id.afnix.fr: add broker flows and render first / last name optional

raito commented

2025-08-28 00:22:55 +00:00

Owner

Fixes #284.
Depends on #265.

Fixes #284. Depends on #265.

raito added 2 commits

2025-08-28 00:22:55 +00:00

terraform/afnix_superadmin/keycloak: make first name and last name optional c1224b182e

This avoids user being prompted for mandatory first name and last name
when we care only about email and usernames.

Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

terraform/afnix_superadmin/keycloak: adopt Lix-style broker flows 4e5fccd2af

This gives us the primitive to extend the logic later on, incl.
moderation support.

Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

raito commented

2025-08-28 00:41:36 +00:00

Author

Owner

Plan sounds good by rebasing it on #265.


  # keycloak_authentication_execution.create_user_if_unique will be created
  + resource "keycloak_authentication_execution" "create_user_if_unique" {
      + authenticator     = "idp-create-user-if-unique"
      + id                = (known after apply)
      + parent_flow_alias = "first broker login / User creation or linking"
      + priority          = 10
      + realm_id          = "afnix"
      + requirement       = "REQUIRED"
    }

  # keycloak_authentication_execution.review_profile will be created
  + resource "keycloak_authentication_execution" "review_profile" {
      + authenticator     = "idp-review-profile"
      + id                = (known after apply)
      + parent_flow_alias = "first broker login"
      + priority          = 10
      + realm_id          = "afnix"
      + requirement       = "REQUIRED"
    }

  # keycloak_authentication_flow.first_broker_login will be created
  + resource "keycloak_authentication_flow" "first_broker_login" {
      + alias       = "first broker login"
      + description = <<-EOT
            Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account
        EOT
      + id          = (known after apply)
      + provider_id = "basic-flow"
      + realm_id    = "afnix"
    }

  # keycloak_authentication_flow.post_github_login will be created
  + resource "keycloak_authentication_flow" "post_github_login" {
      + alias       = "post github login"
      + description = <<-EOT
            Enforce bans post github login since it bypasses the normal flow
        EOT
      + id          = (known after apply)
      + provider_id = "basic-flow"
      + realm_id    = "afnix"
    }

  # keycloak_authentication_subflow.first_broker_login_creation_or_linkage will be created
  + resource "keycloak_authentication_subflow" "first_broker_login_creation_or_linkage" {
      + alias             = "first broker login / User creation or linking"
      + description       = <<-EOT
            Flow for the existing / non existing user alternatives.
        EOT
      + id                = (known after apply)
      + parent_flow_alias = "first broker login"
      + priority          = 20
      + provider_id       = "basic-flow"
      + realm_id          = "afnix"
      + requirement       = "REQUIRED"
    }

  # keycloak_realm_user_profile.default_user_profile will be created
  + resource "keycloak_realm_user_profile" "default_user_profile" {
      + id                         = (known after apply)
      + realm_id                   = "afnix"
      + unmanaged_attribute_policy = "ADMIN_EDIT"

      + attribute {
          + display_name       = "${username}"
          + group              = "user-metadata"
          + multi_valued       = false
          + name               = "username"
          + required_for_roles = [
              + "admin",
              + "user",
            ]

          + permissions {
              + edit = [
                  + "admin",
                  + "user",
                ]
              + view = [
                  + "admin",
                  + "user",
                ]
            }

          + validator {
              + config = {
                  + "max" = "255"
                  + "min" = "3"
                }
              + name   = "length"
            }
          + validator {
              + name = "up-username-not-idn-homograph"
            }
          + validator {
              + name = "username-prohibited-characters"
            }
        }
      + attribute {
          + display_name       = "${email}"
          + group              = "user-metadata"
          + multi_valued       = false
          + name               = "email"
          + required_for_roles = [
              + "admin",
              + "user",
            ]

          + permissions {
              + edit = [
                  + "admin",
                  + "user",
                ]
              + view = [
                  + "admin",
                  + "user",
                ]
            }

          + validator {
              + config = {
                  + "max" = "255"
                  + "min" = "0"
                }
              + name   = "length"
            }
          + validator {
              + name = "email"
            }
        }
      + attribute {
          + display_name = "${firstName}"
          + group        = "user-metadata"
          + multi_valued = false
          + name         = "firstName"

          + permissions {
              + edit = [
                  + "admin",
                  + "user",
                ]
              + view = [
                  + "admin",
                  + "user",
                ]
            }

          + validator {
              + config = {
                  + "max" = "255"
                  + "min" = "0"
                }
              + name   = "length"
            }
          + validator {
              + name = "person-name-prohibited-chars"
            }
        }
      + attribute {
          + display_name = "${lastName}"
          + group        = "user-metadata"
          + multi_valued = false
          + name         = "lastName"

          + permissions {
              + edit = [
                  + "admin",
                  + "user",
                ]
              + view = [
                  + "admin",
                  + "user",
                ]
            }

          + validator {
              + config = {
                  + "max" = "255"
                  + "min" = "0"
                }
              + name   = "length"
            }
          + validator {
              + name = "person-name-prohibited-chars"
            }
        }

      + group {
          + display_description = "Attributes, which refer to user metadata"
          + display_header      = "User metadata"
          + name                = "user-metadata"
        }
    }
    ```

I will wait for #265 to be merged though.

