Skip to content

Commit 8100931

Browse files
felixeversfelixevers
committed
implement frontend auth
1 parent c90f4bf commit 8100931

File tree

21 files changed

+496
-152
lines changed

21 files changed

+496
-152
lines changed

‎backend/.env.example‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
ENV="development"
2+
13
DATABASE_HOSTNAME="postgres"
24
DATABASE_NAME="postgres"
35
DATABASE_USERNAME="postgres"
@@ -8,7 +10,5 @@ REDIS_PASSWORD="password"
810

911
ISSUER_URI="http://keycloak:8080/realms/tasks"
1012
PUBLIC_ISSUER_URI="http://localhost:8080/realms/tasks"
11-
CLIENT_ID="tasks"
13+
CLIENT_ID="tasks-backend"
1214
CLIENT_SECRET="tasks-secret"
13-
14-
ENV="development"

‎backend/config.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,5 +36,5 @@
3636
"PUBLIC_ISSUER_URI",
3737
ISSUER_URI,
3838
)
39-
CLIENT_ID = os.getenv("CLIENT_ID", "tasks")
39+
CLIENT_ID = os.getenv("CLIENT_ID", "tasks-backend")
4040
CLIENT_SECRET = os.getenv("CLIENT_SECRET", "tasks-secret")

‎docker-compose.dev.yml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,21 @@
11
services:
2+
keycloak-postgres:
3+
image: postgres:15.15
4+
volumes:
5+
- "keycloak-data:/var/lib/postgresql"
6+
environment:
7+
POSTGRES_DB: "keycloak"
8+
POSTGRES_USER: "keycloak"
9+
POSTGRES_PASSWORD: "password"
10+
211
keycloak:
3-
image: quay.io/keycloak/keycloak
12+
image: quay.io/keycloak/keycloak:26.4
413
environment:
14+
KC_DB: "postgres"
15+
KC_DB_URL: "jdbc:postgresql://keycloak-postgres:5432/keycloak"
16+
KC_DB_USERNAME: "keycloak"
17+
KC_DB_PASSWORD: "password"
18+
519
KC_HOSTNAME: "localhost"
620
KC_HOSTNAME_PORT: 8080
721
KC_HOSTNAME_STRICT: false
@@ -11,12 +25,11 @@ services:
1125
command: start-dev --import-realm
1226
volumes:
1327
- "./keycloak:/opt/keycloak/data/import:ro"
14-
- "keycloak-data:/opt/keycloak/data"
1528
ports:
1629
- "8080:8080"
1730

1831
postgres:
19-
image: postgres
32+
image: postgres:15.15
2033
environment:
2134
POSTGRES_DB: "postgres"
2235
POSTGRES_USER: "postgres"
@@ -49,7 +62,7 @@ services:
4962

5063
ISSUER_URI: "http://keycloak:8080/realms/tasks"
5164
PUBLIC_ISSUER_URI: "http://localhost:8080/realms/tasks"
52-
CLIENT_ID: "tasks"
65+
CLIENT_ID: "tasks-backend"
5366
CLIENT_SECRET: "tasks-secret"
5467
depends_on:
5568
- postgres
@@ -61,7 +74,7 @@ services:
6174
- "3000:80"
6275
environment:
6376
ISSUER_URI: "http://localhost:8080/realms/tasks"
64-
CLIENT_ID: "tasks"
77+
CLIENT_ID: "tasks-web"
6578
depends_on:
6679
- backend
6780

‎docker-compose.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,21 @@
11
services:
2+
keycloak-postgres:
3+
image: postgres:15.15
4+
volumes:
5+
- "keycloak-data:/var/lib/postgresql"
6+
environment:
7+
POSTGRES_DB: "keycloak"
8+
POSTGRES_USER: "keycloak"
9+
POSTGRES_PASSWORD: "password"
10+
211
keycloak:
312
image: quay.io/keycloak/keycloak:26.4
413
environment:
14+
KC_DB: "postgres"
15+
KC_DB_URL: "jdbc:postgresql://keycloak-postgres:5432/keycloak"
16+
KC_DB_USERNAME: "keycloak"
17+
KC_DB_PASSWORD: "password"
18+
519
KC_HOSTNAME: "localhost"
620
KC_HOSTNAME_PORT: 8080
721
KC_HOSTNAME_STRICT: false
@@ -11,7 +25,6 @@ services:
1125
command: start-dev --import-realm
1226
volumes:
1327
- "./keycloak:/opt/keycloak/data/import:ro"
14-
- "keycloak-data:/opt/keycloak/data"
1528
ports:
1629
- "8080:8080"
1730

