjurClient -s directAccessGrantsEnabled=true
+
+keycloak/bin/kcreg.sh get "$KEYCLOAK_CLIENT_ID" | jq '.secret'

ci/oauth/keycloak/create_user

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+echo "login as admin with user $KEYCLOAK_USER"
+
+keycloak/bin/kcadm.sh config credentials \
+  --server http://localhost:8080/auth \
+  --realm master \
+  --user "$KEYCLOAK_USER" \
+  --password "$KEYCLOAK_PASSWORD"
+
+echo "creating user $1 with email $3"
+
+keycloak/bin/kcadm.sh create users \
+  -s username="$1" \
+  -s email="$3" \
+  -s enabled=true
+
+echo "setting password of user $1 to $2"
+keycloak/bin/kcadm.sh set-password \
+  --username "$1" \
+  -p "$2"

ci/oauth/keycloak/fetch_certificate

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# This script retrieves a certificate from the keycloak OIDC provider
+# and puts it to a trusted operating system store.
+# It is needed to communicate with the provider via SSL for validating ID tokens
+
+openssl s_client \
+  -showcerts \
+  -connect keycloak:8443 \
+  -servername keycloak \
+  </dev/null | \
+  openssl x509 \
+    -outform PEM \
+    >/etc/ssl/certs/keycloak.pem
+
+hash=$(openssl x509 -hash -in /etc/ssl/certs/keycloak.pem -out /dev/null)
+
+ln -s /etc/ssl/certs/keycloak.pem "/etc/ssl/certs/${hash}.0"

ci/oauth/keycloak/keycloak_functions.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+
+KEYCLOAK_SERVICE_NAME="keycloak"
+
+# Note: the single arg is a nameref, which this function sets to an array
+# containing items of the form "KEY=VAL".
+function _hydrate_keycloak_env_args() {
+  local -n arr=$1
+  local keycloak_items
+
+  readarray -t keycloak_items < <(
+    set -o pipefail
+    # Note: This prints all lines that look like:
+    # KEYCLOAK_XXX=someval
+    docker-compose exec -T ${KEYCLOAK_SERVICE_NAME} printenv | awk '/KEYCLOAK/'
+  )
+
+  # shellcheck disable=SC2034
+  arr=(
+    "${keycloak_items[@]}"
+    "PROVIDER_URI=https://keycloak:8443/auth/realms/master"
+    "PROVIDER_INTERNAL_URI=http://keycloak:8080/auth/realms/master/protocol/openid-connect"
+    "PROVIDER_ISSUER=http://keycloak:8080/auth/realms/master"
+    "ID_TOKEN_USER_PROPERTY=preferred_username"
+  )
+}
+
+# The arguments must be unexpanded variable names.  Eg:
+#
+# _create_keycloak_user '$APP_USER' '$APP_PW' '$APP_EMAIL'
+#
+# This is because those variables are not available to this script. They are
+# available to bash commands run via "docker-compose exec keycloak bash
+# -c...", since they're defined in the docker-compose.yml.
+function _create_keycloak_user() {
+  local user_var=$1
+  local pw_var=$2
+  local email_var=$3
+
+  docker-compose exec -T \
+    ${KEYCLOAK_SERVICE_NAME} \
+    bash -c "/scripts/create_user \"$user_var\" \"$pw_var\" \"$email_var\""
+}
+
+function create_keycloak_users() {
+  echo "Defining keycloak client"
+
+  docker-compose exec -T ${KEYCLOAK_SERVICE_NAME} /scripts/create_client
+
+  echo "Creating user 'alice' in Keycloak"
+
+  # Note: We want to pass the bash command thru without expansion here.
+  # shellcheck disable=SC2016
+  _create_keycloak_user \
+    '$KEYCLOAK_APP_USER' \
+    '$KEYCLOAK_APP_USER_PASSWORD' \
+    '$KEYCLOAK_APP_USER_EMAIL'
+}
+
+function wait_for_keycloak_server() {
+  docker-compose exec -T \
+    ${KEYCLOAK_SERVICE_NAME} /scripts/wait_for_server
+}
+
+function fetch_keycloak_certificate() {
+  # there's a dep on the docker-compose.yml volumes.
+  # Fetch SSL cert to communicate with keycloak (OIDC provider).
+  echo "Initialize keycloak certificate in conjur server"
+  docker-compose exec -T \
+    conjur_5 /scripts/fetch_certificate
+}