selman koc
3 years ago
committed by
GitHub
GitHub
58 changed files with 1389 additions and 832 deletions
@ -1,6 +0,0 @@ |
|||
apiVersion: v2 |
|||
name: authserver |
|||
appVersion: "1.0" |
|||
description: eShopOnAbp AuthServer Application |
|||
version: 1.0.0 |
|||
type: application |
|||
@ -1,55 +0,0 @@ |
|||
apiVersion: apps/v1 |
|||
kind: Deployment |
|||
metadata: |
|||
name: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
spec: |
|||
selector: |
|||
matchLabels: |
|||
app: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
template: |
|||
metadata: |
|||
labels: |
|||
app: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
spec: |
|||
containers: |
|||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }} |
|||
imagePullPolicy: {{ .Values.image.pullPolicy }} |
|||
name: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
ports: |
|||
- name: http |
|||
containerPort: 80 |
|||
- name: https |
|||
containerPort: 443 |
|||
env: |
|||
- name: App__SelfUrl |
|||
value: "{{ .Values.config.selfUrl }}" |
|||
- name: App__CorsOrigins |
|||
value: "{{ .Values.config.corsOrigins }}" |
|||
- name: App__RedirectAllowedUrls |
|||
value: "{{ .Values.config.allowedRedirectUrls }}" |
|||
- name: "ConnectionStrings__IdentityService" |
|||
value: "{{ .Values.config.connectionStrings.identityService }}" |
|||
- name: "ConnectionStrings__AdministrationService" |
|||
value: "{{ .Values.config.connectionStrings.administrationService }}" |
|||
- name: "AuthServer__Authority" |
|||
value: "{{ .Values.config.authServer.authority }}" |
|||
- name: "AuthServer__RequireHttpsMetadata" |
|||
value: "{{ .Values.config.authServer.requireHttpsMetadata }}" |
|||
- name: "AuthServer__SwaggerClientId" |
|||
value: "{{ .Values.config.authServer.swaggerClientId }}" |
|||
- name: "AuthServer__SwaggerClientSecret" |
|||
value: "{{ .Values.config.authServer.swaggerClientSecret }}" |
|||
- name: "DOTNET_ENVIRONMENT" |
|||
value: "{{ .Values.config.dotnetEnv }}" |
|||
- name: "Redis__Configuration" |
|||
value: "{{ .Values.config.redisHost }}" |
|||
- name: "StringEncryption__DefaultPassPhrase" |
|||
value: "{{ .Values.config.stringEncryptionDefaultPassPhrase }}" |
|||
- name: "RabbitMQ__Connections__Default__HostName" |
|||
value: "{{ .Values.config.rabbitmqHost }}" |
|||
- name: "ElasticSearch__Url" |
|||
value: "{{ .Values.config.elasticsearchHost }}" |
|||
{{- if .Values.env }} |
|||
{{ toYaml .Values.env | indent 8 }} |
|||
{{- end }} |
|||
|
|||
@ -1,20 +0,0 @@ |
|||
config: |
|||
selfUrl: https://demomicro-st-authserver.eshoponabp.com |
|||
corsOrigins: https://demomicro-st-gateway.eshoponabp.com,https://demomicro-st-gateway-public.eshoponabp.com,https://demomicro-st-identity.eshoponabp.com,https://demomicro-st-administration.eshoponabp.com,https://demomicro-st-basket.eshoponabp.com,https://demomicro-st-catalog.eshoponabp.com,https://demomicro-st-order.eshoponabp.com,https://demomicro-st-cmskit.eshoponabp.com,https://demomicro-st-payment.eshoponabp.com,https://demomicro-st-admin.eshoponabp.com,https://demomicro-st-eshoponabp.com |
|||
allowedRedirectUrls: https://demomicro-st-admin.eshoponabp.com |
|||
authServer: |
|||
authority: https://demomicro-st-authserver.eshoponabp.com |
