feat: pepr Keycloak Client management by slaskawi · Pull Request #358 · defenseunicorns/uds-identity-config

slaskawi · 2025-03-04T11:39:46Z

Description

This Pull Request is the counterpart of defenseunicorns/uds-core#1341 and introduces necessary plugins and Realm Configuration for using Client Credentials Grant by the UDS Operator to manage Keycloak Clients

The documentation for this feature will be delivered separately

Related Issue

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

…management-docs

…docs' into pepr_keycloak_client_management

…management

…in/clientpolicy/executor/UDSClientPolicyPermissionsExecutorFactory.java Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com>

…management

mjnagel

LGTM overall - small comments, but the functionality seems to work as expected in testing.

Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

## Description This Pull Request introduces an alternative mode for managing Keycloak Clients by the UDS Operator. The UDS Operator now discovers if Keycloak has been properly configure (and if it supports the configuration delivered by defenseunicorns/uds-identity-config#358) and switches to Client Credentials if it does. In other case, the UDS Operator will keep using the Dynamic Client Registration feature. The behavior might be overridden by using the `PEPR_KEYCLOAK_CLIENT_STRATEGY` Environment Variable in the UDS Operator that can have 3 values: * `dynamic_client_registration` - the Dynamic Client Registration mode * `client_credentials` - using the Client Credentials mode * `auto` - the Operator probes if a token obtained by the Client Credentials Grant looks good and picks proper mode according to the results of the check. The documentation for this feature will be delivered here: #1367 ## Related Issue * Fixes #1330 * Relates to #1296 * [Technical Design](https://www.notion.so/Managing-Keycloak-Clients-from-Pepr-1a5e512f24fc80c4bc35d13b9d7a1367) ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Steps to Validate This functionality primarily relies on the regression testing. ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed --------- Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com> Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com> Co-authored-by: Noah <40781376+noahpb@users.noreply.github.com> Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

…icorns#1341) ## Description This Pull Request introduces an alternative mode for managing Keycloak Clients by the UDS Operator. The UDS Operator now discovers if Keycloak has been properly configure (and if it supports the configuration delivered by defenseunicorns/uds-identity-config#358) and switches to Client Credentials if it does. In other case, the UDS Operator will keep using the Dynamic Client Registration feature. The behavior might be overridden by using the `PEPR_KEYCLOAK_CLIENT_STRATEGY` Environment Variable in the UDS Operator that can have 3 values: * `dynamic_client_registration` - the Dynamic Client Registration mode * `client_credentials` - using the Client Credentials mode * `auto` - the Operator probes if a token obtained by the Client Credentials Grant looks good and picks proper mode according to the results of the check. The documentation for this feature will be delivered here: defenseunicorns#1367 ## Related Issue * Fixes defenseunicorns#1330 * Relates to defenseunicorns#1296 * [Technical Design](https://www.notion.so/Managing-Keycloak-Clients-from-Pepr-1a5e512f24fc80c4bc35d13b9d7a1367) ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Steps to Validate This functionality primarily relies on the regression testing. ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed --------- Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com> Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com> Co-authored-by: Noah <40781376+noahpb@users.noreply.github.com> Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

slaskawi mentioned this pull request Mar 18, 2025

feat: use Client Credentials for managing Keycloak Clients defenseunicorns/uds-core#1341

Merged

5 tasks