' . $tt->error() . '
'; -} +my $redirect + = $oidc_options{keycloak_base_url} . '/admin/realms/' . uri_escape($oidc_options{keycloak_realm_name}) . '/users'; -$request_ref->{title} = lang('change_password'); -$request_ref->{content_ref} = \$html; -display_page($request_ref); +redirect_to_url($request_ref, 302, $redirect); diff --git a/cgi/login.pl b/cgi/login.pl index ba991afe01d50..be582c6e7a4bd 100644 --- a/cgi/login.pl +++ b/cgi/login.pl @@ -3,7 +3,7 @@ # This file is part of Product Opener. # # Product Opener -# Copyright (C) 2011-2023 Association Open Food Facts +# Copyright (C) 2011-2024 Association Open Food Facts # Contact: contact@openfoodfacts.org # Address: 21 rue des Iles, 94100 Saint-Maur des Fossés, France # @@ -28,10 +28,11 @@ use ProductOpener::Paths qw/:all/; use ProductOpener::Store qw/:all/; use ProductOpener::Display qw/:all/; -use ProductOpener::Users qw/$User_id check_password_hash retrieve_user/; +use ProductOpener::Users qw/$User_id retrieve_user/; use ProductOpener::Lang qw/lang/; +use ProductOpener::Auth qw/password_signin access_to_protected_resource/; -use Apache2::Const -compile => qw(OK); +use Apache2::Const -compile => qw/OK :http/; use CGI qw/:cgi :form escapeHTML/; use URI::Escape::XS; use Encode; @@ -39,60 +40,43 @@ my $request_ref = ProductOpener::Display::init_request(); -my $template_data_ref = {}; - $log->info('start') if $log->is_info(); my $r = shift; my $redirect = single_param('redirect'); -$template_data_ref->{redirect} = $redirect; +my $loc = $redirect || $formatted_subdomain . "/cgi/session.pl"; +my $status_code = Apache2::Const::HTTP_BAD_REQUEST; +my $final_status_set = 0; if (defined $User_id) { - my $loc = $redirect || $formatted_subdomain . "/cgi/session.pl"; + # User is already signed in via cookie or similar, as determined by init_request. $r->headers_out->set(Location => $loc); - $r->err_headers_out->add('Set-Cookie' => $request_ref->{cookie}); - $r->status(302); - return Apache2::Const::OK; + $status_code = Apache2::Const::HTTP_MOVED_TEMPORARILY; + $final_status_set = 1; } -my @errors = (); - -if ($ENV{'REQUEST_METHOD'} eq 'POST') { - my $user_ref = retrieve_user($User_id); - if (not(defined $user_ref)) { - push @errors, 'undefined user'; - $template_data_ref->{success} = 0; - } - - my $hash_is_correct - = check_password_hash(encode_utf8(decode utf8 => single_param('password')), $user_ref->{'encrypted_password'}); - - # We don't have the right password - if (not $hash_is_correct) { - $log->info( - 'bad password - input does not match stored hash', - {encrypted_password => $user_ref->{'encrypted_password'}} - ) if $log->is_info(); - push @errors, lang('error_bad_login_password'); - } +if (not($final_status_set) and (not($ENV{'REQUEST_METHOD'} eq 'POST'))) { + # After OIDC/Keycloak integration, the original login form is no longer used. + # However, some external sites (ie. Hunger Games) may still be using it. + $request_ref->{return_url} = single_param('redirect'); + access_to_protected_resource($request_ref); + $final_status_set = 1; +} - if (scalar(@errors) > 0) { - $template_data_ref->{success} = 0; +if (not($final_status_set)) { + my ($oidc_user_id, $refresh_token, $refresh_expires_at, $access_token, $access_expires_at, $id_token) + = password_signin(encode_utf8(decode utf8 => single_param('user_id')), + encode_utf8(decode utf8 => single_param('password')), $request_ref); + if ($oidc_user_id) { + $r->headers_out->set(Location => $loc); + $status_code = Apache2::Const::HTTP_MOVED_TEMPORARILY; } else { - $template_data_ref->{success} = 1; + $status_code = Apache2::Const::HTTP_UNAUTHORIZED; } -} -$template_data_ref->{errors} = \@errors; - -# Display the sign in form -my $html; -process_template('web/pages/session/sign_in_form.tt.html', $template_data_ref, \$html) or $html = ''; -if ($tt->error()) { - $html .= '' . $tt->error() . '
'; + $final_status_set = 1; } -$request_ref->{title} = lang('login_register_title'); -$request_ref->{content_ref} = \$html; -display_page($request_ref); - +$r->err_headers_out->add('Set-Cookie' => $request_ref->{cookie}); +$r->status($status_code); +return Apache2::Const::OK; diff --git a/scripts/reset_password_for_user.pl b/cgi/oidc_signin.pl old mode 100755 new mode 100644 similarity index 54% rename from scripts/reset_password_for_user.pl rename to cgi/oidc_signin.pl index 9a5deb800075e..1b3e6daf2eaac --- a/scripts/reset_password_for_user.pl +++ b/cgi/oidc_signin.pl @@ -3,7 +3,7 @@ # This file is part of Product Opener. # # Product Opener -# Copyright (C) 2011-2023 Association Open Food Facts +# Copyright (C) 2011-2024 Association Open Food Facts # Contact: contact@openfoodfacts.org # Address: 21 rue des Iles, 94100 Saint-Maur des Fossés, France # @@ -20,27 +20,30 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see" . $tt->error() . "
"; - -$request_ref->{title} = $Lang{'reset_password'}{$lc}; -$request_ref->{content_ref} = \$html; -display_page($request_ref); - diff --git a/cgi/session.pl b/cgi/session.pl index 655159ab2189f..63686e5ec5ac0 100755 --- a/cgi/session.pl +++ b/cgi/session.pl @@ -3,7 +3,7 @@ # This file is part of Product Opener. # # Product Opener -# Copyright (C) 2011-2023 Association Open Food Facts +# Copyright (C) 2011-2024 Association Open Food Facts # Contact: contact@openfoodfacts.org # Address: 21 rue des Iles, 94100 Saint-Maur des Fossés, France # @@ -31,6 +31,7 @@ use ProductOpener::HTTP qw/write_cors_headers/; use ProductOpener::Users qw/$User_id %User/; use ProductOpener::Lang qw/lang/; +use ProductOpener::Auth qw/write_auth_deprecated_headers/; use CGI qw/:cgi :form escapeHTML/; use URI::Escape::XS; @@ -75,6 +76,7 @@ $log->info("redirecting after login", {url => $url}) if $log->is_info(); + write_auth_deprecated_headers(); $r->err_headers_out->add('Set-Cookie' => $request_ref->{cookie}); $r->headers_out->set(Location => "$url"); $r->status(302); @@ -95,6 +97,7 @@ my $data = encode_json(\%response); write_cors_headers(); + write_auth_deprecated_headers(); print header(-type => 'application/json', -charset => 'utf-8') . $data; } @@ -119,6 +122,8 @@ $request_ref->{title} = lang('session_title'); $request_ref->{content_ref} = \$html; + + write_auth_deprecated_headers(); display_page($request_ref); } diff --git a/cgi/sso.pl b/cgi/sso.pl index 576241dff8c0e..dacaed7e41caa 100755 --- a/cgi/sso.pl +++ b/cgi/sso.pl @@ -28,6 +28,7 @@ use ProductOpener::Store qw/:all/; use ProductOpener::Users qw/check_session/; use ProductOpener::Display qw/single_param/; +use ProductOpener::Auth qw/write_auth_deprecated_headers/; use CGI qw/:cgi :form escapeHTML/; use URI::Escape::XS; @@ -44,4 +45,5 @@ my $data = encode_json($response_ref); +write_auth_deprecated_headers(); print header(-type => 'application/json', -charset => 'utf-8') . $data; diff --git a/cgi/user.pl b/cgi/user.pl index 098f3bf09394d..074a92798bb51 100644 --- a/cgi/user.pl +++ b/cgi/user.pl @@ -3,7 +3,7 @@ # This file is part of Product Opener. # # Product Opener -# Copyright (C) 2011-2023 Association Open Food Facts +# Copyright (C) 2011-2024 Association Open Food Facts # Contact: contact@openfoodfacts.org # Address: 21 rue des Iles, 94100 Saint-Maur des Fossés, France # @@ -33,6 +33,7 @@ use ProductOpener::Orgs qw/org_name retrieve_org/; use ProductOpener::Text qw/remove_tags_and_quote/; use ProductOpener::CRM qw/get_contact_url/; +use ProductOpener::Keycloak; use CGI qw/:cgi :form escapeHTML charset/; use URI::Escape::XS; @@ -71,9 +72,9 @@ # The userid looks like an e-mail if ($request_ref->{admin} and ($userid =~ /\@/)) { - my $user_by_email = retrieve_user_by_email($userid); - if (defined $user_by_email) { - $userid = $user_by_email->{userid}; + my $mail_based_userid = is_email_has_off_account($userid); + if (defined $mail_based_userid) { + $userid = $mail_based_userid; } } } @@ -105,12 +106,6 @@ if ($action eq 'process') { - if ($type eq 'edit') { - if (single_param('delete') eq 'on') { - $type = 'delete'; - } - } - # change organization if ($type eq 'edit_owner') { # only admin and pro moderators can change organization freely @@ -121,7 +116,7 @@ display_error_and_exit($request_ref, $Lang{error_no_permission}{$lc}, 403); } } - elsif ($type ne 'delete') { + else { ProductOpener::Users::check_user_form($request_ref, $type, $user_ref, \@errors); } @@ -154,12 +149,10 @@ $user_ref->{email} = $user_info; $user_ref->{userid} = $1; $user_ref->{name} = $1; - $user_ref->{password} = $new_user_password; } else { $user_ref->{userid} = $user_info; $user_ref->{name} = $user_info; - $user_ref->{password} = $new_user_password; } } @@ -170,50 +163,13 @@ $template_data_ref->{sections} = []; if ($user_ref) { - my $selected_language = $user_ref->{preferred_language} - // (remove_tags_and_quote(single_param('preferred_language')) || "$lc"); - my $selected_country = $user_ref->{country} // (remove_tags_and_quote(single_param('country')) || $country); - if ($selected_country eq "en:world") { - $selected_country = ""; - } push @{$template_data_ref->{sections}}, { id => "user", fields => [ - { - field => "name" - }, - { - field => "email", - type => "email", - }, { field => "userid", label => "username" }, - { - field => "password", - type => "password", - label => "password" - }, - { - field => "confirm_password", - type => "password", - label => "password_confirm" - }, - { - field => "preferred_language", - type => "select", - label => "preferred_language", - selected => $selected_language, - options => get_languages_options_list($lc), - }, - { - field => "country", - type => "select", - label => "select_country", - selected => $selected_country, - options => get_countries_options_list($lc), - }, { # this is a honeypot to detect scripts, that fills every fields # this one is hidden in a div and user won't see it @@ -403,9 +359,6 @@ if (($type eq 'add') or ($type =~ /^edit/)) { ProductOpener::Users::process_user_form($type, $user_ref, $request_ref); } - elsif ($type eq 'delete') { - ProductOpener::Users::delete_user($user_ref); - } if ($type eq 'add') { diff --git a/conf/apache-2.4/modperl.conf b/conf/apache-2.4/modperl.conf index fab32e5e2cd52..b3fdcaa877f14 100644 --- a/conf/apache-2.4/modperl.conf +++ b/conf/apache-2.4/modperl.conf @@ -30,4 +30,10 @@ PerlPassEnv RATE_LIMITER_BLOCKING_ENABLED PerlPassEnv ODOO_CRM_URL PerlPassEnv ODOO_CRM_DB PerlPassEnv ODOO_CRM_USER -PerlPassEnv ODOO_CRM_PASSWORD \ No newline at end of file +PerlPassEnv ODOO_CRM_PASSWORD +PerlPassEnv KEYCLOAK_BASE_URL +PerlPassEnv KEYCLOAK_BACKCHANNEL_BASE_URL +PerlPassEnv KEYCLOAK_REALM_NAME +PerlPassEnv PRODUCT_OPENER_OIDC_CLIENT_ID +PerlPassEnv PRODUCT_OPENER_OIDC_CLIENT_SECRET +PerlPassEnv PRODUCT_OPENER_OIDC_DISCOVERY_ENDPOINT \ No newline at end of file diff --git a/conf/keycloak/open-products-facts-realm.json b/conf/keycloak/open-products-facts-realm.json new file mode 100644 index 0000000000000..26a63134ee18f --- /dev/null +++ b/conf/keycloak/open-products-facts-realm.json @@ -0,0 +1,2498 @@ +{ + "id": "793a2761-1af2-44e1-a0b8-cc37a030a2af", + "realm": "open-products-facts", + "displayName": "Open Products Facts", + "displayNameHtml": "", + "notBefore": 0, + "defaultSignatureAlgorithm": "RS256", + "revokeRefreshToken": false, + "refreshTokenMaxReuse": 0, + "accessTokenLifespan": 300, + "accessTokenLifespanForImplicitFlow": 900, + "ssoSessionIdleTimeout": 1800, + "ssoSessionMaxLifespan": 36000, + "ssoSessionIdleTimeoutRememberMe": 0, + "ssoSessionMaxLifespanRememberMe": 0, + "offlineSessionIdleTimeout": 2592000, + "offlineSessionMaxLifespanEnabled": false, + "offlineSessionMaxLifespan": 5184000, + "clientSessionIdleTimeout": 0, + "clientSessionMaxLifespan": 0, + "clientOfflineSessionIdleTimeout": 0, + "clientOfflineSessionMaxLifespan": 0, + "accessCodeLifespan": 60, + "accessCodeLifespanUserAction": 300, + "accessCodeLifespanLogin": 1800, + "actionTokenGeneratedByAdminLifespan": 43200, + "actionTokenGeneratedByUserLifespan": 300, + "oauth2DeviceCodeLifespan": 600, + "oauth2DevicePollingInterval": 5, + "enabled": true, + "sslRequired": "external", + "registrationAllowed": true, + "registrationEmailAsUsername": false, + "rememberMe": false, + "verifyEmail": false, + "loginWithEmailAllowed": true, + "duplicateEmailsAllowed": false, + "resetPasswordAllowed": true, + "editUsernameAllowed": false, + "bruteForceProtected": false, + "permanentLockout": false, + "maxFailureWaitSeconds": 900, + "minimumQuickLoginWaitSeconds": 60, + "waitIncrementSeconds": 60, + "quickLoginCheckMilliSeconds": 1000, + "maxDeltaTimeSeconds": 43200, + "failureFactor": 30, + "roles": { + "realm": [ + { + "id": "ee81baa9-5677-45ff-9c1f-1b24ef49b30e", + "name": "uma_authorization", + "description": "${role_uma_authorization}", + "composite": false, + "clientRole": false, + "containerId": "793a2761-1af2-44e1-a0b8-cc37a030a2af", + "attributes": {} + }, + { + "id": "6254728b-ae51-4873-bcb3-3d9854845b00", + "name": "default-roles-open-products-facts", + "description": "${role_default-roles}", + "composite": true, + "composites": { + "realm": [ + "offline_access", + "uma_authorization" + ], + "client": { + "account": [ + "view-profile", + "delete-account", + "manage-account" + ] + } + }, + "clientRole": false, + "containerId": "793a2761-1af2-44e1-a0b8-cc37a030a2af", + "attributes": {} + }, + { + "id": "fdff2d5b-16f5-4c12-8b4a-76d033b14d69", + "name": "offline_access", + "description": "${role_offline-access}", + "composite": false, + "clientRole": false, + "containerId": "793a2761-1af2-44e1-a0b8-cc37a030a2af", + "attributes": {} + } + ], + "client": { + "realm-management": [ + { + "id": "66d72c18-2dfe-4ae1-a7b2-c1304c1160b2", + "name": "query-users", + "description": "${role_query-users}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "3e13d885-1b39-42ac-b9e4-e648ce07092a", + "name": "manage-authorization", + "description": "${role_manage-authorization}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "a1a2686c-4180-4225-a85e-9872c63a11b5", + "name": "view-events", + "description": "${role_view-events}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "88ca8408-13d1-4d92-aa99-bb792e125572", + "name": "view-identity-providers", + "description": "${role_view-identity-providers}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "3f0ab4f3-03ad-48db-ac07-6ed47b59955a", + "name": "view-clients", + "description": "${role_view-clients}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "query-clients" + ] + } + }, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "b80ae327-2b86-452b-a3d6-deb6f811beb2", + "name": "manage-identity-providers", + "description": "${role_manage-identity-providers}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "efbb7afe-2c7c-454f-bc1e-9caca15222ce", + "name": "create-client", + "description": "${role_create-client}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "b4339138-dbc8-4fc2-8692-fa757a1a5cd4", + "name": "view-users", + "description": "${role_view-users}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "query-groups", + "query-users" + ] + } + }, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "23cfdbd1-32c7-4616-ab20-3eeea3ac462e", + "name": "view-authorization", + "description": "${role_view-authorization}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "17c042a0-cd6b-4f64-a6a0-b579828bce32", + "name": "manage-clients", + "description": "${role_manage-clients}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "4e719a81-d8e3-419d-aa58-52506b8d78ee", + "name": "query-groups", + "description": "${role_query-groups}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "6da1af85-2a85-427d-983c-4faead48871a", + "name": "manage-realm", + "description": "${role_manage-realm}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "37970203-2be4-478c-a00b-7b35142f7915", + "name": "view-realm", + "description": "${role_view-realm}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "f2d9eff6-c191-43fd-8e12-54b996a972a0", + "name": "manage-users", + "description": "${role_manage-users}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "6c39ce91-d0a1-4196-9726-d86bb7c3fc76", + "name": "query-clients", + "description": "${role_query-clients}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "2e0a9cf2-3a31-42b4-9bee-ad0b9b0421c3", + "name": "query-realms", + "description": "${role_query-realms}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "299a944e-1152-42be-b812-aa6768345ca5", + "name": "manage-events", + "description": "${role_manage-events}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "bbbb1ac2-0141-4ae2-9651-e6beeaac082d", + "name": "realm-admin", + "description": "${role_realm-admin}", + "composite": true, + "composites": { + "client": { + "realm-management": [ + "query-users", + "manage-authorization", + "view-identity-providers", + "view-events", + "view-clients", + "manage-identity-providers", + "create-client", + "view-users", + "view-authorization", + "manage-clients", + "query-groups", + "view-realm", + "manage-realm", + "manage-users", + "query-clients", + "query-realms", + "manage-events", + "impersonation" + ] + } + }, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + }, + { + "id": "fb664e6a-778e-4a85-abb5-9af2eec98ac4", + "name": "impersonation", + "description": "${role_impersonation}", + "composite": false, + "clientRole": true, + "containerId": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "attributes": {} + } + ], + "hoppscotch": [ + { + "id": "512f0e38-1503-4090-baf2-bf363ab0e830", + "name": "uma_protection", + "composite": false, + "clientRole": true, + "containerId": "4aa0f015-3b71-4aef-8cc9-6e9ddd814217", + "attributes": {} + } + ], + "security-admin-console": [], + "${PRODUCT_OPENER_OIDC_CLIENT_ID}": [ + { + "id": "beda95d0-edcf-4387-a431-a642df8b62b8", + "name": "uma_protection", + "composite": false, + "clientRole": true, + "containerId": "c865387e-1275-47f7-948a-fd1b4b166385", + "attributes": {} + } + ], + "admin-cli": [], + "account-console": [], + "broker": [ + { + "id": "5f7bf7a7-32ee-4b9f-aa6f-98ec731e2f36", + "name": "read-token", + "description": "${role_read-token}", + "composite": false, + "clientRole": true, + "containerId": "0fb7edcc-ba9a-44ab-bc39-55a1343f342a", + "attributes": {} + } + ], + "account": [ + { + "id": "46ee03c6-0a79-4dfc-8502-638dfc9f2d61", + "name": "view-profile", + "description": "${role_view-profile}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "cf7ce816-056f-4c5c-bcb1-a066a7a6cd36", + "name": "delete-account", + "description": "${role_delete-account}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "1dd5dd45-59a6-439a-b971-9b1e70d1b75f", + "name": "manage-consent", + "description": "${role_manage-consent}", + "composite": true, + "composites": { + "client": { + "account": [ + "view-consent" + ] + } + }, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "71219f0a-0ba0-4521-a14e-a7d44a0b18ee", + "name": "manage-account", + "description": "${role_manage-account}", + "composite": true, + "composites": { + "client": { + "account": [ + "manage-account-links" + ] + } + }, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "af2495f7-4698-4e29-a3c8-d4a5b8ef0a99", + "name": "manage-account-links", + "description": "${role_manage-account-links}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "c441a16c-59ef-43bc-9526-4e81f09af158", + "name": "view-consent", + "description": "${role_view-consent}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "5a4b1f2e-3771-4ad5-8d5f-e79e19e7f2e6", + "name": "view-groups", + "description": "${role_view-groups}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + }, + { + "id": "9271fdb4-6c46-43dd-b1bf-288211bf786f", + "name": "view-applications", + "description": "${role_view-applications}", + "composite": false, + "clientRole": true, + "containerId": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "attributes": {} + } + ] + } + }, + "groups": [], + "defaultRole": { + "id": "6254728b-ae51-4873-bcb3-3d9854845b00", + "name": "default-roles-open-products-facts", + "description": "${role_default-roles}", + "composite": true, + "clientRole": false, + "containerId": "793a2761-1af2-44e1-a0b8-cc37a030a2af" + }, + "requiredCredentials": [ + "password" + ], + "passwordPolicy": "passwordHistory(2) and notUsername(undefined) and notEmail(undefined) and length(12)", + "otpPolicyType": "totp", + "otpPolicyAlgorithm": "HmacSHA512", + "otpPolicyInitialCounter": 0, + "otpPolicyDigits": 8, + "otpPolicyLookAheadWindow": 1, + "otpPolicyPeriod": 30, + "otpPolicyCodeReusable": false, + "otpSupportedApplications": [ + "totpAppFreeOTPName" + ], + "localizationTexts": {}, + "webAuthnPolicyRpEntityName": "Open Products Facts", + "webAuthnPolicySignatureAlgorithms": [ + "ES256" + ], + "webAuthnPolicyRpId": "", + "webAuthnPolicyAttestationConveyancePreference": "not specified", + "webAuthnPolicyAuthenticatorAttachment": "not specified", + "webAuthnPolicyRequireResidentKey": "not specified", + "webAuthnPolicyUserVerificationRequirement": "not specified", + "webAuthnPolicyCreateTimeout": 0, + "webAuthnPolicyAvoidSameAuthenticatorRegister": false, + "webAuthnPolicyAcceptableAaguids": [], + "webAuthnPolicyExtraOrigins": [], + "webAuthnPolicyPasswordlessRpEntityName": "Open Products Facts", + "webAuthnPolicyPasswordlessSignatureAlgorithms": [ + "ES256" + ], + "webAuthnPolicyPasswordlessRpId": "", + "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified", + "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified", + "webAuthnPolicyPasswordlessRequireResidentKey": "not specified", + "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified", + "webAuthnPolicyPasswordlessCreateTimeout": 0, + "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false, + "webAuthnPolicyPasswordlessAcceptableAaguids": [], + "webAuthnPolicyPasswordlessExtraOrigins": [], + "users": [ + { + "id": "c3940479-7649-4562-9890-860d04d1d06e", + "createdTimestamp": 1700482310356, + "username": "service-account-productopener", + "enabled": true, + "totp": false, + "emailVerified": false, + "serviceAccountClientId": "${PRODUCT_OPENER_OIDC_CLIENT_ID}", + "disableableCredentialTypes": [], + "requiredActions": [], + "realmRoles": [ + "default-roles-open-products-facts" + ], + "clientRoles": { + "realm-management": [ + "manage-users", + "query-users" + ] + }, + "notBefore": 0, + "groups": [] + } + ], + "scopeMappings": [ + { + "clientScope": "offline_access", + "roles": [ + "offline_access" + ] + } + ], + "clientScopeMappings": { + "account": [ + { + "client": "account-console", + "roles": [ + "manage-account", + "view-groups" + ] + } + ] + }, + "clients": [ + { + "id": "c865387e-1275-47f7-948a-fd1b4b166385", + "clientId": "${PRODUCT_OPENER_OIDC_CLIENT_ID}", + "name": "${PRODUCT_OPENER_OIDC_CLIENT_ID}", + "description": "Dummy client for local development", + "rootUrl": "http://world.${PRODUCT_OPENER_DOMAIN}/", + "adminUrl": "http://world.${PRODUCT_OPENER_DOMAIN}/", + "baseUrl": "http://world.${PRODUCT_OPENER_DOMAIN}/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": true, + "clientAuthenticatorType": "client-secret", + "secret": "${PRODUCT_OPENER_OIDC_CLIENT_SECRET}", + "redirectUris": [ + "http://world.${PRODUCT_OPENER_DOMAIN}/cgi/oidc_signin_callback.pl" + ], + "webOrigins": [ + "*" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": true, + "publicClient": false, + "frontchannelLogout": true, + "protocol": "openid-connect", + "attributes": { + "oidc.ciba.grant.enabled": "false", + "client.secret.creation.time": "1698609487", + "backchannel.logout.session.required": "true", + "post.logout.redirect.uris": "http://world.${PRODUCT_OPENER_DOMAIN}/cgi/oidc_signout_callback.pl", + "oauth2.device.authorization.grant.enabled": "false", + "display.on.consent.screen": "false", + "backchannel.logout.revoke.offline.tokens": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "protocolMappers": [ + { + "id": "706932c1-de97-4528-abb0-386632953e06", + "name": "Client ID", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "client_id", + "userinfo.token.claim": "true", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "client_id", + "jsonType.label": "String" + } + }, + { + "id": "a762ff13-6c41-4bb9-9314-a918a815815d", + "name": "Client IP Address", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientAddress", + "userinfo.token.claim": "true", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientAddress", + "jsonType.label": "String" + } + }, + { + "id": "658cf99e-9f09-4294-80f2-6fc2656c2674", + "name": "Client Host", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientHost", + "userinfo.token.claim": "true", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientHost", + "jsonType.label": "String" + } + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "openid", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "5ca80ba2-8030-4f5f-909c-dab3221dc652", + "clientId": "account", + "name": "${client_account}", + "rootUrl": "${authBaseUrl}", + "baseUrl": "/realms/open-products-facts/account/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/realms/open-products-facts/account/*" + ], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "9824b957-e826-4d4f-ae3b-da43c77ac7fe", + "clientId": "account-console", + "name": "${client_account-console}", + "rootUrl": "${authBaseUrl}", + "baseUrl": "/realms/open-products-facts/account/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/realms/open-products-facts/account/*" + ], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+", + "pkce.code.challenge.method": "S256" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "protocolMappers": [ + { + "id": "5350bfb5-5e53-41e1-81f5-218aa371cc32", + "name": "audience