|||
requireHttpsMetadata: "false" |
|||
connectionStrings: |
|||
administrationService: "Host=postgresdb-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" |
|||
identityService: "Host=postgresdb-postgresdb;Port=5432;Database=EShopOnAbp_Identity;User ID=postgres;password=myPassw0rd;Pooling=false" |
|||
dotnetEnv: Production |
|||
redisHost: redis-redis |
|||
rabbitmqHost: rabbitmq-rabbitmq |
|||
elasticsearchHost: elasticsearch-elasticsearch |
|||
ingress: |
|||
host: demomicro-st-authserver.eshoponabp.com |
|||
tlsSecret: eshop-wildcard-tls |
|||
image: |
|||
repository: "volocr.azurecr.io/demomicro/app-authserver" |
|||
tag: 1.0.1 |
|||
@ -1,28 +0,0 @@ |
|||
config: |
|||
selfUrl: # https://eshop-st-authserver |
|||
corsOrigins: # https://eshop-st-identity,https://eshop-st-administration |
|||
allowedRedirectUrls: https://eshop-st-web |
|||
connectionStrings: |
|||
administrationService: # |
|||
identityService: # |
|||
authServer: |
|||
authority: http://eshop-st-authserver |
|||
requireHttpsMetadata: "false" |
|||
swaggerClientId: WebGateway_Swagger |
|||
swaggerClientSecret: "1q2w3e*" |
|||
dotnetEnv: # |
|||
redisHost: # |
|||
rabbitmqHost: # |
|||
elasticsearchHost: # |
|||
stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 |
|||
|
|||
ingress: |
|||
host: eshop-st-authserver |
|||
tlsSecret: eshop-wildcard-tls |
|||
|
|||
image: |
|||
repository: eshoponabp/app-authserver |
|||
tag: latest |
|||
pullPolicy: IfNotPresent |
|||
|
|||
env: {} |
|||
@ -0,0 +1,6 @@ |
|||
apiVersion: v2 |
|||
name: keycloak |
|||
appVersion: "1.0" |
|||
description: Keycloak openid-provider instance |
|||
version: 1.0.0 |
|||
type: application |
|||
@ -0,0 +1,63 @@ |
|||
apiVersion: apps/v1 |
|||
kind: Deployment |
|||
metadata: |
|||
name: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
spec: |
|||
selector: |
|||
matchLabels: |
|||
app: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
template: |
|||
metadata: |
|||
labels: |
|||
app: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
spec: |
|||
containers: |
|||
- image: {{ .Values.image.repository }}:{{ .Values.image.tag }} |
|||
imagePullPolicy: {{ .Values.image.pullPolicy }} |
|||
args: ["start", "--cache-stack=kubernetes"] |
|||
name: {{ .Release.Name }}-{{ .Chart.Name }} |
|||
ports: |
|||
- name: http |
|||
containerPort: 8080 |
|||
- name: https |
|||
containerPort: 8443 |
|||
env: |
|||
- name: "KC_DB" |
|||
value: "{{ .Values.config.kcDb }}" |
|||
- name: "KC_DB_URL" |
|||
value: "{{ .Values.config.kcDbUrl }}" |
|||
- name: "KC_DB_URL_HOST" |
|||
value: "{{ .Values.config.kcDbUrlHost }}" |
|||
- name: "KC_DB_URL_PORT" |
|||
value: "{{ .Values.config.kcDbUrlPort }}" |
|||
- name: "KC_DB_URL_DATABASE" |
|||
value: "{{ .Values.config.kcDbUrlDatabase }}" |
|||
- name: "KC_DB_USERNAME" |
|||
value: "{{ .Values.config.kcDbUsername }}" |
|||
- name: "KC_DB_PASSWORD" |
|||
value: "{{ .Values.config.kcDbPassword }}" |
|||
- name: "KEYCLOAK_ADMIN" |
|||
value: "{{ .Values.config.keycloakAdmin }}" |
|||
- name: "KEYCLOAK_ADMIN_PASSWORD" |
|||
value: "{{ .Values.config.keycloakAdminPassword }}" |
|||
- name: "KC_HEALTH_ENABLED" |
|||
value: "{{ .Values.config.kcHealthEnabled }}" |
|||