@@ -41,7 +54,7 @@ services:
4154

4255
ISSUER_URI: "http://keycloak:8080/realms/tasks"
4356
PUBLIC_ISSUER_URI: "http://localhost:8080/realms/tasks"
44-
CLIENT_ID: "tasks"
57+
CLIENT_ID: "tasks-backend"
4558
CLIENT_SECRET: "tasks-secret"
4659

4760
ENV: "development"
@@ -53,7 +66,7 @@ services:
5366
image: ghcr.io/helpwave/tasks-web:latest
5467
environment:
5568
ISSUER_URI: "http://localhost:8080/realms/tasks"
56-
CLIENT_ID: "tasks"
69+
CLIENT_ID: "tasks-web"
5770
depends_on:
5871
- backend
5972

‎keycloak/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Disclaimer
22

3-
`tasks.json` is a realm file.
4-
You can import it into your *development* keycloak.
5-
This configuration has preset credentials in it. Make sure to *not use it in production*.
3+
`tasks.json` is a realm file.
4+
You can import it into your **development** keycloak.
5+
This configuration has preset credentials in it. Make sure to **not use it in production**.

‎keycloak/tasks.json‎

Lines changed: 75 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@
154154
"composite" : true,
155155
"composites" : {
156156
"client" : {
157-
"realm-management" : [ "view-events", "query-realms", "view-users", "manage-identity-providers", "query-groups", "manage-events", "query-users", "manage-authorization", "impersonation", "create-client", "view-clients", "manage-clients", "view-identity-providers", "view-authorization", "query-clients", "view-realm", "manage-realm", "manage-users" ]
157+
"realm-management" : [ "query-realms", "view-events", "view-users", "manage-identity-providers", "query-groups", "manage-events", "query-users", "manage-authorization", "impersonation", "create-client", "view-clients", "manage-clients", "view-authorization", "view-identity-providers", "query-clients", "manage-realm", "view-realm", "manage-users" ]
158158
}
159159
},
160160
"clientRole" : true,
@@ -247,6 +247,8 @@
247247
"attributes" : { }
248248
} ],
249249
"security-admin-console" : [ ],
250+
"tasks-web" : [ ],
251+
"tasks-backend" : [ ],
250252
"admin-cli" : [ ],
251253
"account-console" : [ ],
252254
"broker" : [ {
@@ -332,8 +334,7 @@
332334
"clientRole" : true,
333335
"containerId" : "1343d64d-58b3-494e-af8d-dc951ab7227e",
334336
"attributes" : { }
335-
} ],
336-
"tasks" : [ ]
337+
} ]
337338
}
338339
},
339340
"groups" : [ ],
@@ -504,7 +505,8 @@
504505
"protocol" : "openid-connect",
505506
"attributes" : {
506507
"realm_client" : "false",
507-
"client.use.lightweight.access.token.enabled" : "true"
508+
"client.use.lightweight.access.token.enabled" : "true",
509+
"post.logout.redirect.uris" : "+"
508510
},
509511
"authenticationFlowBindingOverrides" : { },
510512
"fullScopeAllowed" : true,
@@ -532,7 +534,8 @@
532534
"frontchannelLogout" : false,
533535
"protocol" : "openid-connect",
534536
"attributes" : {
535-
"realm_client" : "true"
537+
"realm_client" : "true",
538+
"post.logout.redirect.uris" : "+"
536539
},
537540
"authenticationFlowBindingOverrides" : { },
538541
"fullScopeAllowed" : false,
@@ -560,7 +563,8 @@
560563
"frontchannelLogout" : false,
561564
"protocol" : "openid-connect",
562565
"attributes" : {
563-
"realm_client" : "true"
566+
"realm_client" : "true",
567+
"post.logout.redirect.uris" : "+"
564568
},
565569
"authenticationFlowBindingOverrides" : { },
566570
"fullScopeAllowed" : false,
@@ -618,8 +622,8 @@
618622
"optionalClientScopes" : [ "address", "phone", "organization", "offline_access", "microprofile-jwt" ]
619623
}, {
620624
"id" : "e43b587c-07db-445d-b6d9-e9b4b7cd03ac",
621-
"clientId" : "tasks",
622-
