diff --git a/security-c4po-angular/package-lock.json b/security-c4po-angular/package-lock.json index 5199064..2598d99 100644 --- a/security-c4po-angular/package-lock.json +++ b/security-c4po-angular/package-lock.json @@ -10976,9 +10976,9 @@ } }, "keycloak-js": { - "version": "13.0.1", - "resolved": "https://registry.npmjs.org/keycloak-js/-/keycloak-js-13.0.1.tgz", - "integrity": "sha512-S9mFX8HHlgw+i2HAIhteccrkffQmUn4CpYcU8ViGnODSBcnaf2YTtLhiiRH/a6SaOBpxmJTN3XVIZbE9d/HyXQ==", + "version": "14.0.0", + "resolved": "https://registry.npmjs.org/keycloak-js/-/keycloak-js-14.0.0.tgz", + "integrity": "sha512-35olMBg+Fwr1b3hu3BmyYj4PBn2uoDn7OOO0C1f+4axZhaOhvv47zq7nHG8R3g2QZcHFG5SymdEU6obrahEdJQ==", "requires": { "base64-js": "1.3.1", "js-sha256": "0.9.0" diff --git a/security-c4po-angular/package.json b/security-c4po-angular/package.json index 76da706..01b9aed 100644 --- a/security-c4po-angular/package.json +++ b/security-c4po-angular/package.json @@ -36,13 +36,13 @@ "@ngxs/store": "^3.7.3", "chart.js": "^4.2.1", "eva-icons": "^1.1.3", + "font-awesome": "^4.7.0", "i18n-iso-countries": "^6.8.0", "jwt-decode": "^3.1.2", - "keycloak-angular": "^8.4.0", - "keycloak-js": "^13.0.1", + "keycloak-angular": "^8.3.0", + "keycloak-js": "^14.0.0", "moment": "^2.29.1", "moment-timezone": "latest", - "font-awesome": "^4.7.0", "ng-mocks": "^13.4.2", "ngx-moment": "^5.0.0", "ngx-take-until-destroy": "^5.4.0", diff --git a/security-c4po-angular/src/app/header/header.component.ts b/security-c4po-angular/src/app/header/header.component.ts index 88c2c10..bf65160 100644 --- a/security-c4po-angular/src/app/header/header.component.ts +++ b/security-c4po-angular/src/app/header/header.component.ts @@ -142,13 +142,14 @@ export class HeaderComponent implements OnInit { } onClickLogOut(): void { - console.info('Logging out...'); - // ToDo: Redirect user to Landing page from Issue #142 https://github.com/Marcel-Haag/security-c4po/issues/143 - // ToDo: Fix Redirect URI in Keycloak Setting - /*this.keycloakService.logout(`http://auth-server/realms/${environment.keycloakclientId}/protocol/openid-connect/logout`).then(() => { + // ToDo: Has to be implemented once HTTPS works + + /*this.userService.logout().then(() => { + console.warn('logout success'); // Route user back to default page this.router.navigate([Route.HOME]).then(() => { // Reset User props from store + this.keycloakService.clearToken(); this.store.dispatch(new ResetSession()); }, err => { console.error(err); diff --git a/security-c4po-angular/src/app/objective-overview/objective-overview.module.ts b/security-c4po-angular/src/app/objective-overview/objective-overview.module.ts index b8b1f0d..d52c160 100644 --- a/security-c4po-angular/src/app/objective-overview/objective-overview.module.ts +++ b/security-c4po-angular/src/app/objective-overview/objective-overview.module.ts @@ -11,7 +11,7 @@ import { NbListModule, NbButtonModule, NbTooltipModule, - NbActionsModule, NbUserModule, NbContextMenuModule + NbActionsModule, NbUserModule, NbContextMenuModule, NbSortDirective } from '@nebular/theme'; import {TranslateModule} from '@ngx-translate/core'; import {StatusTagModule} from '@shared/widgets/status-tag/status-tag.module'; @@ -32,7 +32,7 @@ import {VersionTagModule} from '@shared/widgets/version-tag/version-tag.module'; declarations: [ ObjectiveHeaderComponent, ObjectiveCategoriesComponent, - ObjectiveTableComponent, + ObjectiveTableComponent ], imports: [ CommonModule, @@ -67,7 +67,10 @@ import {VersionTagModule} from '@shared/widgets/version-tag/version-tag.module'; exports: [ ObjectiveHeaderComponent, ObjectiveCategoriesComponent, - ObjectiveTableComponent, + ObjectiveTableComponent + ], + providers: [ + NbSortDirective ] }) export class ObjectiveOverviewModule { diff --git a/security-c4po-angular/src/app/objective-overview/objective-table/objective-table.component.html b/security-c4po-angular/src/app/objective-overview/objective-table/objective-table.component.html index a2e2454..6ec2faa 100644 --- a/security-c4po-angular/src/app/objective-overview/objective-table/objective-table.component.html +++ b/security-c4po-angular/src/app/objective-overview/objective-table/objective-table.component.html @@ -1,5 +1,5 @@
- +
diff --git a/security-c4po-angular/src/shared/modules/comment-dialog/comment-dialog.component.ts b/security-c4po-angular/src/shared/modules/comment-dialog/comment-dialog.component.ts index ff43ac8..7fa0158 100644 --- a/security-c4po-angular/src/shared/modules/comment-dialog/comment-dialog.component.ts +++ b/security-c4po-angular/src/shared/modules/comment-dialog/comment-dialog.component.ts @@ -28,6 +28,7 @@ export class CommentDialogComponent implements OnInit { // HTML only readonly fa = FA; + readonly getRowsFromString = /\r|\r\n|\n/; constructor( @Inject(NB_DIALOG_CONFIG) private data: GenericDialogData, diff --git a/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.html b/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.html index 00a89a6..b352c51 100644 --- a/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.html +++ b/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.html @@ -36,6 +36,7 @@ type="formText" required fullWidth id="{{formArray[2].fieldName}}" nbInput class="form-field form-text" + rows="{{formArray[2].controlsConfig[0].value !== '' ? formArray[2].controlsConfig[0].value.split(getRowsFromString).length + 1 : 2}}" [status]="findingFormGroup.get(formArray[2].fieldName).dirty ? (findingFormGroup.get(formArray[2].fieldName).invalid ? 