- name: "KC_HTTP_RELATIVE_PATH" |
|||
value: "{{ .Values.config.kcHttpRelativePath }}" |
|||
- name: "KC_PROXY" |
|||
value: "{{ .Values.config.kcProxy }}" |
|||
- name: "PROXY_ADDRESS_FORWARDING" |
|||
value: "{{ .Values.config.proxyAddressForwarding }}" |
|||
- name: "KC_HTTP_ENABLED" |
|||
value: "{{ .Values.config.kcHttpEnabled }}" |
|||
- name: "KC_HOSTNAME_URL" |
|||
value: "{{ .Values.config.kcHostnameUrl }}" |
|||
- name: "KC_HOSTNAME_ADMIN_URL" |
|||
value: "{{ .Values.config.kcHostnameAdminUrl }}" |
|||
- name: "jgroups.dns.query" |
|||
value: "{{ .Values.config.jgroupsDnsQuery }}" |
|||
|
|||
{{- if .Values.env }} |
|||
{{ toYaml .Values.env | indent 8 }} |
|||
{{- end }} |
|||
|
|||
@ -0,0 +1,38 @@ |
|||
config: |
|||
kcDb: postgres |
|||
kcDbUrl: jdbc:postgresql://eshop-st-postgresdb:5432/keycloak |
|||
kcDbUrlHost: eshop-st-postgresdb |
|||
kcDbUrlPort: 5432 |
|||
kcDbUrlDatabase: keycloak |
|||
kcDbUsername: postgres |
|||
kcDbPassword: myPassw0rd |
|||
keycloakAdmin: admin |
|||
keycloakAdminPassword: 1q2w3E* |
|||
kcHealthEnabled: true |
|||
kcHttpRelativePath : / |
|||
kcProxy: edge |
|||
proxyAddressForwarding: true |
|||
kcHttpEnabled: true |
|||
kcHostnameUrl: https://account.eshoponabp.dev |
|||
kcHostnameAdminUrl: https://account.eshoponabp.dev |
|||
jgroupsDnsQuery: eshop-st-keycloak |
|||
|
|||
ingress: |
|||
host: account.eshoponabp.dev |
|||
tlsSecret: eshop-wildcard-tls |
|||
|
|||
image: |
|||
repository: quay.io/keycloak/keycloak |
|||
tag: 21.1.1 |
|||
pullPolicy: IfNotPresent |
|||
|
|||
# command: |
|||
# - "/opt/keycloak/bin/kc.sh" |
|||
# - "start" |
|||
# - "--auto-build" |
|||
# - "--http-enabled=true" |
|||
# - "--http-port=8080" |
|||
# - "--hostname-strict=false" |
|||
# - "--hostname-strict-https=false" |
|||
|
|||
env: {} |
|||
@ -1,113 +0,0 @@ |
|||
{ |
|||
"ReverseProxy": { |
|||
"Routes": { |
|||
"Account Service": { |
|||
"ClusterId": "accountCluster", |
|||
"Match": { |
|||
"Path": "/api/account/{**everything}" |
|||
} |
|||
}, |
|||
"Administration Service": { |
|||
"ClusterId": "administrationCluster", |
|||
"Match": { |
|||
"Path": "/api/abp/{**everything}" |
|||
} |
|||
}, |
|||
"Catalog Service": { |
|||
"ClusterId": "catalogCluster", |
|||
"Match": { |
|||
"Path": "/api/catalog/{**everything}" |
|||
} |
|||
}, |
|||
"Basket Service": { |
|||
"ClusterId": "basketCluster", |
|||
"Match": { |
|||
"Path": "/api/basket/{**everything}" |
|||
} |
|||
}, |
|||
"Ordering Service": { |
|||
"ClusterId": "orderingCluster", |
|||
"Match": { |
|||
"Path": "/api/ordering/{**everything}" |
|||
} |
|||
}, |
|||
"Payment Service": { |
|||
"ClusterId": "paymentCluster", |
|||
"Match": { |
|||
"Path": "/api/payment/{**everything}" |
|||
} |
|||
}, |
|||
"Cmskit Service": { |
|||
"ClusterId": "cmskitCluster", |
|||
"Match": { |
|||
"Path": "/api/cmskit/{**everything}" |
|||
} |
|||
}, |
|||
"product-picture-route": { |
|||
"ClusterId": "productPictureCluster", |
|||
"Match": { |
|||
"Path": "/product-images/{**everything}", |
|||
"Methods": [ "GET" ] |
|||
} |
|||
} |
|||
}, |
|||
"Clusters": { |
|||
"accountCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-authserver" |
|||
} |
|||
} |
|||
}, |
|||
"administrationCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-administration" |
|||
} |
|||
} |
|||
}, |
|||
"catalogCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-catalog" |
|||
} |
|||
} |
|||
}, |
|||
"basketCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-basket" |
|||
} |
|||
} |
|||
}, |
|||
"orderingCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-ordering" |
|||
} |
|||
} |
|||
}, |
|||
"paymentCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-payment" |
|||
} |
|||
} |
|||
}, |
|||
"cmskitCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-cmskit" |
|||
} |
|||
} |
|||
}, |
|||
"productPictureCluster": { |
|||
"Destinations": { |
|||
"destination1": { |
|||
"Address": "http://eshop-st-catalog" |
|||
} |
|||
} |
|||
} |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,432 @@ |
|||
using System; |
|||
using System.Collections.Generic; |
|||
using System.Linq; |
|||
using System.Threading.Tasks; |
|||
using EShopOnAbp.IdentityService.Keycloak.Service; |
|||
using Keycloak.Net; |
|||
using Keycloak.Net.Models.Clients; |
|||
using Keycloak.Net.Models.ClientScopes; |
|||
using Keycloak.Net.Models.ProtocolMappers; |
|||
using Microsoft.Extensions.Configuration; |
|||
using Microsoft.Extensions.Logging; |
|||
using Microsoft.Extensions.Options; |
|||
using Volo.Abp.Data; |
|||
using Volo.Abp.DependencyInjection; |
|||
|
|||
namespace EShopOnAbp.IdentityService.DbMigrations; |
|||
|
|||
public class KeyCloakDataSeeder : IDataSeedContributor, ITransientDependency |
|||
{ |
|||
private readonly KeycloakClient _keycloakClient; |
|||
private readonly KeycloakClientOptions _keycloakOptions; |
|||
private readonly ILogger<KeyCloakDataSeeder> _logger; |
|||
private readonly IConfiguration _configuration; |
|||
|
|||
public KeyCloakDataSeeder(IOptions<KeycloakClientOptions> keycloakClientOptions, ILogger<KeyCloakDataSeeder> logger, |
|||
IConfiguration configuration) |
|||
{ |
|||
_logger = logger; |
|||
_configuration = configuration; |
|||
_keycloakOptions = keycloakClientOptions.Value; |
|||
|
|||
_keycloakClient = new KeycloakClient( |
|||
_keycloakOptions.Url, |
|||
_keycloakOptions.AdminUserName, |
|||
_keycloakOptions.AdminPassword |
|||
); |
|||
} |
|||
|
|||
public async Task SeedAsync(DataSeedContext context) |
|||
{ |
|||
await UpdateRealmSettingsAsync(); |
|||
await UpdateAdminUserAsync(); |
|||
await CreateRoleMapperAsync(); // roles scope
|
|||
await CreateClientScopesAsync(); |
|||
await CreateClientsAsync(); |
|||
} |
|||
|
|||
private async Task UpdateRealmSettingsAsync() |
|||
{ |
|||
var masterRealm = await _keycloakClient.GetRealmAsync(_keycloakOptions.RealmName); |
|||
if (masterRealm.AccessTokenLifespan != 30 * 60) |
|||
{ |
|||
masterRealm.AccessTokenLifespan = 30 * 60; |
|||
await _keycloakClient.UpdateRealmAsync(_keycloakOptions.RealmName, masterRealm); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateRoleMapperAsync() |
|||
{ |
|||
var roleScope = (await _keycloakClient.GetClientScopesAsync(_keycloakOptions.RealmName)) |
|||
.FirstOrDefault(q => q.Name == "roles"); |
|||
if (roleScope == null) |
|||
return; |
|||
|
|||
if (!roleScope.ProtocolMappers.Any(q => q.Name == "roles")) |
|||
{ |
|||
