mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-23 03:27:50 +09:00
IvanHunters
c254603764
Same offline-token-survives-logout issue as the dashboard: the linstor-gui
auth-proxy requested offline_access, so a copied kc-access cookie stayed valid
for the whole offline-session lifetime after logout.
Drop offline_access from the proxy --scope and the optional client scope, and
update the ingress auth unittest accordingly.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
(cherry picked from commit 51c34c236e)
76 lines
2.3 KiB
YAML
76 lines
2.3 KiB
YAML
{{- $host := index .Values._cluster "root-host" }}
|
|
|
|
{{- /*
|
|
Persist client + cookie secrets across upgrades: if the Secrets already
|
|
exist, reuse their values; otherwise generate new random ones. The
|
|
KeycloakClient CRD references the same client secret so Keycloak stays
|
|
in sync with what oauth2-proxy reads.
|
|
*/ -}}
|
|
{{- $existingClientSecret := lookup "v1" "Secret" .Release.Namespace "linstor-gui-client" }}
|
|
{{- $clientSecret := "" }}
|
|
{{- if $existingClientSecret }}
|
|
{{- $clientSecret = index $existingClientSecret.data "client-secret-key" | b64dec }}
|
|
{{- else }}
|
|
{{- $clientSecret = randAlphaNum 32 }}
|
|
{{- end }}
|
|
|
|
{{- $existingAuthConfig := lookup "v1" "Secret" .Release.Namespace "linstor-gui-auth-config" }}
|
|
{{- $cookieSecret := "" }}
|
|
{{- if $existingAuthConfig }}
|
|
{{- $cookieSecret = index $existingAuthConfig.data "cookieSecret" | b64dec }}
|
|
{{- else }}
|
|
{{- $cookieSecret = randAlphaNum 16 }}
|
|
{{- end }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: linstor-gui-client
|
|
labels:
|
|
{{- include "linstor-gui.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
data:
|
|
client-secret-key: {{ $clientSecret | b64enc }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: linstor-gui-auth-config
|
|
labels:
|
|
{{- include "linstor-gui.labels" . | nindent 4 }}
|
|
type: Opaque
|
|
data:
|
|
cookieSecret: {{ $cookieSecret | b64enc }}
|
|
{{- if .Capabilities.APIVersions.Has "v1.edp.epam.com/v1" }}
|
|
---
|
|
apiVersion: v1.edp.epam.com/v1
|
|
kind: KeycloakClient
|
|
metadata:
|
|
name: linstor-gui-client
|
|
annotations:
|
|
# Re-reconcile the Keycloak client if the random secret regenerates.
|
|
secret-hash: {{ $clientSecret | sha256sum }}
|
|
spec:
|
|
realmRef:
|
|
name: keycloakrealm-cozy
|
|
kind: ClusterKeycloakRealm
|
|
secret: $linstor-gui-client:client-secret-key
|
|
advancedProtocolMappers: true
|
|
name: linstor-gui
|
|
clientId: linstor-gui
|
|
directAccess: true
|
|
public: false
|
|
webUrl: "https://linstor-gui.{{ $host }}"
|
|
defaultClientScopes:
|
|
- groups
|
|
# offline_access is intentionally not offered: an offline refresh token
|
|
# survives logout (see the proxy Deployment's --scope). NB the
|
|
# keycloak-operator only adds client scopes, so dropping this does not strip
|
|
# the realm-default offline_access from an already-created client; the proxy
|
|
# --scope change is what prevents issuance.
|
|
attributes:
|
|
post.logout.redirect.uris: "+"
|
|
redirectUris:
|
|
- "https://linstor-gui.{{ $host }}/oauth2/callback/*"
|
|
{{- end }}
|