resolve", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-resolve-mapper", + "consentRequired": false, + "config": {} + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "e1a63130-d2cb-4618-a11c-43616af049ae", + "clientId": "admin-cli", + "name": "${client_admin-cli}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "0fb7edcc-ba9a-44ab-bc39-55a1343f342a", + "clientId": "broker", + "name": "${client_broker}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": true, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "4aa0f015-3b71-4aef-8cc9-6e9ddd814217", + "clientId": "hoppscotch", + "name": "hoppscotch", + "description": "", + "rootUrl": "https://hoppscotch.io/", + "adminUrl": "https://hoppscotch.io/", + "baseUrl": "https://hoppscotch.io/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "https://hoppscotch.io/oauth" + ], + "webOrigins": [ + "https://hoppscotch.io" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": true, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": true, + "protocol": "openid-connect", + "attributes": { + "oidc.ciba.grant.enabled": "false", + "client.secret.creation.time": "1701004114", + "backchannel.logout.session.required": "true", + "post.logout.redirect.uris": "https://hoppscotch.io/", + "oauth2.device.authorization.grant.enabled": "true", + "display.on.consent.screen": "false", + "backchannel.logout.revoke.offline.tokens": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "protocolMappers": [ + { + "id": "6196a19f-9fee-41ce-bc2e-3859ddf460ac", + "name": "Client Host", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientHost", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientHost", + "jsonType.label": "String" + } + }, + { + "id": "406f0512-2b23-44f0-9678-12122bd33740", + "name": "Client ID", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "client_id", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "client_id", + "jsonType.label": "String" + } + }, + { + "id": "cc918f4f-54d4-4967-a08a-667e92a1658b", + "name": "Client IP Address", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientAddress", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientAddress", + "jsonType.label": "String" + } + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "4753f77d-ecb7-4944-9959-1321e7ef7b9a", + "clientId": "realm-management", + "name": "${client_realm-management}", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [], + "webOrigins": [], + "notBefore": 0, + "bearerOnly": true, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "0d555a34-b029-415f-943c-ac012ffcb130", + "clientId": "security-admin-console", + "name": "${client_security-admin-console}", + "rootUrl": "${authAdminUrl}", + "baseUrl": "/admin/open-products-facts/console/", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "redirectUris": [ + "/admin/open-products-facts/console/*" + ], + "webOrigins": [ + "+" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "post.logout.redirect.uris": "+", + "pkce.code.challenge.method": "S256" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": false, + "nodeReRegistrationTimeout": 0, + "protocolMappers": [ + { + "id": "f9eac11f-03bf-4cae-96e9-4a7398018a3f", + "name": "locale", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "locale", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "locale", + "jsonType.label": "String" + } + } + ], + "defaultClientScopes": [ + "web-origins", + "acr", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + } + ], + "clientScopes": [ + { + "id": "c7499cba-fd75-463a-91bf-2c2c97fc53c4", + "name": "acr", + "description": "OpenID Connect scope for add acr (authentication context class reference) to the token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "c0ca0cf9-2d7c-4ae1-8106-2027fed1c526", + "name": "acr loa level", + "protocol": "openid-connect", + "protocolMapper": "oidc-acr-mapper", + "consentRequired": false, + "config": { + "id.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true" + } + } + ] + }, + { + "id": "2a574392-a877-45ec-9e3d-cb2232e9588a", + "name": "microprofile-jwt", + "description": "Microprofile - JWT built-in scope", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "false" + }, + "protocolMappers": [ + { + "id": "d2959159-b03a-4a92-9c5b-2ff5549a6206", + "name": "upn", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "username", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "upn", + "jsonType.label": "String" + } + }, + { + "id": "767c475c-f091-444a-84f8-c7a5b7958bca", + "name": "groups", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-realm-role-mapper", + "consentRequired": false, + "config": { + "multivalued": "true", + "userinfo.token.claim": "true", + "user.attribute": "foo", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "groups", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "a0ff4433-96a0-4ddc-98b4-e08a51d049f0", + "name": "web-origins", + "description": "OpenID Connect scope for add allowed web origins to the access token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "false", + "consent.screen.text": "" + }, + "protocolMappers": [ + { + "id": "ed584f54-23c5-4337-acd2-78e688bbbfd7", + "name": "allowed web origins", + "protocol": "openid-connect", + "protocolMapper": "oidc-allowed-origins-mapper", + "consentRequired": false, + "config": {} + } + ] + }, + { + "id": "a2e9bd68-a189-4cba-a3a5-08e6a989410b", + "name": "role_list", + "description": "SAML role list", + "protocol": "saml", + "attributes": { + "consent.screen.text": "${samlRoleListScopeConsentText}", + "display.on.consent.screen": "true" + }, + "protocolMappers": [ + { + "id": "d3b567b8-3eef-4bbd-b286-a14b70aa380a", + "name": "role list", + "protocol": "saml", + "protocolMapper": "saml-role-list-mapper", + "consentRequired": false, + "config": { + "single": "false", + "attribute.nameformat": "Basic", + "attribute.name": "Role" + } + } + ] + }, + { + "id": "09d1bc31-22c4-43f2-82e3-ac122bfb1cb3", + "name": "phone", + "description": "OpenID Connect built-in scope: phone", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true", + "consent.screen.text": "${phoneScopeConsentText}" + }, + "protocolMappers": [ + { + "id": "5081ef31-f3bb-45ff-aa8e-2e828540097e", + "name": "phone number verified", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "phoneNumberVerified", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "phone_number_verified", + "jsonType.label": "boolean" + } + }, + { + "id": "b0dbf5fb-e59b-4872-816e-d175506b0c89", + "name": "phone number", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "phoneNumber", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "phone_number", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "e100d014-3f1d-4075-9777-643deeda8811", + "name": "profile", + "description": "OpenID Connect built-in scope: profile", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true", + "consent.screen.text": "${profileScopeConsentText}" + }, + "protocolMappers": [ + { + "id": "902e4bf6-5162-42a1-b4af-6e37bed27d3b", + "name": "given name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "firstName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "given_name", + "jsonType.label": "String" + } + }, + { + "id": "5f94628e-6b46-462c-b730-1fbf315f5135", + "name": "website", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "website", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "website", + "jsonType.label": "String" + } + }, + { + "id": "d17ab27c-4402-4073-876e-e7acbea84a2f", + "name": "username", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "username", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "preferred_username", + "jsonType.label": "String" + } + }, + { + "id": "cc8c509e-4cd5-4eef-ad30-6765b7e7a493", + "name": "birthdate", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "birthdate", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "birthdate", + "jsonType.label": "String" + } + }, + { + "id": "d70f5b9c-ceaa-4d9a-bec8-31ddec27280e", + "name": "zoneinfo", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "zoneinfo", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "zoneinfo", + "jsonType.label": "String" + } + }, + { + "id": "57df491b-fe9a-41dc-945a-347da30f3599", + "name": "locale", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "locale", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "locale", + "jsonType.label": "String" + } + }, + { + "id": "bf0a66f9-33d6-4b77-afd9-1b2a00aeefc1", + "name": "updated at", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "updatedAt", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "updated_at", + "jsonType.label": "long" + } + }, + { + "id": "e1dd1206-5607-4e29-92af-bf321eadb31b", + "name": "full name", + "protocol": "openid-connect", + "protocolMapper": "oidc-full-name-mapper", + "consentRequired": false, + "config": { + "id.