await _keycloakClient.CreateProtocolMapperAsync(_keycloakOptions.RealmName, roleScope.Id, |
|||
new ProtocolMapper() |
|||
{ |
|||
Name = "roles", |
|||
Protocol = "openid-connect", |
|||
_ProtocolMapper = "oidc-usermodel-realm-role-mapper", |
|||
Config = new Dictionary<string, string>() |
|||
{ |
|||
{ "access.token.claim", "true" }, |
|||
{ "id.token.claim", "true" }, |
|||
{ "claim.name", "role" }, |
|||
{ "multivalued", "true" }, |
|||
{ "userinfo.token.claim", "true" }, |
|||
} |
|||
}); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateClientScopesAsync() |
|||
{ |
|||
await CreateScopeAsync("AdministrationService"); |
|||
await CreateScopeAsync("IdentityService"); |
|||
await CreateScopeAsync("BasketService"); |
|||
await CreateScopeAsync("CatalogService"); |
|||
await CreateScopeAsync("OrderingService"); |
|||
await CreateScopeAsync("PaymentService"); |
|||
await CreateScopeAsync("CmskitService"); |
|||
} |
|||
|
|||
private async Task CreateScopeAsync(string scopeName) |
|||
{ |
|||
var scope = (await _keycloakClient.GetClientScopesAsync(_keycloakOptions.RealmName)) |
|||
.FirstOrDefault(q => q.Name == scopeName); |
|||
|
|||
if (scope == null) |
|||
{ |
|||
scope = new ClientScope |
|||
{ |
|||
Name = scopeName, |
|||
Description = scopeName + " scope", |
|||
Protocol = "openid-connect", |
|||
Attributes = new Attributes |
|||
{ |
|||
ConsentScreenText = scopeName, |
|||
DisplayOnConsentScreen = "true", |
|||
IncludeInTokenScope = "true" |
|||
}, |
|||
ProtocolMappers = new List<ProtocolMapper>() |
|||
{ |
|||
new ProtocolMapper() |
|||
{ |
|||
Name = scopeName, |
|||
Protocol = "openid-connect", |
|||
_ProtocolMapper = "oidc-audience-mapper", |
|||
Config = |
|||
new |
|||
Dictionary<string, string> |
|||
{ |
|||
{ "id.token.claim", "false" }, |
|||
{ "access.token.claim", "true" }, |
|||
{ "included.custom.audience", scopeName } |
|||
} |
|||
} |
|||
} |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientScopeAsync(_keycloakOptions.RealmName, scope); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateClientsAsync() |
|||
{ |
|||
await CreatePublicWebClientAsync(); |
|||
await CreateSwaggerClientAsync(); |
|||
await CreateWebClientAsync(); |
|||
// await CreateCmskitClientAsync();
|
|||
// await CreateAdministrationClientAsync();
|
|||
} |
|||
|
|||
private async Task CreateAdministrationClientAsync() |
|||
{ |
|||
var administrationClient = |
|||
(await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, |
|||
clientId: "EShopOnAbp_AdministrationService")) |
|||
.FirstOrDefault(); |
|||
|
|||
if (administrationClient == null) |
|||
{ |
|||
administrationClient = new Client() |
|||
{ |
|||
ClientId = "EShopOnAbp_AdministrationService", |
|||
Name = "Administration service client", |
|||
Protocol = "openid-connect", |
|||
PublicClient = false, |
|||
ImplicitFlowEnabled = false, |
|||
AuthorizationServicesEnabled = false, |
|||
StandardFlowEnabled = false, |
|||
DirectAccessGrantsEnabled = false, |
|||
ServiceAccountsEnabled = true, |
|||
Secret = "1q2w3e*" |
|||
}; |
|||
|
|||
administrationClient.Attributes = new Dictionary<string, object>() |
|||
{ |
|||
{ "oauth2.device.authorization.grant.enabled", false }, |
|||