'danger' : 'basic') : 'basic'" placeholder="{{formArray[2].placeholder | translate}} *"> @@ -57,6 +58,7 @@ type="formText" required fullWidth id="{{formArray[3].fieldName}}" nbInput class="form-field form-text" + rows="{{formArray[3].controlsConfig[0].value !== '' ? formArray[3].controlsConfig[0].value.split(getRowsFromString).length + 1 : 2}}" [status]="findingFormGroup.get(formArray[3].fieldName).dirty ? (findingFormGroup.get(formArray[3].fieldName).invalid ? 'danger' : 'basic') : 'basic'" placeholder="{{formArray[3].placeholder | translate}} *"> @@ -132,6 +134,7 @@ type="text" required fullWidth id="{{formArray[5].fieldName}}" nbInput class="form-field form-textarea" + rows="{{formArray[5].controlsConfig[0].value !== '' ? formArray[5].controlsConfig[0].value.split(getRowsFromString).length + 1 : 2}}" [status]="findingFormGroup.get(formArray[5].fieldName).dirty ? (findingFormGroup.get(formArray[5].fieldName).invalid ? 'danger' : 'basic') : 'basic'" placeholder="{{formArray[5].placeholder | translate}} *"> @@ -153,6 +156,7 @@ type="text" fullWidth id="{{formArray[6].fieldName}}" nbInput class="form-field form-textarea" + rows="{{formArray[6].controlsConfig[0].value !== '' ? formArray[6].controlsConfig[0].value.split(getRowsFromString).length + 1 : 2}}" [status]="findingFormGroup.get(formArray[6].fieldName).dirty ? (findingFormGroup.get(formArray[6].fieldName).invalid ? 'danger' : 'basic') : 'basic'" placeholder="{{formArray[6].placeholder | translate}}"> diff --git a/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.ts b/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.ts index 378ceb5..ef0776d 100644 --- a/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.ts +++ b/security-c4po-angular/src/shared/modules/finding-dialog/finding-dialog.component.ts @@ -21,25 +21,6 @@ import {Store} from '@ngxs/store'; changeDetection: ChangeDetectionStrategy.OnPush }) export class FindingDialogComponent implements OnInit { - // form control elements - findingFormGroup: FormGroup; - formArray: GenericFormFieldConfig[]; - - dialogData: GenericDialogData; - - // HTML only - readonly fa = FA; - severity: Severity = Severity.LOW; - readonly severityTexts: Array = [ - {value: Severity.LOW, translationText: 'severities.low'}, - {value: Severity.MEDIUM, translationText: 'severities.medium'}, - {value: Severity.HIGH, translationText: 'severities.high'}, - {value: Severity.CRITICAL, translationText: 'severities.critical'} - ]; - - // ToDo: Adjust for edit finding dialog to include existing urls - affectedUrls: string[] = []; - initialAffectedUrls: string[] = []; constructor( @Inject(NB_DIALOG_CONFIG) private data: GenericDialogData, @@ -51,6 +32,26 @@ export class FindingDialogComponent implements OnInit { private store: Store ) { } + // form control elements + findingFormGroup: FormGroup; + formArray: GenericFormFieldConfig[]; + + dialogData: GenericDialogData; + + // HTML only + readonly fa = FA; + readonly getRowsFromString = /\r|\r\n|\n/; + severity: Severity = Severity.LOW; + readonly severityTexts: Array = [ + {value: Severity.LOW, translationText: 'severities.low'}, + {value: Severity.MEDIUM, translationText: 'severities.medium'}, + {value: Severity.HIGH, translationText: 'severities.high'}, + {value: Severity.CRITICAL, translationText: 'severities.critical'} + ]; + + // ToDo: Adjust for edit finding dialog to include existing urls + affectedUrls: string[] = []; + initialAffectedUrls: string[] = []; ngOnInit(): void { this.findingFormGroup = this.generateFormCreationFieldArray(); diff --git a/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.html b/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.html index 45b7ab6..a88885d 100644 --- a/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.html +++ b/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.html @@ -49,6 +49,7 @@ type="formText" required fullWidth id="{{fieldConfig.fieldName}}" nbInput class="form-field form-textarea" + rows="{{fieldConfig.controlsConfig[0].value !== '' ? fieldConfig.controlsConfig[0].value.split(getRowsFromString).length + 1 : 2}}" [status]="projectFormGroup.get(fieldConfig.fieldName).dirty ? (projectFormGroup.get(fieldConfig.fieldName).invalid ? 'danger' : 'basic') : 'basic'" placeholder="{{fieldConfig.placeholder | translate}}"> diff --git a/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.ts b/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.ts index ffa9bac..a033bf2 100644 --- a/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.ts +++ b/security-c4po-angular/src/shared/modules/project-dialog/project-dialog.component.ts @@ -26,6 +26,7 @@ export class ProjectDialogComponent implements OnInit { // HTML only readonly fa = FA; + readonly getRowsFromString = /\r|\r\n|\n/; state: ReportState = ReportState.NEW; readonly reportStateTexts = reportStateTexts; diff --git a/security-c4po-angular/src/shared/modules/project-dialog/service/project-dialog.service.ts b/security-c4po-angular/src/shared/modules/project-dialog/service/project-dialog.service.ts index 2d5c552..97a4825 100644 --- a/security-c4po-angular/src/shared/modules/project-dialog/service/project-dialog.service.ts +++ b/security-c4po-angular/src/shared/modules/project-dialog/service/project-dialog.service.ts @@ -87,7 +87,7 @@ export class ProjectDialogService { labelKey: 'project.summary.label', placeholder: 'project.summary.placeholder', controlsConfig: [ - {value: project ? project.summary : '', disabled: !project}, + {value: project && project.summary ? project.summary : '', disabled: !project}, [project ? Validators.required : []] ], errors: [ diff --git a/security-c4po-angular/src/shared/services/user-service/user.service.ts b/security-c4po-angular/src/shared/services/user-service/user.service.ts index b6bd4f9..0f6f38a 100644 --- a/security-c4po-angular/src/shared/services/user-service/user.service.ts +++ b/security-c4po-angular/src/shared/services/user-service/user.service.ts @@ -1,10 +1,12 @@ import {Injectable} from '@angular/core'; import {HttpClient, HttpHeaders} from '@angular/common/http'; import {User} from '../../models/user.model'; -import {from, Observable, Subscriber} from 'rxjs'; +import {from, Observable, of, Subscriber} from 'rxjs'; import {Store} from '@ngxs/store'; import {KeycloakService} from 'keycloak-angular'; import {map} from 'rxjs/operators'; +import {environment} from '../../../environments/environment'; +import {Route} from '@shared/models/route.enum'; @Injectable({ providedIn: 'root' @@ -39,6 +41,42 @@ export class UserService { return from(this.keycloakService.loadUserProfile()) as Observable; } + public logout(): Promise { + return this.keycloakService.logout(); + } + + // ToDo: Change update profile propterties OR ... + // ...In our angular application, best way to change password was to create “button” with “hardcoded” link to: + // https://keycloakUrl/realms/myrealm/protocol/openid-connect/auth 58 + // ?response_type=code + // &client_id=myclient + // &redirect_uri=myAppUrl + // &kc_action=UPDATE_PASSWORD + // ToDo: Or use API + // https://stackoverflow.com/questions/33910615/is-there-an-api-call-for-changing-user-password-on-keycloak + + // ToDo: https://www.keycloak.org/docs/latest/server_development/ + public changeUserProperties(): Observable { + // ToDo: There is a kc_action parameter available in keycloak to let application force required actions. + /*../realms/myrealm/protocol/openid-connect/auth + ?response_type=code + &client_id=myclient + &redirect_uri=https://myclient.com + &kc_action=update_profile*/ + return of(); + } + + // ToDo: https://keycloak.discourse.group/t/integrate-change-password-from-account-console-into-own-webapp/12300 + public changePassword(): Observable { + // ToDo: To force (or allow) a password update, use kc_action=UPDATE_PASSWORD + /*../realms/myrealm/protocol/openid-connect/auth + ?response_type=code + &client_id=myclient + &redirect_uri=https://myclient.com + &kc_action=update_profile*/ + return of(); + } + private getToken(): Observable { return new Observable((observer: Subscriber): void => { this.keycloakService.getToken().then(token => { diff --git a/security-c4po-cfg/cfg/c4po_realm_export.json b/security-c4po-cfg/cfg/c4po_realm_export.json index 6b62ef4..d076986 100644 --- a/security-c4po-cfg/cfg/c4po_realm_export.json +++ b/security-c4po-cfg/cfg/c4po_realm_export.json @@ -4,12 +4,13 @@ "displayName" : "C4PO", "displayNameHtml" : "
C4PO
", "notBefore" : 0, + "defaultSignatureAlgorithm" : "RS256", "revokeRefreshToken" : false, "refreshTokenMaxReuse" : 0, - "accessTokenLifespan" : 300, + "accessTokenLifespan" : 18000, "accessTokenLifespanForImplicitFlow" : 900, - "ssoSessionIdleTimeout" : 1800, - "ssoSessionMaxLifespan" : 36000, + "ssoSessionIdleTimeout" : 28800, + "ssoSessionMaxLifespan" : 604800, "ssoSessionIdleTimeoutRememberMe" : 0, "ssoSessionMaxLifespanRememberMe" : 0, "offlineSessionIdleTimeout" : 2592000, @@ -21,18 +22,20 @@ "clientOfflineSessionMaxLifespan" : 0, "accessCodeLifespan" : 60, "accessCodeLifespanUserAction" : 300, - "accessCodeLifespanLogin" : 1800, + "accessCodeLifespanLogin" : 28800, "actionTokenGeneratedByAdminLifespan" : 43200, "actionTokenGeneratedByUserLifespan" : 300, + "oauth2DeviceCodeLifespan" : 600, + "oauth2DevicePollingInterval" : 5, "enabled" : true, "sslRequired" : "external", "registrationAllowed" : false, "registrationEmailAsUsername" : false, - "rememberMe" : false, + "rememberMe" : true, "verifyEmail" : false, "loginWithEmailAllowed" : true, "duplicateEmailsAllowed" : false, - "resetPasswordAllowed" : false, + "resetPasswordAllowed" : true, "editUsernameAllowed" : false, "bruteForceProtected" : false, "permanentLockout" : false, @@ -52,13 +55,10 @@ "containerId" : "c4po_realm_local", "attributes" : { } }, { - "id" : "1fabc468-65bf-4651-8436-7d8d6a3a79e7", + "id" : "14eac93b-242a-4058-ba97-cf1f05a1e2ca", "name" : "c4po_user", - "description" : "This is a normal c4po User role", - "composite" : true, - "composites" : { - "realm" : [ "offline_access", "uma_authorization" ] - }, + "description" : "This is a normal user role", + "composite" : false, "clientRole" : false, "containerId" : "c4po_realm_local", "attributes" : { } @@ -73,10 +73,24 @@ }, { "id" : "3dc67a08-dc0a-4bb1-8808-b49bbf4611b0", "name" : "c4po_admin", - "description" : "This is an c4po admin role", + "description" : "This is an admin role", "composite" : true, "composites" : { - "realm" : [ "c4po_user", "offline_access", "uma_authorization" ] + "realm" : [ "offline_access", "uma_authorization" ] + }, + "clientRole" : false, + "containerId" : "c4po_realm_local", + "attributes" : { } + }, { + "id" : "da9911ce-ab0d-4a99-b73a-0ed6ca0406a7", + "name" : "default-roles-c4po_realm_local", + "description" : "${role_default-roles}", + "composite" : true, + "composites" : { + "realm" : [ "offline_access", "uma_authorization" ], + "client" : { + "account" : [ "view-profile", "manage-account" ] + } }, "clientRole" : false, "containerId" : "c4po_realm_local", @@ -108,17 +122,17 @@ "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "3e152bff-b1b3-491e-8b41-5824f417357e", - "name" : "query-groups", - "description" : "${role_query-groups}", + "id" : "82f7b76d-b528-4fd5-aa9f-d89f1df9e1e1", + "name" : "impersonation", + "description" : "${role_impersonation}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "82f7b76d-b528-4fd5-aa9f-d89f1df9e1e1", - "name" : "impersonation", - "description" : "${role_impersonation}", + "id" : "3e152bff-b1b3-491e-8b41-5824f417357e", + "name" : "query-groups", + "description" : "${role_query-groups}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", @@ -153,17 +167,17 @@ "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "84338fd5-5a70-4c6a-b580-adb7416cb8b6", - "name" : "view-events", - "description" : "${role_view-events}", + "id" : "f36d5b71-6f9e-433e-a549-5f8dab3fa39d", + "name" : "query-realms", + "description" : "${role_query-realms}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "f36d5b71-6f9e-433e-a549-5f8dab3fa39d", - "name" : "query-realms", - "description" : "${role_query-realms}", + "id" : "84338fd5-5a70-4c6a-b580-adb7416cb8b6", + "name" : "view-events", + "description" : "${role_view-events}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", @@ -185,17 +199,17 @@ "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "7fcf212c-4371-48be-a75a-ec93830c4f8b", - "name" : "manage-users", - "description" : "${role_manage-users}", + "id" : "26f88bad-f69b-464f-89f1-43b987589173", + "name" : "manage-authorization", + "description" : "${role_manage-authorization}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", "attributes" : { } }, { - "id" : "26f88bad-f69b-464f-89f1-43b987589173", - "name" : "manage-authorization", - "description" : "${role_manage-authorization}", + "id" : "7fcf212c-4371-48be-a75a-ec93830c4f8b", + "name" : "manage-users", + "description" : "${role_manage-users}", "composite" : false, "clientRole" : true, "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", @@ -223,7 +237,7 @@ "composite" : true, "composites" : { "client" : { - "realm-management" : [ "query-groups", "query-users" ] + "realm-management" : [ "query-users", "query-groups" ] } }, "clientRole" : true, @@ -236,7 +250,7 @@ "composite" : true, "composites" : { "client" : { - "realm-management" : [ "create-client", "manage-clients", "manage-realm", "query-groups", "impersonation", "view-authorization", "view-clients", "manage-identity-providers", "view-events", "query-realms", "view-realm", "query-clients", "manage-users", "manage-authorization", "query-users", "manage-events", "view-users", "view-identity-providers" ] + "realm-management" : [ "create-client", "manage-clients", "manage-realm", "query-groups", "impersonation", "view-authorization", "view-clients", "manage-identity-providers", "view-events", "query-realms", "view-realm", "query-clients", "query-users", "manage-authorization", "manage-users", "manage-events", "view-users", "view-identity-providers" ] } }, "clientRole" : true, @@ -294,6 +308,22 @@ "clientRole" : true, "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", "attributes" : { } + }, { + "id" : "00ba6e25-3731-4363-9c07-3712aedf1ea8", + "name" : "view-groups", + "description" : "${role_view-groups}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "e772178b-5083-406b-84b5-e900a19f1a49", + "name" : "delete-account", + "description" : "${role_delete-account}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } }, { "id" : "f590afe8-3e54-491d-97b1-e29f56b22df3", "name" : "manage-account-links", @@ -335,7 +365,14 @@ } }, "groups" : [ ], - "defaultRoles" : [ "uma_authorization", "offline_access" ], + "defaultRole" : { + "id" : "da9911ce-ab0d-4a99-b73a-0ed6ca0406a7", + "name" : "default-roles-c4po_realm_local", + "description" : "${role_default-roles}", + "composite" : true, + "clientRole" : false, + "containerId" : "c4po_realm_local" + }, "requiredCredentials" : [ "password" ], "otpPolicyType" : "totp", "otpPolicyAlgorithm" : "HmacSHA1", @@ -343,7 +380,8 @@ "otpPolicyDigits" : 6, "otpPolicyLookAheadWindow" : 1, "otpPolicyPeriod" : 30, - "otpSupportedApplications" : [ "FreeOTP", "Google Authenticator" ], + "otpPolicyCodeReusable" : false, + "otpSupportedApplications" : [ "totpAppGoogleName", "totpAppFreeOTPName" ], "webAuthnPolicyRpEntityName" : "keycloak", "webAuthnPolicySignatureAlgorithms" : [ "ES256" ], "webAuthnPolicyRpId" : "", @@ -365,52 +403,50 @@ "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false, "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ], "users" : [ { - "id" : "f8aab31f-4925-4242-a6fa-f98135b4b031", - "createdTimestamp" : 1628265648730, - "username" : "aaa", + "id" : "7fd27f3e-2102-4531-ad77-2423d42568e7", + "createdTimestamp" : 1682073378356, + "username" : "admin", "enabled" : true, "totp" : false, "emailVerified" : false, - "firstName" : "test", + "firstName" : "admin", "lastName" : "admin", "credentials" : [ { - "id" : "2aef72e0-1728-429c-b55c-7ff7f3cf65aa", + "id" : "095476b7-53a3-4528-85bd-4e45bebd1155", "type" : "password", - "createdDate" : 1628265679465, - "secretData" : "{\"value\":\"50YE6HhI9bY+we+xCWDwMkWRWVylzSBmhuwZ5ZWfcnG35reKCQwJismV3PiU+URf4EpZtz7GXai1nB7tzfP7Og==\",\"salt\":\"ePpIxzR6oiOY7bmrsI+5EA==\"}", - "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}" + "userLabel" : "My