Plan sounds good by rebasing it on #265. ``` # keycloak_authentication_execution.create_user_if_unique will be created + resource "keycloak_authentication_execution" "create_user_if_unique" { + authenticator = "idp-create-user-if-unique" + id = (known after apply) + parent_flow_alias = "first broker login / User creation or linking" + priority = 10 + realm_id = "afnix" + requirement = "REQUIRED" } # keycloak_authentication_execution.review_profile will be created + resource "keycloak_authentication_execution" "review_profile" { + authenticator = "idp-review-profile" + id = (known after apply) + parent_flow_alias = "first broker login" + priority = 10 + realm_id = "afnix" + requirement = "REQUIRED" } # keycloak_authentication_flow.first_broker_login will be created + resource "keycloak_authentication_flow" "first_broker_login" { + alias = "first broker login" + description = <<-EOT Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account EOT + id = (known after apply) + provider_id = "basic-flow" + realm_id = "afnix" } # keycloak_authentication_flow.post_github_login will be created + resource "keycloak_authentication_flow" "post_github_login" { + alias = "post github login" + description = <<-EOT Enforce bans post github login since it bypasses the normal flow EOT + id = (known after apply) + provider_id = "basic-flow" + realm_id = "afnix" } # keycloak_authentication_subflow.first_broker_login_creation_or_linkage will be created + resource "keycloak_authentication_subflow" "first_broker_login_creation_or_linkage" { + alias = "first broker login / User creation or linking" + description = <<-EOT Flow for the existing / non existing user alternatives. EOT + id = (known after apply) + parent_flow_alias = "first broker login" + priority = 20 + provider_id = "basic-flow" + realm_id = "afnix" + requirement = "REQUIRED" } # keycloak_realm_user_profile.default_user_profile will be created + resource "keycloak_realm_user_profile" "default_user_profile" { + id = (known after apply) + realm_id = "afnix" + unmanaged_attribute_policy = "ADMIN_EDIT" + attribute { + display_name = "${username}" + group = "user-metadata" + multi_valued = false + name = "username" + required_for_roles = [ + "admin", + "user", ] + permissions { + edit = [ + "admin", + "user", ] + view = [ + "admin", + "user", ] } + validator { + config = { + "max" = "255" + "min" = "3" } + name = "length" } + validator { + name = "up-username-not-idn-homograph" } + validator { + name = "username-prohibited-characters" } } + attribute { + display_name = "${email}" + group = "user-metadata" + multi_valued = false + name = "email" + required_for_roles = [ + "admin", + "user", ] + permissions { + edit = [ + "admin", + "user", ] + view = [ + "admin", + "user", ] } + validator { + config = { + "max" = "255" + "min" = "0" } + name = "length" } + validator { + name = "email" } } + attribute { + display_name = "${firstName}" + group = "user-metadata" + multi_valued = false + name = "firstName" + permissions { + edit = [ + "admin", + "user", ] + view = [ + "admin", + "user", ] } + validator { + config = { + "max" = "255" + "min" = "0" } + name = "length" } + validator { + name = "person-name-prohibited-chars" } } + attribute { + display_name = "${lastName}" + group = "user-metadata" + multi_valued = false + name = "lastName" + permissions { + edit = [ + "admin", + "user", ] + view = [ + "admin", + "user", ] } + validator { + config = { + "max" = "255" + "min" = "0" } + name = "length" } + validator { + name = "person-name-prohibited-chars" } } + group { + display_description = "Attributes, which refer to user metadata" + display_header = "User metadata" + name = "user-metadata" } } ``` I will wait for #265 to be merged though.

raito changed title from ~~WIP: id.afnix.fr: add broker flows and render first / last name optional~~ to id.afnix.fr: add broker flows and render first / last name optional

2025-08-28 00:41:41 +00:00

raito force-pushed broker-flows from 4e5fccd2af to 8f47ba67d4

2025-08-28 00:41:57 +00:00

Compare

raito force-pushed broker-flows from 8f47ba67d4 to 814906e8b3

2025-08-28 00:42:20 +00:00

Compare

raito force-pushed broker-flows from 814906e8b3 to be665179b2

2025-08-28 00:54:41 +00:00

Compare

Rows
Columns

id.afnix.fr: add broker flows and render first / last name optional #302