From 5a6f984222d37e50c8d7c06415ba48e66f45b4ed Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Sat, 1 Jan 2022 17:46:11 +0300 Subject: refactor(ops/keycloak): Split out clients & user-sources Without some kind of physical organisation it's a little difficult to understand whether things are going "in" (supplying users to Keycloak) or "out" (getting auth/user info from Keycloak). Change-Id: I516501081e3448c81c710fcbc79cc68ad2a80f3b Reviewed-on: https://cl.tvl.fyi/c/depot/+/4762 Tested-by: BuildkiteCI Reviewed-by: Profpatsch --- ops/keycloak/user_sources.tf | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 ops/keycloak/user_sources.tf (limited to 'ops/keycloak/user_sources.tf') diff --git a/ops/keycloak/user_sources.tf b/ops/keycloak/user_sources.tf new file mode 100644 index 000000000000..3fde6e07cc91 --- /dev/null +++ b/ops/keycloak/user_sources.tf @@ -0,0 +1,21 @@ +# All user sources, that is services from which Keycloak gets user +# information (either by accessing a system like LDAP or integration +# through protocols like OIDC). + +resource "keycloak_ldap_user_federation" "tvl_ldap" { + name = "tvl-ldap" + realm_id = keycloak_realm.tvl.id + enabled = true + connection_url = "ldap://localhost" + users_dn = "ou=users,dc=tvl,dc=fyi" + username_ldap_attribute = "cn" + uuid_ldap_attribute = "cn" + rdn_ldap_attribute = "cn" + full_sync_period = 86400 + trust_email = true + + user_object_classes = [ + "inetOrgPerson", + "organizationalPerson", + ] +} -- cgit 1.4.1