"name" : "helpwave tasks",
625+
"clientId" : "tasks-backend",
626+
"name" : "helpwave tasks backend",
623627
"description" : "",
624628
"rootUrl" : "",
625629
"adminUrl" : "",
@@ -647,6 +651,47 @@
647651
"client.secret.creation.time" : "1764546967",
648652
"backchannel.logout.session.required" : "true",
649653
"standard.token.exchange.enabled" : "false",
654+
"frontchannel.logout.session.required" : "true",
655+
"post.logout.redirect.uris" : "+",
656+
"display.on.consent.screen" : "false",
657+
"oauth2.device.authorization.grant.enabled" : "false",
658+
"backchannel.logout.revoke.offline.tokens" : "false",
659+
"dpop.bound.access.tokens" : "false"
660+
},
661+
"authenticationFlowBindingOverrides" : { },
662+
"fullScopeAllowed" : true,
663+
"nodeReRegistrationTimeout" : -1,
664+
"defaultClientScopes" : [ "web-origins", "acr", "roles", "profile", "basic", "email" ],
665+
"optionalClientScopes" : [ "address", "phone", "organization", "offline_access", "microprofile-jwt" ]
666+
}, {
667+
"id" : "1c76a254-0a04-4dc1-b287-4e642ae3e9be",
668+
"clientId" : "tasks-web",
669+
"name" : "helpwave tasks web",
670+
"description" : "",
671+
"rootUrl" : "",
672+
"adminUrl" : "",
673+
"baseUrl" : "",
674+
"surrogateAuthRequired" : false,
675+
"enabled" : true,
676+
"alwaysDisplayInConsole" : false,
677+
"clientAuthenticatorType" : "client-secret",
678+
"redirectUris" : [ "*" ],
679+
"webOrigins" : [ "*" ],
680+
"notBefore" : 0,
681+
"bearerOnly" : false,
682+
"consentRequired" : false,
683+
"standardFlowEnabled" : true,
684+
"implicitFlowEnabled" : false,
685+
"directAccessGrantsEnabled" : false,
686+
"serviceAccountsEnabled" : false,
687+
"publicClient" : true,
688+
"frontchannelLogout" : true,
689+
"protocol" : "openid-connect",
690+
"attributes" : {
691+
"realm_client" : "false",
692+
"oidc.ciba.grant.enabled" : "false",
693+
"backchannel.logout.session.required" : "true",
694+
"standard.token.exchange.enabled" : "false",
650695
"oauth2.device.authorization.grant.enabled" : "false",
651696
"backchannel.logout.revoke.offline.tokens" : "false",
652697
"dpop.bound.access.tokens" : "false"
@@ -695,8 +740,9 @@
695740
"consentRequired" : false,
696741
"config" : {
697742
"user.session.note" : "AUTH_TIME",
698-
"id.token.claim" : "true",
699743
"introspection.token.claim" : "true",
744+
"userinfo.token.claim" : "true",
745+
"id.token.claim" : "true",
700746
"access.token.claim" : "true",
701747
"claim.name" : "auth_time",
702748
"jsonType.label" : "long"
@@ -1067,6 +1113,7 @@
10671113
"config" : {
10681114
"introspection.token.claim" : "true",
10691115
"multivalued" : "true",
1116+
"userinfo.token.claim" : "true",
10701117
"user.attribute" : "foo",
10711118
"id.token.claim" : "true",
10721119
"access.token.claim" : "true",
@@ -1168,8 +1215,9 @@
11681215
"consentRequired" : false,
11691216
"config" : {
11701217
"user.session.note" : "clientAddress",
1171-
"id.token.claim" : "true",
11721218
"introspection.token.claim" : "true",
1219+
"userinfo.token.claim" : "true",
1220+
"id.token.claim" : "true",
11731221
"access.token.claim" : "true",
11741222
"claim.name" : "clientAddress",
11751223
"jsonType.label" : "String"
@@ -1182,8 +1230,9 @@
11821230
"consentRequired" : false,
11831231
"config" : {
11841232
"user.session.note" : "client_id",
1185-
"id.token.claim" : "true",
11861233
"introspection.token.claim" : "true",
1234+
"userinfo.token.claim" : "true",
1235+
"id.token.claim" : "true",
11871236
"access.token.claim" : "true",
11881237
"claim.name" : "client_id",
11891238
"jsonType.label" : "String"
@@ -1196,8 +1245,9 @@
