832be361c7
- Rename the bootstrap human admin from jovann@siteconseil.fr to jovann@e-cosplay.fr in docker-compose env vars and in the realm import JSON. Keycloak identifies users by username so a new user is created on the next sync run; the old jovann@siteconseil.fr is left in place and can be deleted manually from the admin UI. - Introduce a service account client `sync-bot` in the master realm (confidential, service accounts enabled, direct grants off) granted the `admin` realm role. sync.sh now authenticates via client_credentials, falling back to the bootstrap admin only on the very first run — so reconciliation keeps working after the default admin is disabled. - Add disable_default_admin() at the end of the sync script. It first verifies that sync-bot can authenticate, then flips the `admin` user's `enabled` flag to false. Idempotent and safe: refuses to run if sync-bot auth is broken, and is a no-op if admin is already disabled. - SYNC_BOT_CLIENT / SYNC_BOT_SECRET env vars added to the init container for both bootstrap authentication and service client secret reconciliation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
150 lines
4.3 KiB
JSON
150 lines
4.3 KiB
JSON
{
|
|
"realm": "ecosplay",
|
|
"displayName": "E-Cosplay",
|
|
"displayNameHtml": "<span style=\"font-weight:900;text-transform:uppercase;font-style:italic;\">E-Cosplay</span>",
|
|
"enabled": true,
|
|
|
|
"loginTheme": "ecosplay",
|
|
"accountTheme": "ecosplay",
|
|
"emailTheme": "ecosplay",
|
|
"adminTheme": "keycloak.v2",
|
|
|
|
"internationalizationEnabled": true,
|
|
"supportedLocales": ["fr"],
|
|
"defaultLocale": "fr",
|
|
|
|
"registrationAllowed": true,
|
|
"registrationEmailAsUsername": true,
|
|
"rememberMe": true,
|
|
"verifyEmail": true,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"resetPasswordAllowed": true,
|
|
"editUsernameAllowed": false,
|
|
|
|
"bruteForceProtected": true,
|
|
"permanentLockout": false,
|
|
"maxFailureWaitSeconds": 900,
|
|
"minimumQuickLoginWaitSeconds": 60,
|
|
"waitIncrementSeconds": 60,
|
|
"quickLoginCheckMilliSeconds": 1000,
|
|
"maxDeltaTimeSeconds": 43200,
|
|
"failureFactor": 5,
|
|
|
|
"passwordPolicy": "length(10) and specialChars(1) and digits(1) and upperCase(1) and lowerCase(1) and notUsername(undefined) and notEmail(undefined)",
|
|
|
|
"accessTokenLifespan": 300,
|
|
"accessTokenLifespanForImplicitFlow": 900,
|
|
"ssoSessionIdleTimeout": 1800,
|
|
"ssoSessionMaxLifespan": 36000,
|
|
"offlineSessionIdleTimeout": 2592000,
|
|
"actionTokenGeneratedByUserLifespan": 900,
|
|
|
|
"smtpServer": {
|
|
"host": "email-smtp.eu-west-3.amazonaws.com",
|
|
"port": "587",
|
|
"from": "auth@e-cosplay.fr",
|
|
"fromDisplayName": "E-Cosplay",
|
|
"replyTo": "noreply@e-cosplay.fr",
|
|
"envelopeFrom": "auth@e-cosplay.fr",
|
|
"auth": "true",
|
|
"starttls": "true",
|
|
"ssl": "false",
|
|
"user": "AKIAWTT2T22CWBRBBDYN",
|
|
"password": "BBdgb6KxRQ8mNcpWFJsZCJxbSGNdgLhKFiITMErfBlQP"
|
|
},
|
|
|
|
"groups": [
|
|
{ "name": "gp_asso" },
|
|
{ "name": "gp_contest" },
|
|
{ "name": "gp_mail" },
|
|
{ "name": "gp_mailling" },
|
|
{ "name": "gp_member" },
|
|
{ "name": "gp_ndd" },
|
|
{ "name": "gp_sign" },
|
|
{ "name": "gp_ticket" },
|
|
{ "name": "super_admin_asso" },
|
|
{ "name": "superadmin" }
|
|
],
|
|
|
|
"users": [
|
|
{
|
|
"username": "jovann@e-cosplay.fr",
|
|
"email": "jovann@e-cosplay.fr",
|
|
"firstName": "Jovann",
|
|
"lastName": "Serreau",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "Shoko1997@",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"requiredActions": ["CONFIGURE_TOTP"],
|
|
"groups": ["/super_admin_asso", "/superadmin"],
|
|
"clientRoles": {
|
|
"realm-management": ["realm-admin"]
|
|
}
|
|
}
|
|
],
|
|
|
|
"clients": [
|
|
{
|
|
"clientId": "ecosplay_web",
|
|
"name": "E-Cosplay Web",
|
|
"description": "Application web principale e-cosplay.fr (login site interne)",
|
|
"enabled": true,
|
|
"publicClient": false,
|
|
"secret": "change-me-in-admin-console",
|
|
"redirectUris": [
|
|
"https://www.e-cosplay.fr/oauth/keycloak",
|
|
"https://cos.local/oauth/keycloak"
|
|
],
|
|
"webOrigins": [
|
|
"https://www.e-cosplay.fr",
|
|
"https://cos.local"
|
|
],
|
|
"protocol": "openid-connect",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"attributes": {
|
|
"post.logout.redirect.uris": "https://www.e-cosplay.fr/*##https://cos.local/*",
|
|
"pkce.code.challenge.method": "S256"
|
|
}
|
|
},
|
|
{
|
|
"clientId": "eticket",
|
|
"name": "E-Ticket",
|
|
"description": "Application billetterie ticket.e-cosplay.fr",
|
|
"enabled": true,
|
|
"publicClient": false,
|
|
"secret": "change-me-in-admin-console",
|
|
"redirectUris": [
|
|
"https://ticket.e-cosplay.fr/api/auth/login/sso/validate",
|
|
"https://cos.local/api/auth/login/sso/validate",
|
|
"https://ticket.e-cosplay.fr/connection/sso/check",
|
|
"https://cos.local/connection/sso/check"
|
|
],
|
|
"webOrigins": [
|
|
"https://ticket.e-cosplay.fr",
|
|
"https://cos.local"
|
|
],
|
|
"protocol": "openid-connect",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"attributes": {
|
|
"post.logout.redirect.uris": "https://ticket.e-cosplay.fr/*##https://cos.local/*",
|
|
"pkce.code.challenge.method": "S256"
|
|
}
|
|
}
|
|
]
|
|
}
|