@@ -70,14 +70,14 @@ Fetch groups and extra credentials, but not roles.
7070
7171NOTE: The OAuth2 Client in Keycloak must be given the `view-users` _Service Account Role_ for the realm that the users are in.
7272
73- user-info-fetcher needs a service account at Keycloak with the permissions to read user objects.
73+ The user-info-fetcher requires a service account in Keycloak with the permissions to read user objects.
7474To create such as user you need to take the following steps:
7575
7676*With your user realm selected* click on `Clients` at the left side and use the `Import client` button:
7777
7878image::keycloak-user-info-fetcher/1.png[]
7979
80- Create a file with the following JSON objects .
80+ Create a file with the following JSON object .
8181Swap out `secret` with your desired password and potentially `redirectUris` and `webOrigins` .
8282
8383[source,json]
@@ -116,11 +116,11 @@ To achieve this open the user and click on the `Role mapping tab`:
116116image::keycloak-user-info-fetcher/3.png[]
117117
118118Assign the role `view-users` as shown below.
119- This is needed, so that the user is allowed to read other users information.
119+ This is necessary to allow the user to read other users' information.
120120
121121image::keycloak-user-info-fetcher/4.png[]
122122
123- Afterwards you can store the user-info-fetcher credentials in Kubernetes with something like
123+ Afterwards you can store the user-info-fetcher credentials in Kubernetes in a Secret:
124124
125125[source,yaml]
126126----
@@ -230,7 +230,7 @@ You can also use `-d '{"id":"123456"}'` to query by the user ID.
230230
231231=== Rego rule library
232232
233- You could call the HTTP API from rego rules yourself .
233+ The HTTP API exposed by the user-info-fetcher can be called directly using the rego function `http.send` .
234234However, we provide a convenience rego rule library, which we ship with `OpaClusters` by default.
235235
236236For example, the following rule allows access for users in the `/admin` group:
0 commit comments