11961245
"consentRequired" : false,
11971246
"config" : {
11981247
"user.session.note" : "clientHost",
1199-
"id.token.claim" : "true",
12001248
"introspection.token.claim" : "true",
1249+
"userinfo.token.claim" : "true",
1250+
"id.token.claim" : "true",
12011251
"access.token.claim" : "true",
12021252
"claim.name" : "clientHost",
12031253
"jsonType.label" : "String"
@@ -1236,12 +1286,13 @@
12361286
"protocolMapper" : "oidc-organization-membership-mapper",
12371287
"consentRequired" : false,
12381288
"config" : {
1239-
"id.token.claim" : "true",
12401289
"introspection.token.claim" : "true",
1290+
"multivalued" : "true",
1291+
"userinfo.token.claim" : "true",
1292+
"id.token.claim" : "true",
12411293
"access.token.claim" : "true",
12421294
"claim.name" : "organization",
1243-
"jsonType.label" : "String",
1244-
"multivalued" : "true"
1295+
"jsonType.label" : "String"
12451296
}
12461297
} ]
12471298
}, {
@@ -1271,7 +1322,8 @@
12711322
"config" : {
12721323
"id.token.claim" : "true",
12731324
"introspection.token.claim" : "true",
1274-
"access.token.claim" : "true"
1325+
"access.token.claim" : "true",
1326+
"userinfo.token.claim" : "true"
12751327
}
12761328
} ]
12771329
} ],
@@ -1316,7 +1368,7 @@
13161368
"subType" : "anonymous",
13171369
"subComponents" : { },
13181370
"config" : {
1319-
"allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper" ]
1371+
"allowed-protocol-mapper-types" : [ "oidc-address-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "oidc-full-name-mapper", "saml-role-list-mapper" ]
13201372
}
13211373
}, {
13221374
"id" : "c2c89f17-9dc3-4b48-9cc0-96cf40c186aa",
@@ -1325,7 +1377,7 @@
13251377
"subType" : "authenticated",
13261378
"subComponents" : { },
13271379
"config" : {
1328-
"allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper" ]
1380+
"allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "saml-user-property-mapper", "oidc-usermodel-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper" ]
13291381
}
13301382
}, {
13311383
"id" : "87223906-c75c-4ea0-bfaf-2c845185de52",
@@ -2120,12 +2172,16 @@
21202172
"cibaExpiresIn" : "120",
21212173
"cibaAuthRequestedUserHint" : "login_hint",
21222174
"oauth2DeviceCodeLifespan" : "600",
2175+
"clientOfflineSessionMaxLifespan" : "0",
21232176
"oauth2DevicePollingInterval" : "5",
2177+
"clientSessionIdleTimeout" : "0",
21242178
"parRequestUriLifespan" : "60",
2179+
"clientSessionMaxLifespan" : "0",
2180+
"clientOfflineSessionIdleTimeout" : "0",
21252181
"cibaInterval" : "5",
21262182
"realmReusableOtpCode" : "false"
21272183
},
2128-
"keycloakVersion" : "26.4.6",
2184+
"keycloakVersion" : "26.4.7",
21292185
"userManagedAccessAllowed" : false,
21302186
"organizationsEnabled" : false,
21312187
"verifiableCredentialsEnabled" : false,

‎shell.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ pkgs.mkShell {
5050
export DATABASE_URL="postgresql+asyncpg://${postgresUser}:${postgresPassword}@localhost:${toString postgresPort}/${postgresDatabase}"
5151
export REDIS_URL="redis://:${redisPassword}@${redisHost}:${toString redisPort}"
5252
export ISSUER_URI="http://localhost:8080/realms/tasks"
53-
export CLIENT_ID="tasks"
5453
export CLIENT_SECRET="tasks-secret"
5554
5655
export LD_LIBRARY_PATH="${libPath}:$LD_LIBRARY_PATH"

‎web/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ yarn-error.log*
1111

1212
# build
1313
build
14+
tsconfig.tsbuildinfo
1415

1516
# jetbrains
1617
.idea
@@ -20,5 +21,6 @@ build
2021
.DS_Store
2122
*.pem
2223

24+
2325
# local env files
2426
.env*.local

0 commit comments

Comments
 (0)