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true" + } + }, + { + "id": "975562f7-f636-4ee9-92b9-adb62fa89b7e", + "name": "picture", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "picture", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "picture", + "jsonType.label": "String" + } + }, + { + "id": "f5bdaafa-8a95-4832-a66f-e86b0b536d6e", + "name": "family name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "lastName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "family_name", + "jsonType.label": "String" + } + }, + { + "id": "1c3e5f92-db44-4326-8c4e-1c905efe0fd3", + "name": "profile", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "profile", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "profile", + "jsonType.label": "String" + } + }, + { + "id": "fdf2590d-db0f-462f-91bf-97f21e34ab35", + "name": "middle name", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "middleName", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "middle_name", + "jsonType.label": "String" + } + }, + { + "id": "a5b2c3dc-1cfb-4ba3-ac9b-83d03f0bbdbc", + "name": "nickname", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "nickname", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "nickname", + "jsonType.label": "String" + } + }, + { + "id": "bcdd0ae3-7a76-455a-bd75-0b504f09f872", + "name": "gender", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "gender", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "gender", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "79dc30bd-d1e1-4204-9311-1373e521c182", + "name": "address", + "description": "OpenID Connect built-in scope: address", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true", + "consent.screen.text": "${addressScopeConsentText}" + }, + "protocolMappers": [ + { + "id": "b31e7709-4f24-4738-96b6-a5bf2acb89e3", + "name": "address", + "protocol": "openid-connect", + "protocolMapper": "oidc-address-mapper", + "consentRequired": false, + "config": { + "user.attribute.formatted": "formatted", + "user.attribute.country": "country", + "user.attribute.postal_code": "postal_code", + "userinfo.token.claim": "true", + "user.attribute.street": "street", + "id.token.claim": "true", + "user.attribute.region": "region", + "access.token.claim": "true", + "user.attribute.locality": "locality" + } + } + ] + }, + { + "id": "1c85b4a1-30c2-4cf3-aed9-1009b170d8cd", + "name": "email", + "description": "OpenID Connect built-in scope: email", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true", + "consent.screen.text": "${emailScopeConsentText}" + }, + "protocolMappers": [ + { + "id": "ba8c1b78-e58f-4fdd-bcbf-45a14fe2ee5d", + "name": "email verified", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-property-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "emailVerified", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "email_verified", + "jsonType.label": "boolean" + } + }, + { + "id": "e316fc71-abdb-4cda-b0a6-a6716949a66f", + "name": "email", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "email", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "email", + "jsonType.label": "String" + } + } + ] + }, + { + "id": "e6e22dd5-5636-4682-a865-cf2224ed3d53", + "name": "openid", + "description": "OpenID Connect built-in scope: openid", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true", + "gui.order": "", + "consent.screen.text": "" + } + }, + { + "id": "4b53d281-e9f0-4eb4-8045-8c6069c90347", + "name": "roles", + "description": "OpenID Connect scope for add user roles to the access token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "true", + "consent.screen.text": "${rolesScopeConsentText}" + }, + "protocolMappers": [ + { + "id": "d1dec85d-aa84-4cbd-9091-afddd4ab9060", + "name": "realm roles", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-realm-role-mapper", + "consentRequired": false, + "config": { + "user.attribute": "foo", + "access.token.claim": "true", + "claim.name": "realm_access.roles", + "jsonType.label": "String", + "multivalued": "true" + } + }, + { + "id": "c03d266a-0c5b-4fab-b1f2-a8b6c1913ee2", + "name": "client roles", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-client-role-mapper", + "consentRequired": false, + "config": { + "user.attribute": "foo", + "access.token.claim": "true", + "claim.name": "resource_access.${client_id}.roles", + "jsonType.label": "String", + "multivalued": "true" + } + }, + { + "id": "462cabcf-b519-4c06-b125-a3ff8ada34d2", + "name": "audience resolve", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-resolve-mapper", + "consentRequired": false, + "config": {} + } + ] + }, + { + "id": "1304cdff-edd6-424a-ba73-a74d37de6c68", + "name": "offline_access", + "description": "OpenID Connect built-in scope: offline_access", + "protocol": "openid-connect", + "attributes": { + "consent.screen.text": "${offlineAccessScopeConsentText}", + "display.on.consent.screen": "true" + } + } + ], + "defaultDefaultClientScopes": [ + "role_list", + "profile", + "email", + "roles", + "web-origins", + "acr" + ], + "defaultOptionalClientScopes": [ + "offline_access", + "address", + "phone", + "microprofile-jwt" + ], + "browserSecurityHeaders": { + "contentSecurityPolicyReportOnly": "", + "xContentTypeOptions": "nosniff", + "referrerPolicy": "no-referrer", + "xRobotsTag": "none", + "xFrameOptions": "SAMEORIGIN", + "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';", + "xXSSProtection": "1; mode=block", + "strictTransportSecurity": "max-age=31536000; includeSubDomains" + }, + "smtpServer": {}, + "loginTheme": "off", + "accountTheme": "off", + "eventsEnabled": true, + "eventsExpiration": 7776000, + "eventsListeners": [ + "jboss-logging", + "persist-deleted-user-event-listener", + "redis-event-listener" + ], + "enabledEventTypes": [ + "SEND_RESET_PASSWORD", + "UPDATE_CONSENT_ERROR", + "GRANT_CONSENT", + "VERIFY_PROFILE_ERROR", + "REMOVE_TOTP", + "REVOKE_GRANT", + "UPDATE_TOTP", + "LOGIN_ERROR", + "CLIENT_LOGIN", + "RESET_PASSWORD_ERROR", + "IMPERSONATE_ERROR", + "CODE_TO_TOKEN_ERROR", + "CUSTOM_REQUIRED_ACTION", + "OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR", + "RESTART_AUTHENTICATION", + "IMPERSONATE", + "UPDATE_PROFILE_ERROR", + "LOGIN", + "OAUTH2_DEVICE_VERIFY_USER_CODE", + "UPDATE_PASSWORD_ERROR", + "CLIENT_INITIATED_ACCOUNT_LINKING", + "OAUTH2_EXTENSION_GRANT", + "USER_DISABLED_BY_PERMANENT_LOCKOUT", + "TOKEN_EXCHANGE", + "AUTHREQID_TO_TOKEN", + "LOGOUT", + "REGISTER", + "DELETE_ACCOUNT_ERROR", + "CLIENT_REGISTER", + "IDENTITY_PROVIDER_LINK_ACCOUNT", + "USER_DISABLED_BY_TEMPORARY_LOCKOUT", + "DELETE_ACCOUNT", + "UPDATE_PASSWORD", + "CLIENT_DELETE", + "FEDERATED_IDENTITY_LINK_ERROR", + "IDENTITY_PROVIDER_FIRST_LOGIN", + "CLIENT_DELETE_ERROR", + "VERIFY_EMAIL", + "CLIENT_LOGIN_ERROR", + "RESTART_AUTHENTICATION_ERROR", + "EXECUTE_ACTIONS", + "REMOVE_FEDERATED_IDENTITY_ERROR", + "TOKEN_EXCHANGE_ERROR", + "PERMISSION_TOKEN", + "SEND_IDENTITY_PROVIDER_LINK_ERROR", + "EXECUTE_ACTION_TOKEN_ERROR", + "OAUTH2_EXTENSION_GRANT_ERROR", + "SEND_VERIFY_EMAIL", + "OAUTH2_DEVICE_AUTH", + "EXECUTE_ACTIONS_ERROR", + "REMOVE_FEDERATED_IDENTITY", + "OAUTH2_DEVICE_CODE_TO_TOKEN", + "IDENTITY_PROVIDER_POST_LOGIN", + "IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR", + "OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR", + "UPDATE_EMAIL", + "REGISTER_ERROR", + "REVOKE_GRANT_ERROR", + "EXECUTE_ACTION_TOKEN", + "LOGOUT_ERROR", + "UPDATE_EMAIL_ERROR", + "CLIENT_UPDATE_ERROR", + "AUTHREQID_TO_TOKEN_ERROR", + "UPDATE_PROFILE", + "CLIENT_REGISTER_ERROR", + "FEDERATED_IDENTITY_LINK", + "SEND_IDENTITY_PROVIDER_LINK", + "SEND_VERIFY_EMAIL_ERROR", + "RESET_PASSWORD", + "CLIENT_INITIATED_ACCOUNT_LINKING_ERROR", + "OAUTH2_DEVICE_AUTH_ERROR", + "UPDATE_CONSENT", + "REMOVE_TOTP_ERROR", + "VERIFY_EMAIL_ERROR", + "SEND_RESET_PASSWORD_ERROR", + "CLIENT_UPDATE", + "CUSTOM_REQUIRED_ACTION_ERROR", + "IDENTITY_PROVIDER_POST_LOGIN_ERROR", + "UPDATE_TOTP_ERROR", + "CODE_TO_TOKEN", + "VERIFY_PROFILE", + "GRANT_CONSENT_ERROR", + "IDENTITY_PROVIDER_FIRST_LOGIN_ERROR" + ], + "adminEventsEnabled": true, + "adminEventsDetailsEnabled": true, + "identityProviders": [], + "identityProviderMappers": [], + "components": { + "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [ + { + "id": "b183dcd5-f711-4c95-9307-c3ac90ede96c", + "name": "Allowed Protocol Mapper Types", + "providerId": "allowed-protocol-mappers", + "subType": "authenticated", + "subComponents": {}, + "config": { + "allowed-protocol-mapper-types": [ + "oidc-full-name-mapper", + "oidc-usermodel-property-mapper", + "saml-user-property-mapper", + "saml-role-list-mapper", + "oidc-address-mapper", + "oidc-usermodel-attribute-mapper", + "oidc-sha256-pairwise-sub-mapper", + "saml-user-attribute-mapper" + ] + } + }, + { + "id": "539c0fae-f869-470d-b219-058562d2d218", + "name": "Allowed Protocol Mapper Types", + "providerId": "allowed-protocol-mappers", + "subType": "anonymous", + "subComponents": {}, + "config": { + "allowed-protocol-mapper-types": [ + "oidc-address-mapper", + "saml-user-attribute-mapper", + "saml-role-list-mapper", + "oidc-usermodel-property-mapper", + "oidc-full-name-mapper", + "oidc-sha256-pairwise-sub-mapper", + "oidc-usermodel-attribute-mapper", + "saml-user-property-mapper" + ] + } + }, + { + "id": "8602688d-3424-4037-a0a0-12405b54f9f8", + "name": "Allowed Client Scopes", + "providerId": "allowed-client-templates", + "subType": "authenticated", + "subComponents": {}, + "config": { + "allow-default-scopes": [ + "true" + ] + } + }, + { + "id": "d4a1a071-49de-47cf-b4f5-b70e7941f7a5", + "name": "Max Clients Limit", + "providerId": "max-clients", + "subType": "anonymous", + "subComponents": {}, + "config": { + "max-clients": [ + "200" + ] + } + }, + { + "id": "2175cf38-7265-4e2d-9320-a31c15aef524", + "name": "Consent Required", + "providerId": "consent-required", + "subType": "anonymous", + "subComponents": {}, + "config": {} + }, + { + "id": "83c49007-1f60-4fdd-ae7a-5b9a966ded72", + "name": "Full Scope Disabled", + "providerId": "scope", + "subType": "anonymous", + "subComponents": {}, + "config": {} + }, + { + "id": "2a71ac63-e747-4cc3-9018-2a0f02c681f1", + "name": "Allowed Client Scopes", + "providerId": "allowed-client-templates", + "subType": "anonymous", + "subComponents": {}, + "config": { + "allow-default-scopes": [ + "true" + ] + } + }, + { + "id": "593a59e1-9911-4eee-9803-f3091194d4e5", + "name": "Trusted Hosts", + "providerId": "trusted-hosts", + "subType": "anonymous", + "subComponents": {}, + "config": { + "host-sending-registration-request-must-match": [ + "true" + ], + "client-uris-must-match": [ + "true" + ] + } + } + ], + "org.keycloak.userprofile.UserProfileProvider": [ + { + "id": "918f023c-6942-4c7b-8026-a8fe4e037e0a", + "providerId": "declarative-user-profile", + "subComponents": {}, + "config": { + "kc.user.profile.config": [ + "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{},\"pattern\":{\"pattern\":\"^[a-z0-9]+[a-z0-9\\\\-]*[a-z0-9]+$\",\"error-message\":\"\"},\"length\":{\"min\":\"2\",\"max\":\"20\"}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"name\",\"displayName\":\"${name}\",\"permissions\":{\"edit\":[\"admin\",\"user\"],\"view\":[\"user\",\"admin\"]},\"annotations\":{},\"validations\":{\"person-name-prohibited-characters\":{\"error-message\":\"\"}}}],\"groups\":[]}" + ] + } + } + ], + "org.keycloak.keys.KeyProvider": [ + { + "id": "f33d1c49-c3c5-4409-b56f-151464f12082", + "name": "aes-generated", + "providerId": "aes-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ] + } + }, + { + "id": "48e3e60b-2dc9-4adf-b343-0cb8a58c29d7", + "name": "hmac-generated", + "providerId": "hmac-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ], + "algorithm": [ + "HS256" + ] + } + }, + { + "id": "fa16d8c9-f6fc-4139-a50d-d700ba7520fb", + "name": "rsa-generated", + "providerId": "rsa-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ] + } + }, + { + "id": "3ddadf69-a870-45d0-ada9-937ace566201", + "name": "rsa-enc-generated", + "providerId": "rsa-enc-generated", + "subComponents": {}, + "config": { + "priority": [ + "100" + ], + "algorithm": [ + "RSA-OAEP" + ] + } + } + ] + }, + "internationalizationEnabled": true, + "supportedLocales": [ + "de", + "no", + "fi", + "ru", + "lt", + "lv", + "fr", + "hu", + "zh-CN", + "sk", + "ca", + "sv", + "pt-BR", + "el", + "en", + "it", + "es", + "cs", + "ar", + "ja", + "fa", + "pl", + "da", + "nl", + "tr" + ], + "defaultLocale": "en", + "authenticationFlows": [ + { + "id": "837aceb1-a125-4512-9e1e-d9ac5d2e5b74", + "alias": "Account verification options", + "description": "Method with which to verity the existing account", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-email-verification", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Verify Existing Account by Re-authentication", + "userSetupAllowed": false + } + ] + }, + { + "id": "0341e0fb-f68a-4873-8693-5580fb6a5a33", + "alias": "Browser - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-otp-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "38bbee9b-ccc8-4a70-82b9-a557059a3195", + "alias": "Direct Grant - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "direct-grant-validate-otp", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "3f93705f-e378-4e0c-9e4f-44bd19fad478", + "alias": "First broker login - Conditional OTP", + "description": "Flow to determine if the OTP is required for the authentication", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-otp-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "d2f35a8f-6963-466c-8fa9-e4750b7c33c2", + "alias": "Handle Existing Account", + "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-confirm-link", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Account verification options", + "userSetupAllowed": false + } + ] + }, + { + "id": "19ccacc2-c55b-404e-8cd2-ec05a4433756", + "alias": "Reset - Conditional OTP", + "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "conditional-user-configured", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-otp", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "cd95618e-8090-4310-a370-93cac5735394", + "alias": "User creation or linking", + "description": "Flow for the existing/non-existing user alternatives", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticatorConfig": "create unique user config", + "authenticator": "idp-create-user-if-unique", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Handle Existing Account", + "userSetupAllowed": false + } + ] + }, + { + "id": "a07df183-1404-4879-8527-4aca2a4f12b5", + "alias": "Verify Existing Account by Re-authentication", + "description": "Reauthentication of existing account", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "idp-username-password-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "First broker login - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "4e81104d-c074-4978-b9d9-b3775b8db85d", + "alias": "browser", + "description": "browser based authentication", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "auth-cookie", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "auth-spnego", + "authenticatorFlow": false, + "requirement": "DISABLED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "identity-provider-redirector", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 25, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "ALTERNATIVE", + "priority": 30, + "autheticatorFlow": true, + "flowAlias": "forms", + "userSetupAllowed": false + } + ] + }, + { + "id": "8b1079fd-4d74-4dd9-9880-69f12816346e", + "alias": "clients", + "description": "Base authentication for clients", + "providerId": "client-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "client-secret", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-jwt", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-secret-jwt", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 30, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "client-x509", + "authenticatorFlow": false, + "requirement": "ALTERNATIVE", + "priority": 40, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "427364f6-1881-4d72-8389-39ddafec8fa8", + "alias": "direct grant", + "description": "OpenID Connect Resource Owner Grant", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "direct-grant-validate-username", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "direct-grant-validate-password", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 30, + "autheticatorFlow": true, + "flowAlias": "Direct Grant - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "8c506173-2dab-47ee-b5f1-acbdb13e7b1c", + "alias": "docker auth", + "description": "Used by Docker clients to authenticate against the IDP", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "docker-http-basic-authenticator", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "6dd67a6e-bde9-4000-9fa9-38b985d935d5", + "alias": "first broker login", + "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticatorConfig": "review profile config", + "authenticator": "idp-review-profile", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "User creation or