{ "oidc.ciba.grant.enabled", false } |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientAsync(_keycloakOptions.RealmName, administrationClient); |
|||
|
|||
await AddOptionalClientScopesAsync( |
|||
"EShopOnAbp_AdministrationService", |
|||
new List<string> |
|||
{ |
|||
"IdentityService" |
|||
} |
|||
); |
|||
|
|||
var insertedClient = |
|||
(await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "EShopOnAbp_AdministrationService")) |
|||
.First(); |
|||
|
|||
var clientIdProtocolMapper = insertedClient.ProtocolMappers.First(q => q.Name == "Client ID"); |
|||
|
|||
clientIdProtocolMapper.Config["claim.name"] = "client_id"; |
|||
|
|||
var result = await _keycloakClient.UpdateClientAsync(_keycloakOptions.RealmName, insertedClient.Id, |
|||
insertedClient); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateCmskitClientAsync() |
|||
{ |
|||
var cmsKitClient = |
|||
(await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "EShopOnAbp_CmskitService")) |
|||
.FirstOrDefault(); |
|||
|
|||
if (cmsKitClient == null) |
|||
{ |
|||
cmsKitClient = new Client() |
|||
{ |
|||
ClientId = "EShopOnAbp_CmskitService", |
|||
Name = "Cmskit microservice client", |
|||
Protocol = "openid-connect", |
|||
PublicClient = false, |
|||
ImplicitFlowEnabled = false, |
|||
AuthorizationServicesEnabled = false, |
|||
StandardFlowEnabled = false, |
|||
DirectAccessGrantsEnabled = false, |
|||
ServiceAccountsEnabled = true, |
|||
Secret = "1q2w3e*" |
|||
}; |
|||
cmsKitClient.Attributes = new Dictionary<string, object>() |
|||
{ |
|||
{ "oauth2.device.authorization.grant.enabled", false }, |
|||
{ "oidc.ciba.grant.enabled", false }, |
|||
{ "client_credentials.use_refresh_token", false } |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientAsync(_keycloakOptions.RealmName, cmsKitClient); |
|||
|
|||
await AddOptionalClientScopesAsync( |
|||
"EShopOnAbp_CmskitService", |
|||
new List<string> |
|||
{ |
|||
"IdentityService" |
|||
} |
|||
); |
|||
|
|||
var insertedClient = |
|||
(await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "EShopOnAbp_CmskitService")) |
|||
.First(); |
|||
|
|||
var clientIdProtocolMapper = insertedClient.ProtocolMappers.First(q => q.Name == "Client ID"); |
|||
|
|||
clientIdProtocolMapper.Config["claim.name"] = "client_id"; |
|||
|
|||
var result = await _keycloakClient.UpdateClientAsync(_keycloakOptions.RealmName, insertedClient.Id, |
|||
insertedClient); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateWebClientAsync() |
|||
{ |
|||
var webClient = (await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "Web")) |
|||
.FirstOrDefault(); |
|||
|
|||
if (webClient == null) |
|||
{ |
|||
var webRootUrl = _configuration[$"Clients:Web:RootUrl"]; |
|||
webClient = new Client |
|||
{ |
|||
ClientId = "Web", |
|||
Name = "Angular Back-Office Web Application", |
|||
Protocol = "openid-connect", |
|||
Enabled = true, |
|||
BaseUrl = webRootUrl, |
|||
RedirectUris = new List<string> |
|||
{ |
|||
$"{webRootUrl.TrimEnd('/')}" |
|||
}, |
|||
FrontChannelLogout = true, |
|||
PublicClient = true |
|||
}; |
|||
webClient.Attributes = new Dictionary<string, object> |
|||
{ |
|||
