Skip to content

Commit 76f669e

Browse files
sbernauerlabrenbe
andauthored
Apply suggestions from code review
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
1 parent f83ee7e commit 76f669e

1 file changed

Lines changed: 5 additions & 5 deletions

File tree

docs/modules/opa/pages/usage-guide/user-info-fetcher.adoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,14 @@ Fetch groups and extra credentials, but not roles.
7070

7171
NOTE: The OAuth2 Client in Keycloak must be given the `view-users` _Service Account Role_ for the realm that the users are in.
7272

73-
user-info-fetcher needs a service account at Keycloak with the permissions to read user objects.
73+
The user-info-fetcher requires a service account in Keycloak with the permissions to read user objects.
7474
To create such as user you need to take the following steps:
7575

7676
*With your user realm selected* click on `Clients` at the left side and use the `Import client` button:
7777

7878
image::keycloak-user-info-fetcher/1.png[]
7979

80-
Create a file with the following JSON objects.
80+
Create a file with the following JSON object.
8181
Swap out `secret` with your desired password and potentially `redirectUris` and `webOrigins`.
8282

8383
[source,json]
@@ -116,11 +116,11 @@ To achieve this open the user and click on the `Role mapping tab`:
116116
image::keycloak-user-info-fetcher/3.png[]
117117

118118
Assign the role `view-users` as shown below.
119-
This is needed, so that the user is allowed to read other users information.
119+
This is necessary to allow the user to read other users' information.
120120

121121
image::keycloak-user-info-fetcher/4.png[]
122122

123-
Afterwards you can store the user-info-fetcher credentials in Kubernetes with something like
123+
Afterwards you can store the user-info-fetcher credentials in Kubernetes in a Secret:
124124

125125
[source,yaml]
126126
----
@@ -230,7 +230,7 @@ You can also use `-d '{"id":"123456"}'` to query by the user ID.
230230

231231
=== Rego rule library
232232

233-
You could call the HTTP API from rego rules yourself.
233+
The HTTP API exposed by the user-info-fetcher can be called directly using the rego function `http.send`.
234234
However, we provide a convenience rego rule library, which we ship with `OpaClusters` by default.
235235

236236
For example, the following rule allows access for users in the `/admin` group:

0 commit comments

Comments
 (0)