linking", + "userSetupAllowed": false + } + ] + }, + { + "id": "80eb0f7c-6d8b-43cd-90e5-119d8e44824a", + "alias": "forms", + "description": "Username, password, otp and other auth forms.", + "providerId": "basic-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "auth-username-password-form", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 20, + "autheticatorFlow": true, + "flowAlias": "Browser - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "9eb4e22d-39e7-48ff-b77e-757805d6987a", + "alias": "registration", + "description": "registration flow", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "registration-page-form", + "authenticatorFlow": true, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": true, + "flowAlias": "registration form", + "userSetupAllowed": false + } + ] + }, + { + "id": "34456905-10d7-4a57-9998-5df42f05b29a", + "alias": "registration form", + "description": "registration form", + "providerId": "form-flow", + "topLevel": false, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "registration-user-creation", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "registration-password-action", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 50, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "registration-recaptcha-action", + "authenticatorFlow": false, + "requirement": "DISABLED", + "priority": 60, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + }, + { + "id": "0641d5d0-1d12-45e0-8520-7eb3c1ecb536", + "alias": "reset credentials", + "description": "Reset credentials for a user if they forgot their password or something", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "reset-credentials-choose-user", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-credential-email", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 20, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticator": "reset-password", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 30, + "autheticatorFlow": false, + "userSetupAllowed": false + }, + { + "authenticatorFlow": true, + "requirement": "CONDITIONAL", + "priority": 40, + "autheticatorFlow": true, + "flowAlias": "Reset - Conditional OTP", + "userSetupAllowed": false + } + ] + }, + { + "id": "f194e634-6df2-4b44-a3c6-461e94a3b8c3", + "alias": "saml ecp", + "description": "SAML ECP Profile Authentication Flow", + "providerId": "basic-flow", + "topLevel": true, + "builtIn": true, + "authenticationExecutions": [ + { + "authenticator": "http-basic-authenticator", + "authenticatorFlow": false, + "requirement": "REQUIRED", + "priority": 10, + "autheticatorFlow": false, + "userSetupAllowed": false + } + ] + } + ], + "authenticatorConfig": [ + { + "id": "292fb851-a707-4990-b103-fdf003c89f39", + "alias": "create unique user config", + "config": { + "require.password.update.after.registration": "false" + } + }, + { + "id": "4d7896e8-a936-48d0-aff5-9e3746361daa", + "alias": "review profile config", + "config": { + "update.profile.on.first.login": "missing" + } + } + ], + "requiredActions": [ + { + "alias": "CONFIGURE_TOTP", + "name": "Configure OTP", + "providerId": "CONFIGURE_TOTP", + "enabled": true, + "defaultAction": false, + "priority": 10, + "config": {} + }, + { + "alias": "TERMS_AND_CONDITIONS", + "name": "Terms and Conditions", + "providerId": "TERMS_AND_CONDITIONS", + "enabled": false, + "defaultAction": false, + "priority": 20, + "config": {} + }, + { + "alias": "UPDATE_PASSWORD", + "name": "Update Password", + "providerId": "UPDATE_PASSWORD", + "enabled": true, + "defaultAction": false, + "priority": 30, + "config": {} + }, + { + "alias": "UPDATE_PROFILE", + "name": "Update Profile", + "providerId": "UPDATE_PROFILE", + "enabled": true, + "defaultAction": false, + "priority": 40, + "config": {} + }, + { + "alias": "VERIFY_EMAIL", + "name": "Verify Email", + "providerId": "VERIFY_EMAIL", + "enabled": true, + "defaultAction": false, + "priority": 50, + "config": {} + }, + { + "alias": "delete_account", + "name": "Delete Account", + "providerId": "delete_account", + "enabled": true, + "defaultAction": false, + "priority": 60, + "config": {} + }, + { + "alias": "webauthn-register", + "name": "Webauthn Register", + "providerId": "webauthn-register", + "enabled": true, + "defaultAction": false, + "priority": 70, + "config": {} + }, + { + "alias": "webauthn-register-passwordless", + "name": "Webauthn Register Passwordless", + "providerId": "webauthn-register-passwordless", + "enabled": true, + "defaultAction": false, + "priority": 80, + "config": {} + }, + { + "alias": "update_user_locale", + "name": "Update User Locale", + "providerId": "update_user_locale", + "enabled": true, + "defaultAction": false, + "priority": 1000, + "config": {} + } + ], + "browserFlow": "browser", + "registrationFlow": "registration", + "directGrantFlow": "direct grant", + "resetCredentialsFlow": "reset credentials", + "clientAuthenticationFlow": "clients", + "dockerAuthenticationFlow": "docker auth", + "attributes": { + "cibaBackchannelTokenDeliveryMode": "poll", + "cibaAuthRequestedUserHint": "login_hint", + "clientOfflineSessionMaxLifespan": "0", + "oauth2DevicePollingInterval": "5", + "clientSessionIdleTimeout": "0", + "userProfileEnabled": "true", + "clientOfflineSessionIdleTimeout": "0", + "cibaInterval": "5", + "realmReusableOtpCode": "false", + "cibaExpiresIn": "120", + "oauth2DeviceCodeLifespan": "600", + "parRequestUriLifespan": "60", + "clientSessionMaxLifespan": "0", + "frontendUrl": "", + "acr.loa.map": "{}", + "adminEventsExpiration": "5400" + }, + "keycloakVersion": "23.0.0", + "userManagedAccessAllowed": false, + "clientProfiles": { + "profiles": [] + }, + "clientPolicies": { + "policies": [] + } +} diff --git a/conf/nginx-docker/nginx.conf b/conf/nginx-docker/nginx.conf index 6929179121f5d..ccfbcbbff3567 100644 --- a/conf/nginx-docker/nginx.conf +++ b/conf/nginx-docker/nginx.conf @@ -131,3 +131,27 @@ server { proxy_pass http://$backend; } } + +server { + listen 80; + listen [::]:80; + + server_name auth.${PRODUCT_OPENER_DOMAIN}; + + # logs location + access_log /var/log/nginx/auth-off-access.log; + error_log /var/log/nginx/auth-off-error.log; + + gzip on; + gzip_min_length 1000; + + # this is the internal Docker DNS, cache only for 30s + resolver 127.0.0.11 valid=30s; + location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + set $keycloak keycloak; + proxy_pass http://$keycloak:8080; + } +} diff --git a/cpanfile b/cpanfile index d7bc18fcf1064..065d261d2ef33 100644 --- a/cpanfile +++ b/cpanfile @@ -16,7 +16,6 @@ requires 'JSON::PP'; # libjson-pp-perl requires 'Cpanel::JSON::XS'; # libcpanel-json-xs-perl - fast parsing requires 'JSON::MaybeXS'; # libjson-maybexs-perl requires 'Clone'; # libclone-perl -requires 'Crypt::PasswdMD5'; # libcrypt-passwdmd5-perl requires 'Encode::Detect'; # libencode-detect-perl requires 'Barcode::ZBar'; # libbarcode-zbar-perl requires 'XML::FeedPP'; # libxml-feedpp-perl @@ -38,7 +37,7 @@ requires 'GeoIP2', '>= 2.006002, < 3.0'; # libgeoip2-perl, deps: libdata-validat requires 'Email::Valid', '>= 1.202, < 2.0'; # libemail-valid-perl requires 'Path::Tiny', '>= 0.118'; # libpath-tiny-perl requires 'XML::RPC', '== 2'; # libxml-rpc-fast-perl - +requires 'AnyEvent::RipeRedis'; # libanyevent-redis-perl # Probably not available as Debian/Ubuntu packages requires 'MongoDB', '>= 2.2.2, < 2.3'; # libmongodb-perl has 1.8.1/2.0.3 vs 2.2.2. deps: libauthen-sasl-saslprep-perl, libbson-perl, libauthen-scram-perl, libclass-xsaccessor-perl, libdigest-hmac-perl, libsafe-isa-perl, libconfig-autoconf-perl, libpath-tiny-perl @@ -50,7 +49,6 @@ requires 'Image::OCR::Tesseract'; # deps: libfile-find-rule-perl requires 'DateTime', '>= 1.54, < 2.0'; # libdatetime-perl has 1.46. deps: libclass-singleton-perl requires 'DateTime::Locale', '>= 1.32, < 2.0'; # libdatetime-locale-perl has 1.17. deps: libfile-sharedir-install-perl requires 'DateTime::Format::ISO8601'; # libdatetime-format-iso8601-perl -requires 'Crypt::ScryptKDF'; requires 'Locale::Maketext::Lexicon::Getcontext', '>= 0.05'; # deps: liblocale-maketext-lexicon-perl requires 'CLDR::Number::Format::Decimal'; requires 'CLDR::Number::Format::Percent'; @@ -68,7 +66,6 @@ requires 'JSON::Create'; requires 'JSON::Parse'; requires 'Data::DeepAccess'; requires 'XML::XML2JSON'; -requires 'Redis'; requires 'Digest::SHA1'; requires 'Data::Difference'; requires 'Data::Compare'; @@ -86,6 +83,8 @@ requires 'Log::Any::Adapter::Log4perl', '>= 0.09'; # liblog-any-adapter-log4perl # Retry requires 'Action::CircuitBreaker'; requires 'Action::Retry'; # deps: libmath-fibonacci-perl +requires 'LWP::UserAgent::Plugin'; +requires 