{ "post.logout.redirect.uris", $"{webRootUrl.TrimEnd('/')}" } |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientAsync(_keycloakOptions.RealmName, webClient); |
|||
|
|||
await AddOptionalClientScopesAsync( |
|||
"Web", |
|||
new List<string> |
|||
{ |
|||
"AdministrationService", "IdentityService", "BasketService", "CatalogService", |
|||
"OrderingService", "PaymentService", "CmskitService" |
|||
} |
|||
); |
|||
} |
|||
} |
|||
|
|||
private async Task CreateSwaggerClientAsync() |
|||
{ |
|||
var swaggerClient = |
|||
(await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "SwaggerClient")) |
|||
.FirstOrDefault(); |
|||
|
|||
if (swaggerClient == null) |
|||
{ |
|||
var webGatewaySwaggerRootUrl = _configuration[$"Clients:WebGateway:RootUrl"].TrimEnd('/'); |
|||
var publicWebGatewayRootUrl = _configuration[$"Clients:PublicWebGateway:RootUrl"].TrimEnd('/'); |
|||
var accountServiceRootUrl = _configuration[$"Clients:AccountService:RootUrl"].TrimEnd('/'); |
|||
var identityServiceRootUrl = _configuration[$"Clients:IdentityService:RootUrl"].TrimEnd('/'); |
|||
var administrationServiceRootUrl = _configuration[$"Clients:AdministrationService:RootUrl"].TrimEnd('/'); |
|||
var catalogServiceRootUrl = _configuration[$"Clients:CatalogService:RootUrl"].TrimEnd('/'); |
|||
var basketServiceRootUrl = _configuration[$"Clients:BasketService:RootUrl"].TrimEnd('/'); |
|||
var orderingServiceRootUrl = _configuration[$"Clients:OrderingService:RootUrl"].TrimEnd('/'); |
|||
var paymentServiceRootUrl = _configuration[$"Clients:PaymentService:RootUrl"].TrimEnd('/'); |
|||
var cmskitServiceRootUrl = _configuration[$"Clients:CmskitService:RootUrl"].TrimEnd('/'); |
|||
|
|||
swaggerClient = new Client |
|||
{ |
|||
ClientId = "SwaggerClient", |
|||
Name = "Swagger Client Application", |
|||
Protocol = "openid-connect", |
|||
Enabled = true, |
|||
RedirectUris = new List<string> |
|||
{ |
|||
$"{webGatewaySwaggerRootUrl}/swagger/oauth2-redirect.html", // WebGateway redirect uri
|
|||
$"{publicWebGatewayRootUrl}/swagger/oauth2-redirect.html", // PublicWebGateway redirect uri
|
|||
$"{accountServiceRootUrl}/swagger/oauth2-redirect.html", // AccountService redirect uri
|
|||
$"{identityServiceRootUrl}/swagger/oauth2-redirect.html", // IdentityService redirect uri
|
|||
$"{administrationServiceRootUrl}/swagger/oauth2-redirect.html", // AdministrationService redirect uri
|
|||
$"{catalogServiceRootUrl}/swagger/oauth2-redirect.html", // CatalogService redirect uri
|
|||
$"{basketServiceRootUrl}/swagger/oauth2-redirect.html", // BasketService redirect uri
|
|||
$"{orderingServiceRootUrl}/swagger/oauth2-redirect.html", // OrderingService redirect uri
|
|||
$"{paymentServiceRootUrl}/swagger/oauth2-redirect.html", // PaymentService redirect uri
|
|||
$"{cmskitServiceRootUrl}/swagger/oauth2-redirect.html" // CmskitService redirect uri
|
|||
}, |
|||
FrontChannelLogout = true, |
|||
PublicClient = true |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientAsync(_keycloakOptions.RealmName, swaggerClient); |
|||
|
|||
await AddOptionalClientScopesAsync( |
|||
"SwaggerClient", |
|||
new List<string> |
|||
{ |
|||
"AdministrationService", "IdentityService", "BasketService", "CatalogService", |
|||
"OrderingService", "PaymentService", "CmskitService" |
