From e8fa347fd1e22b6c55941ecff8b6d385c7027791 Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Sun, 26 Dec 2021 18:36:00 +0300 Subject: feat(ops/keycloak): Set up oauth2_proxy client Change-Id: I996d9644ed7e870d6e5a42af117eafbf841da679 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4640 Tested-by: BuildkiteCI Autosubmit: tazjin Reviewed-by: Profpatsch --- ops/keycloak/main.tf | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/ops/keycloak/main.tf b/ops/keycloak/main.tf index 312e8ac61fcf..95902476bba2 100644 --- a/ops/keycloak/main.tf +++ b/ops/keycloak/main.tf @@ -38,3 +38,24 @@ resource "keycloak_ldap_user_federation" "tvl_ldap" { "organizationalPerson", ] } + +resource "keycloak_openid_client" "oauth2_proxy" { + realm_id = keycloak_realm.tvl.id + client_id = "oauth2-proxy" + name = "TVL OAuth2 Proxy" + enabled = true + access_type = "CONFIDENTIAL" + standard_flow_enabled = true + + valid_redirect_uris = [ + "https://login.tvl.fyi/oauth2/callback" + ] +} + +resource "keycloak_openid_audience_protocol_mapper" "panettone_audience" { + realm_id = keycloak_realm.tvl.id + client_id = keycloak_openid_client.oauth2_proxy.id + name = "panettone-audience" + + included_custom_audience = "b" +} -- cgit 1.4.1