'LWP::UserAgent::Plugin::Retry'; # AnyEvent requires 'AnyEvent'; @@ -104,6 +103,10 @@ requires 'Imager::File::JPEG'; requires 'Imager::File::PNG'; requires 'Imager::File::WEBP'; +# OIDC / OAuth +requires 'OIDC::Lite'; +requires 'Crypt::JWT'; + # To dynamically load Config_*.pm modules requires 'Module::Load'; diff --git a/docker-compose.yml b/docker-compose.yml index 66546f4bfd182..84a7e357eed2e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -35,6 +35,12 @@ x-backend-conf: &backend-conf - ODOO_CRM_DB - ODOO_CRM_USER - ODOO_CRM_PASSWORD + - KEYCLOAK_BASE_URL + - KEYCLOAK_BACKCHANNEL_BASE_URL + - KEYCLOAK_REALM_NAME + - PRODUCT_OPENER_OIDC_CLIENT_ID + - PRODUCT_OPENER_OIDC_CLIENT_SECRET + - PRODUCT_OPENER_OIDC_DISCOVERY_ENDPOINT depends_on: - memcached volumes: @@ -104,8 +110,12 @@ services: - "$MINION_QUEUE" incron: <<: *backend-conf - # This service watch for new images to trigger ocr and robotoff processing + # This service watches for new images to trigger ocr and robotoff processing command: ["perl", "scripts/run_cloud_vision_ocr.pl", "/mnt/podata/new_images"] + redis-listener: + <<: *backend-conf + # This service watches for new events on a redis stream to delete users + command: ["perl", "scripts/listen_to_redis_stream.pl"] frontend: image: ghcr.io/openfoodfacts/openfoodfacts-server/frontend:${TAG} depends_on: diff --git a/docker/dev.yml b/docker/dev.yml index 4a2999d6c238d..2ab41d07738e4 100644 --- a/docker/dev.yml +++ b/docker/dev.yml @@ -27,6 +27,9 @@ x-backend-conf: &backend-conf # e.g. when developing with openfoodfacts-query extra_hosts: - "host.docker.internal:host-gateway" + - "auth.openfoodfacts.localhost:host-gateway" + networks: + default: x-minion-db-network: &minion-db-network networks: @@ -42,6 +45,7 @@ services: backend: <<: [*backend-conf, *minion-db-network] incron: *backend-conf + redis-listener: *backend-conf minion: <<: [*backend-conf, *minion-db-network] # in dev we want to use watch assets and recompile on the fly @@ -87,9 +91,21 @@ services: aliases: # trick: make it possible for robotoff to reach it internally, # using localhost domain - - world.openfoodfacts.localhost - - static.openfoodfacts.localhost - - images.openfoodfacts.localhost + - world.${PRODUCT_OPENER_DOMAIN} + - static.${PRODUCT_OPENER_DOMAIN} + - images.${PRODUCT_OPENER_DOMAIN} + - fr.${PRODUCT_OPENER_DOMAIN} + - world-be.${PRODUCT_OPENER_DOMAIN} + - world-de.${PRODUCT_OPENER_DOMAIN} + - world-it.${PRODUCT_OPENER_DOMAIN} + - es-it.${PRODUCT_OPENER_DOMAIN} + - ch-it.${PRODUCT_OPENER_DOMAIN} + - ssl-api.${PRODUCT_OPENER_DOMAIN} + - fr.pro.${PRODUCT_OPENER_DOMAIN} + - world.pro.${PRODUCT_OPENER_DOMAIN} + - auth.${PRODUCT_OPENER_DOMAIN} + - es.${PRODUCT_OPENER_DOMAIN} + - be-fr.${PRODUCT_OPENER_DOMAIN} volumes: product_images: diff --git a/docker/integration-test.yml b/docker/integration-test.yml new file mode 100644 index 0000000000000..60c45293e3163 --- /dev/null +++ b/docker/integration-test.yml @@ -0,0 +1,24 @@ +include: + - ${DEPS_DIR}/openfoodfacts-shared-services/docker-compose.yml + - ${DEPS_DIR}/openfoodfacts-auth/docker-compose.yml + +services: + backend: + depends_on: + postgres: + condition: service_started + mongodb: + condition: service_started + dynamicfront: + condition: service_started + incron: + condition: service_started + minion: + condition: service_started + redis: + condition: service_started + redis-listener: + condition: service_started + keycloak: + # Keycloak takes a while to start so need to wait until it is healthy + condition: service_healthy diff --git a/docker/prod.yml b/docker/prod.yml index 77b854d7a9914..12d4cbc43bc82 100644 --- a/docker/prod.yml +++ b/docker/prod.yml @@ -16,6 +16,10 @@ services: restart: always networks: - webnet + redis-listener: + restart: always + networks: + - webnet minion: restart: always networks: diff --git a/docker/run.yml b/docker/run.yml index e8a686abe57ac..93305f9d8366d 100644 --- a/docker/run.yml +++ b/docker/run.yml @@ -9,6 +9,10 @@ services: networks: # Needed to access MongoDB and Redis shared_network: + redis-listener: + networks: + # Needed to access MongoDB and Redis + shared_network: networks: # This network allows access to shared services like MongoDB and Redis diff --git a/lib/ProductOpener/API.pm b/lib/ProductOpener/API.pm index 7f4ac51ed6714..f677ab194418d 100644 --- a/lib/ProductOpener/API.pm +++ b/lib/ProductOpener/API.pm @@ -1,7 +1,7 @@ # This file is part of Product Opener. # # Product Opener -# Copyright (C) 2011-2023 Association Open Food Facts +# Copyright (C) 2011-2024 Association Open Food Facts # Contact: contact@openfoodfacts.org # Address: 21 rue des Iles, 94100 Saint-Maur des Fossés, France # @@ -53,6 +53,7 @@ BEGIN { &normalize_requested_code &customize_response_for_product &check_user_permission + &process_auth_header ); # symbols to export on request %EXPORT_TAGS = (all => [@EXPORT_OK]); } @@ -62,6 +63,7 @@ use vars @EXPORT_OK; use ProductOpener::Config qw/:all/; use ProductOpener::Display qw/:all/; use ProductOpener::HTTP qw/write_cors_headers/; +use ProductOpener::Auth qw/:all/; use ProductOpener::Users qw/:all/; use ProductOpener::Lang qw/$lc lang_in_other_lc/; use ProductOpener::Products qw/normalize_code_with_gs1_ai product_name_brand_quantity/; @@ -74,6 +76,8 @@ use ProductOpener::Ecoscore qw/localize_ecoscore/; use ProductOpener::Packaging qw/%packaging_taxonomies/; use ProductOpener::Permissions qw/has_permission/; use ProductOpener::GeoIP qw/get_country_for_ip_api/; +use ProductOpener::Paths qw/:all/; +use ProductOpener::Store qw/:all/; use ProductOpener::APIProductRead qw/read_product_api/; use ProductOpener::APIProductWrite qw/write_product_api/; @@ -83,7 +87,7 @@ use ProductOpener::APITagRead qw/read_tag_api/; use ProductOpener::APITaxonomySuggestions qw/taxonomy_suggestions_api/; use ProductOpener::ProductsFeatures qw(feature_enabled); -use CGI qw(header); +use CGI qw/:cgi :form escapeHTML/; use Apache2::RequestIO(); use Apache2::RequestRec(); use JSON::MaybeXS; @@ -908,4 +912,103 @@ sub check_user_permission ($request_ref, $response_ref, $permission) { return $error; } +=head2 process_auth_header ( $request_ref, $r ) + +Using the Authorization HTTP header, check if we have a valid user. + +=head3 Parameters + +=head4 $request_ref (input) + +Reference to the request object. + +=head4 $r (input) + +Reference to the Apache2 request object + +=head3 Return value + +1 if the user has been signed in, -1 if the Bearer token was invalid, 0 otherwise. + +=cut + +sub process_auth_header ($request_ref, $r) { + my $token = _read_auth_header($request_ref, $r); + unless ($token) { + return 0; + } + + my $access_token; + # verify token using JWKS (see Auth.pm) + eval {$access_token = verify_access_token($token);}; + my $error = $@; + if ($error) { + $log->info('Access token invalid', {token => $token}) if $log->is_info(); + } + + unless ($access_token) { + add_error( + $request_ref->{api_response}, + { + message => {id => 'invalid_token'}, + impact => {id => 'failure'}, + } + ); + return -1; + } + + $request_ref->{access_token} = $access_token; + my $user_id = get_user_id_using_token($access_token, $request_ref); + unless (defined $user_id) { + $log->info('User not found and not created') if $log->is_info(); + display_error_and_exit($request_ref, 'Internal error', 500); + } + + my $user_ref = retrieve_user($user_id); + unless (defined $user_ref) { + $log->info('User not found', {user_id => $user_id}) if $log->is_info(); + display_error_and_exit($request_ref, 'Internal error', 500); + } + + $log->debug('user_id found', {user_id => $user_id}) if $log->is_debug(); + + my $user_session = open_user_session($user_ref, undef, undef, $access_token->{access_token}, + undef, $access_token->{id_token}, $request_ref); + param('user_id', $user_id); + param('user_session', $user_session); + init_user($request_ref); + + return 1; +} + +=head2 _read_auth_header ( $request_ref, $r ) + +Using the Authorization HTTP header, check if it looks like a +Bearer token, and if it does, copy it to the request_ref + +=head3 Parameters + +=head4 $request_ref (input) + +Reference to the request object. + +=head4 $r (input) + +Reference to the Apache2 request object + +=head3 Return value + +None + +=cut + +sub _read_auth_header ($request_ref, $r) { + my $authorization = $r->headers_in->{Authorization}; + if ((defined $authorization) and ($authorization =~ /^Bearer (?[% lang('reset_password_reset') %]
-[% lang('login_to_add_products')%]
-[% lang('login_not_registered_yet') %]
- [% lang('login_create_your_account') %]
- [% lang('forgotten_password') %]
-
-1
+