|||
} |
|||
); |
|||
} |
|||
} |
|||
|
|||
private async Task CreatePublicWebClientAsync() |
|||
{ |
|||
var publicWebClient = (await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: "PublicWeb")) |
|||
.FirstOrDefault(); |
|||
|
|||
if (publicWebClient == null) |
|||
{ |
|||
var publicWebRootUrl = _configuration[$"Clients:PublicWeb:RootUrl"]; |
|||
publicWebClient = new Client |
|||
{ |
|||
ClientId = "PublicWeb", |
|||
Name = "Public Web Application", |
|||
Protocol = "openid-connect", |
|||
Enabled = true, |
|||
BaseUrl = publicWebRootUrl, |
|||
RedirectUris = new List<string> |
|||
{ |
|||
$"{publicWebRootUrl.TrimEnd('/')}/signin-oidc" |
|||
}, |
|||
FrontChannelLogout = true, |
|||
PublicClient = true, |
|||
ImplicitFlowEnabled = true // for hybrid flow
|
|||
}; |
|||
publicWebClient.Attributes = new Dictionary<string, object> |
|||
{ |
|||
{ "post.logout.redirect.uris", $"{publicWebRootUrl.TrimEnd('/')}/signout-callback-oidc" } |
|||
}; |
|||
|
|||
await _keycloakClient.CreateClientAsync(_keycloakOptions.RealmName, publicWebClient); |
|||
|
|||
await AddOptionalClientScopesAsync( |
|||
"PublicWeb", |
|||
new List<string> |
|||
{ |
|||
"AdministrationService", "IdentityService", "BasketService", "CatalogService", |
|||
"OrderingService", "PaymentService", "CmskitService" |
|||
} |
|||
); |
|||
} |
|||
} |
|||
|
|||
private async Task AddOptionalClientScopesAsync(string clientName, List<string> scopes) |
|||
{ |
|||
var client = (await _keycloakClient.GetClientsAsync(_keycloakOptions.RealmName, clientId: clientName)) |
|||
.FirstOrDefault(); |
|||
if (client == null) |
|||
{ |
|||
_logger.LogError($"Couldn't find {clientName}! Could not seed optional scopes!"); |
|||
return; |
|||
} |
|||
|
|||
var clientOptionalScopes = |
|||
(await _keycloakClient.GetOptionalClientScopesAsync(_keycloakOptions.RealmName, client.Id)).ToList(); |
|||
|
|||
var clientScopes = (await _keycloakClient.GetClientScopesAsync(_keycloakOptions.RealmName)).ToList(); |
|||
|
|||
foreach (var scope in scopes) |
|||
{ |
|||
if (!clientOptionalScopes.Any(q => q.Name == scope)) |
|||
{ |
|||
var serviceScope = clientScopes.First(q => q.Name == scope); |
|||
_logger.LogInformation($"Seeding {scope} scope to {clientName}."); |
|||
await _keycloakClient.UpdateOptionalClientScopeAsync(_keycloakOptions.RealmName, client.Id, |
|||
serviceScope.Id); |
|||
} |
|||
} |
|||
} |
|||
|
|||
private async Task UpdateAdminUserAsync() |
|||
{ |
|||
var users = await _keycloakClient.GetUsersAsync(_keycloakOptions.RealmName, username: "admin"); |
|||
var adminUser = users.FirstOrDefault(); |
|||
if (adminUser == null) |
|||
{ |
|||
throw new Exception( |
|||
"Keycloak admin user is not provided, check if KEYCLOAK_ADMIN environment variable is passed properly."); |
|||
} |
|||
|
|||
if (string.IsNullOrEmpty(adminUser.Email)) |
|||
{ |
|||
adminUser.Email = "admin@abp.io"; |
|||
adminUser.FirstName = "admin"; |
|||
adminUser.EmailVerified = true; |
|||
|
|||
_logger.LogInformation("Updating admin user with email and first name..."); |
|||
await _keycloakClient.UpdateUserAsync(_keycloakOptions.RealmName, adminUser.Id, adminUser); |
|||
} |
|||
} |
|||
} |
|||
Loading…
Reference in new issue