password", + "createdDate" : 1682073413281, + "secretData" : "{\"value\":\"2ZAR9LLxAcwOezklS872x9jSq8d4oGulf45PkPNs5KroeI22UCdDdIsAafy++JpQgXwBl+5Co82gOclWR3fldA==\",\"salt\":\"tAfgELoKjIq6/grj0epu7A==\",\"additionalParameters\":{}}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}" } ], "disableableCredentialTypes" : [ ], "requiredActions" : [ ], - "realmRoles" : [ "uma_authorization", "offline_access", "c4po_admin" ], - "clientRoles" : { - "account" : [ "view-profile", "manage-account" ] - }, + "realmRoles" : [ "c4po_admin", "default-roles-c4po_realm_local" ], "notBefore" : 0, "groups" : [ ] }, { - "id" : "10e06d7a-8dd0-4ecd-8963-056b45079c4f", - "createdTimestamp" : 1617897245335, - "username" : "ttt", + "id" : "16a52c3d-998b-4f2d-badb-1f369d95a690", + "createdTimestamp" : 1682073624527, + "username" : "c4po", "enabled" : true, "totp" : false, "emailVerified" : false, - "firstName" : "test", - "lastName" : "user", + "firstName" : "Elliot", + "lastName" : "Alderson", + "attributes" : { + "locale" : [ "en" ] + }, "credentials" : [ { - "id" : "7026fefc-ae26-442b-acae-92f1f2d24eac", + "id" : "028e1f11-50c1-4b28-a521-b80469aa1ae0", "type" : "password", - "createdDate" : 1617897287400, - "secretData" : "{\"value\":\"mhW4yxOg+8bcyPF4yWsfPZnLGUp4oaqc9aNA+WBcpr9qXgs/Jw+rM2VlLEgeD/kXGItcScA8V20sVGrMWT94Yw==\",\"salt\":\"nkH510WAwjKZJqd/ZEkIHA==\"}", - "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}" + "userLabel" : "My password", + "createdDate" : 1682073686387, + "secretData" : "{\"value\":\"M/Sb4JgRZ0TSR49GI+Xh+QMhX3iAK84G6xfF5tCCz3z4bneEtyuggOn/HcNOfwSpxj1qetci5017gcjOYqc1+g==\",\"salt\":\"jvPAa8JX8WIwgPHsJVL2QQ==\",\"additionalParameters\":{}}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}" } ], "disableableCredentialTypes" : [ ], "requiredActions" : [ ], - "realmRoles" : [ "uma_authorization", "c4po_user" ], - "clientRoles" : { - "c4po_local" : [ "user" ], - "account" : [ "view-profile", "manage-account" ] - }, + "realmRoles" : [ "c4po_user", "default-roles-c4po_realm_local" ], "notBefore" : 0, "groups" : [ ] } ], @@ -421,7 +457,7 @@ "clientScopeMappings" : { "account" : [ { "client" : "account-console", - "roles" : [ "manage-account" ] + "roles" : [ "manage-account", "view-groups" ] } ] }, "clients" : [ { @@ -435,7 +471,6 @@ "alwaysDisplayInConsole" : false, "clientAuthenticatorType" : "client-secret", "secret" : "**********", - "defaultRoles" : [ "view-profile", "manage-account" ], "redirectUris" : [ "/realms/c4po_realm_local/account/*" ], "webOrigins" : [ ], "notBefore" : 0, @@ -448,11 +483,13 @@ "publicClient" : false, "frontchannelLogout" : false, "protocol" : "openid-connect", - "attributes" : { }, + "attributes" : { + "post.logout.redirect.uris" : "+" + }, "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : false, "nodeReRegistrationTimeout" : 0, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "da51d616-1ca6-4434-a16d-b543d2a4e4c0", @@ -478,6 +515,7 @@ "frontchannelLogout" : false, "protocol" : "openid-connect", "attributes" : { + "post.logout.redirect.uris" : "+", "pkce.code.challenge.method" : "S256" }, "authenticationFlowBindingOverrides" : { }, @@ -491,7 +529,7 @@ "consentRequired" : false, "config" : { } } ], - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "63cb2215-d2f1-4229-96fc-82fb843e283a", @@ -514,11 +552,13 @@ "publicClient" : true, "frontchannelLogout" : false, "protocol" : "openid-connect", - "attributes" : { }, + "attributes" : { + "post.logout.redirect.uris" : "+" + }, "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : false, "nodeReRegistrationTimeout" : 0, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "f90fb534-a4bf-4e08-b0d3-8a5552eb5a12", @@ -541,20 +581,26 @@ "publicClient" : false, "frontchannelLogout" : false, "protocol" : "openid-connect", - "attributes" : { }, + "attributes" : { + "post.logout.redirect.uris" : "+" + }, "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : false, "nodeReRegistrationTimeout" : 0, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "6cbc559d-073e-40d7-8b73-b2dcdc438461", "clientId" : "c4po_local", + "name" : "", + "description" : "", + "rootUrl" : "", + "adminUrl" : "", + "baseUrl" : "", "surrogateAuthRequired" : false, "enabled" : true, "alwaysDisplayInConsole" : false, "clientAuthenticatorType" : "client-secret", - "secret" : "**********", "redirectUris" : [ "http://localhost:4200/*" ], "webOrigins" : [ "*" ], "notBefore" : 0, @@ -572,9 +618,15 @@ "saml.force.post.binding" : "false", "saml.multivalued.roles" : "false", "saml.encrypt" : "false", + "frontchannel.logout.url" : "/logout", + "post.logout.redirect.uris" : "*", + "oauth2.device.authorization.grant.enabled" : "false", "saml.server.signature" : "false", + "backchannel.logout.revoke.offline.tokens" : "false", "saml.server.signature.keyinfo.ext" : "false", "exclude.session.state.from.auth.response" : "false", + "oidc.ciba.grant.enabled" : "false", + "backchannel.logout.session.required" : "true", "saml_force_name_id_format" : "false", "saml.client.signature" : "false", "tls.client.certificate.bound.access.tokens" : "false", @@ -585,7 +637,7 @@ "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : true, "nodeReRegistrationTimeout" : -1, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", @@ -608,11 +660,13 @@ "publicClient" : false, "frontchannelLogout" : false, "protocol" : "openid-connect", - "attributes" : { }, + "attributes" : { + "post.logout.redirect.uris" : "+" + }, "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : false, "nodeReRegistrationTimeout" : 0, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "7e165a51-6cb8-43cf-a4fe-1d0ad513586b", @@ -638,6 +692,7 @@ "frontchannelLogout" : false, "protocol" : "openid-connect", "attributes" : { + "post.logout.redirect.uris" : "+", "pkce.code.challenge.method" : "S256" }, "authenticationFlowBindingOverrides" : { }, @@ -658,11 +713,13 @@ "jsonType.label" : "String" } } ], - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "7f731c1c-4fd8-470a-a995-b242fc5b550d", "clientId" : "security-c4po-angular", + "name" : "", + "description" : "", "rootUrl" : "", "adminUrl" : "", "baseUrl" : "http://localhost:4200/", @@ -688,9 +745,14 @@ "saml.force.post.binding" : "false", "saml.multivalued.roles" : "false", "saml.encrypt" : "false", + "post.logout.redirect.uris" : "*", + "oauth2.device.authorization.grant.enabled" : "false", "saml.server.signature" : "false", + "backchannel.logout.revoke.offline.tokens" : "false", "saml.server.signature.keyinfo.ext" : "false", "exclude.session.state.from.auth.response" : "false", + "oidc.ciba.grant.enabled" : "false", + "backchannel.logout.session.required" : "true", "saml_force_name_id_format" : "false", "saml.client.signature" : "false", "tls.client.certificate.bound.access.tokens" : "false", @@ -701,11 +763,13 @@ "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : true, "nodeReRegistrationTimeout" : -1, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "id" : "8badc11a-50e4-44ae-a292-47e3759fcaeb", "clientId" : "security-c4po-api", + "name" : "", + "description" : "", "rootUrl" : "", "adminUrl" : "", "baseUrl" : "http://localhost:8443/", @@ -731,9 +795,14 @@ "saml.force.post.binding" : "false", "saml.multivalued.roles" : "false", "saml.encrypt" : "false", + "post.logout.redirect.uris" : "*", + "oauth2.device.authorization.grant.enabled" : "false", "saml.server.signature" : "false", + "backchannel.logout.revoke.offline.tokens" : "false", "saml.server.signature.keyinfo.ext" : "false", "exclude.session.state.from.auth.response" : "false", + "oidc.ciba.grant.enabled" : "false", + "backchannel.logout.session.required" : "true", "saml_force_name_id_format" : "false", "saml.client.signature" : "false", "tls.client.certificate.bound.access.tokens" : "false", @@ -744,19 +813,10 @@ "authenticationFlowBindingOverrides" : { }, "fullScopeAllowed" : true, "nodeReRegistrationTimeout" : -1, - "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] } ], "clientScopes" : [ { - "id" : "8d428e56-80df-4505-8e1a-26537e793b31", - "name" : "offline_access", - "description" : "OpenID Connect built-in scope: offline_access", - "protocol" : "openid-connect", - "attributes" : { - "consent.screen.text" : "${offlineAccessScopeConsentText}", - "display.on.consent.screen" : "true" - } - }, { "id" : "4b171f57-736a-41b4-b67b-585bac1d8d24", "name" : "role_list", "description" : "SAML role list", @@ -777,6 +837,15 @@ "attribute.name" : "Role" } } ] + }, { + "id" : "8d428e56-80df-4505-8e1a-26537e793b31", + "name" : "offline_access", + "description" : "OpenID Connect built-in scope: offline_access", + "protocol" : "openid-connect", + "attributes" : { + "consent.screen.text" : "${offlineAccessScopeConsentText}", + "display.on.consent.screen" : "true" + } }, { "id" : "ac7d05f9-d505-42e9-9b7c-1984b31e653d", "name" : "profile", @@ -981,73 +1050,6 @@ "jsonType.label" : "String" } } ] - }, { - "id" : "32f1098d-79a9-4da4-a94a-c873fcc0f6e1", - "name" : "email", - "description" : "OpenID Connect built-in scope: email", - "protocol" : "openid-connect", - "attributes" : { - "include.in.token.scope" : "true", - "display.on.consent.screen" : "true", - "consent.screen.text" : "${emailScopeConsentText}" - }, - "protocolMappers" : [ { - "id" : "92afef33-2843-40bc-aba1-58d462fa81cc", - "name" : "email verified", - "protocol" : "openid-connect", - "protocolMapper" : "oidc-usermodel-property-mapper", - "consentRequired" : false, - "config" : { - "userinfo.token.claim" : "true", - "user.attribute" : "emailVerified", - "id.token.claim" : "true", - "access.token.claim" : "true", - "claim.name" : "email_verified", - "jsonType.label" : "boolean" - } - }, { - "id" : "4b4d33d1-ed47-40db-a05f-4253c25dbbff", - "name" : "email", - "protocol" : "openid-connect", - "protocolMapper" : "oidc-usermodel-property-mapper", - "consentRequired" : false, - "config" : { - "userinfo.token.claim" : "true", - "user.attribute" : "email", - "id.token.claim" : "true", - "access.token.claim" : "true", - "claim.name" : "email", - "jsonType.label" : "String" - } - } ] - }, { - "id" : "412cfb80-d33e-44da-a0e2-b0bde0423c00", - "name" : "address", - "description" : "OpenID Connect built-in scope: address", - "protocol" : "openid-connect", - "attributes" : { - "include.in.token.scope" : "true", - "display.on.consent.screen" : "true", - "consent.screen.text" : "${addressScopeConsentText}" - }, - "protocolMappers" : [ { - "id" : "261a490f-073d-4975-af5b-e2d9e21ea768", - "name" : "address", - "protocol" : "openid-connect", - "protocolMapper" : "oidc-address-mapper", - "consentRequired" : false, - "config" : { - "user.attribute.formatted" : "formatted", - "user.attribute.country" : "country", - "user.attribute.postal_code" : "postal_code", - "userinfo.token.claim" : "true", - "user.attribute.street" : "street", - "id.token.claim" : "true", - "user.attribute.region" : "region", - "access.token.claim" : "true", - "user.attribute.locality" : "locality" - } - } ] }, { "id" : "faf5c077-e43d-4433-9f5d-ddfc10f31385", "name" : "phone", @@ -1131,24 +1133,6 @@ "consentRequired" : false, "config" : { } } ] - }, { - "id" : "cd5f153a-ff23-43d5-81a0-6c8dc6f39a4e", - "name" : "web-origins", - "description" : "OpenID Connect scope for add allowed web origins to the access token", - "protocol" : "openid-connect", - "attributes" : { - "include.in.token.scope" : "false", - "display.on.consent.screen" : "false", - "consent.screen.text" : "" - }, - "protocolMappers" : [ { - "id" : "9a8031f8-997b-4899-ba60-05868f8e4b18", - "name" : "allowed web origins", - "protocol" : "openid-connect", - "protocolMapper" : "oidc-allowed-origins-mapper", - "consentRequired" : false, - "config" : { } - } ] }, { "id" : "b18623a4-3595-4993-b2bd-79e94778d28b", "name" : "microprofile-jwt", @@ -1188,8 +1172,114 @@ "jsonType.label" : "String" } } ] + }, { + "id" : "412cfb80-d33e-44da-a0e2-b0bde0423c00", + "name" : "address", + "description" : "OpenID Connect built-in scope: address", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${addressScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "261a490f-073d-4975-af5b-e2d9e21ea768", + "name" : "address", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-address-mapper", + "consentRequired" : false, + "config" : { + "user.attribute.formatted" : "formatted", + "user.attribute.country" : "country", + "user.attribute.postal_code" : "postal_code", + "userinfo.token.claim" : "true", + "user.attribute.street" : "street", + "id.token.claim" : "true", + "user.attribute.region" : "region", + "access.token.claim" : "true", + "user.attribute.locality" : "locality" + } + } ] + }, { + "id" : "cd5f153a-ff23-43d5-81a0-6c8dc6f39a4e", + "name" : "web-origins", + "description" : "OpenID Connect scope for add allowed web origins to the access token", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "false", + "display.on.consent.screen" : "false", + "consent.screen.text" : "" + }, + "protocolMappers" : [ { + "id" : "9a8031f8-997b-4899-ba60-05868f8e4b18", + "name" : "allowed web origins", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-allowed-origins-mapper", + "consentRequired" : false, + "config" : { } + } ] + }, { + "id" : "aeab50c1-fd64-4f14-83d9-2c545a23f77c", + "name" : "acr", + "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "false", + "display.on.consent.screen" : "false" + }, + "protocolMappers" : [ { + "id" : "a70e5d7f-734e-4838-96a1-67cd713f3c9e", + "name" : "acr loa level", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-acr-mapper", + "consentRequired" : false, + "config" : { + "id.token.claim" : "true", + "access.token.claim" : "true", + "userinfo.token.claim" : "true" + } + } ] + }, { + "id" : "32f1098d-79a9-4da4-a94a-c873fcc0f6e1", + "name" : "email", + "description" : "OpenID Connect built-in scope: email", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${emailScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "92afef33-2843-40bc-aba1-58d462fa81cc", + "name" : "email verified", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "emailVerified", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "email_verified", + "jsonType.label" : "boolean" + } + }, { + "id" : "4b4d33d1-ed47-40db-a05f-4253c25dbbff", + "name" : "email", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "email", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "email", + "jsonType.label" : "String" + } + } ] } ], - "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins" ], + "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins", "acr" ], "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt" ], "browserSecurityHeaders" : { "contentSecurityPolicyReportOnly" : "", @@ -1206,6 +1296,8 @@ "enabledEventTypes" : [ ], "adminEventsEnabled" : false, "adminEventsDetailsEnabled" : false, + "identityProviders" : [ ], + "identityProviderMappers" : [ ], "components" : { "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ { "id" : "56f53138-a448-42f5-ba77-b026b1b179d0", @@ -1232,7 +1324,7 @@ "subType" : "anonymous", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "saml-role-list-mapper", "saml-user-property-mapper" ] } }, { "id" : "cc2d0cd7-3d3f-4b0a-ad95-7118f36bf188", @@ -1264,7 +1356,7 @@ "subType" : "authenticated", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "saml-user-attribute-mapper", "oidc-address-mapper", "saml-role-list-mapper" ] } }, { "id" : "92230e65-7480-44c3-af2d-72ddee758cbc", @@ -1277,6 +1369,12 @@ "client-uris-must-match" : [ "true" ] } } ], + "org.keycloak.userprofile.UserProfileProvider" : [ { + "id" : "d3115ef0-4137-41c5-9e7f-35ace4f7b43e", + "providerId" : "declarative-user-profile", + "subComponents" : { }, + "config" : { } + } ], "org.keycloak.keys.KeyProvider" : [ { "id" : "ea025a18-d77a-4bbc-8e3a-c6b55ccf4b3f", "name" : "hmac-generated", @@ -1310,10 +1408,11 @@ } } ] }, - "internationalizationEnabled" : false, - "supportedLocales" : [ ], + "internationalizationEnabled" : true, + "supportedLocales" : [ "de", "en" ], + "defaultLocale" : "en", "authenticationFlows" : [ { - "id" : "15c4eeb8-2a2b-4e5e-b5e1-98509003683b", + "id" : "0296b89f-2d7b-4931-b4ce-72167e83d8b7", "alias" : "Account verification options", "description" : "Method with which to verity the existing account", "providerId" : "basic-flow", @@ -1321,19 +1420,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "idp-email-verification", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "ALTERNATIVE", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "Verify Existing Account by Re-authentication", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "e1240eb6-5e97-443f-9759-107179344936", + "id" : "64a2976c-5625-41a2-97d7-b53e78cc3a92", "alias" : "Authentication Options", "description" : "Authentication options.", "providerId" : "basic-flow", @@ -1341,25 +1442,28 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "basic-auth", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "basic-auth-otp", + "authenticatorFlow" : false, "requirement" : "DISABLED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "auth-spnego", + "authenticatorFlow" : false, "requirement" : "DISABLED", "priority" : 30, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "89fcc224-8b2a-4a3f-9b3e-abb9d577cacc", + "id" : "23dce318-8864-429d-8e42-8f60adf87bb8", "alias" : "Browser - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -1367,19 +1471,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "conditional-user-configured", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "auth-otp-form", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "74e9fa48-2fed-41c9-afa7-3a4beae840ce", + "id" : "07c663a3-9361-4fb1-ac6f-6af140b9d8b5", "alias" : "Direct Grant - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -1387,19 +1493,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "conditional-user-configured", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "direct-grant-validate-otp", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "b898b1e5-7746-4c73-a441-36e7fde9f25b", + "id" : "8a797183-07fc-44a1-80a5-bfa6b4d727e1", "alias" : "First broker login - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -1407,19 +1515,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "conditional-user-configured", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "auth-otp-form", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "0498a97c-0af7-4316-b5d5-5a3ddbfcd390", + "id" : "98e3631a-0ff2-4528-b835-4836d755b430", "alias" : "Handle Existing Account", "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider", "providerId" : "basic-flow", @@ -1427,19 +1537,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "idp-confirm-link", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "REQUIRED", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "Account verification options", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "510b541f-9a5a-4525-bb72-638c6aba43ca", + "id" : "849a9f5a-0389-4de4-8da7-9561a1e266e8", "alias" : "Reset - Conditional OTP", "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", "providerId" : "basic-flow", @@ -1447,19 +1559,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "conditional-user-configured", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "reset-otp", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "6490f472-d3db-47ce-ba4f-7e8b8048dec5", + "id" : "e196e161-37ce-4616-be7f-b1742c4f7453", "alias" : "User creation or linking", "description" : "Flow for the existing/non-existing user alternatives", "providerId" : "basic-flow", @@ -1468,19 +1582,21 @@ "authenticationExecutions" : [ { "authenticatorConfig" : "create unique user config", "authenticator" : "idp-create-user-if-unique", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "ALTERNATIVE", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "Handle Existing Account", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "0cfd20ab-4c6f-4af2-a01f-eef718f79d24", + "id" : "ab6e417d-91a9-4a2e-a288-230b30ed2608", "alias" : "Verify Existing Account by Re-authentication", "description" : "Reauthentication of existing account", "providerId" : "basic-flow", @@ -1488,19 +1604,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "idp-username-password-form", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "CONDITIONAL", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "First broker login - Conditional OTP", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "c91d3ef4-70ab-4be0-a9ec-abd17564ef9f", + "id" : "ed177a27-8acf-46c9-aecd-66a9de099b71", "alias" : "browser", "description" : "browser based authentication", "providerId" : "basic-flow", @@ -1508,31 +1626,35 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "auth-cookie", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "auth-spnego", + "authenticatorFlow" : false, "requirement" : "DISABLED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "identity-provider-redirector", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 25, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "ALTERNATIVE", "priority" : 30, + "autheticatorFlow" : true, "flowAlias" : "forms", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "0a39ae03-c439-41ec-b9bc-e4defb358422", + "id" : "7e14a81b-508b-4a78-aeca-c783e209209d", "alias" : "clients", "description" : "Base authentication for clients", "providerId" : "client-flow", @@ -1540,31 +1662,35 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "client-secret", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "client-jwt", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "client-secret-jwt", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 30, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "client-x509", + "authenticatorFlow" : false, "requirement" : "ALTERNATIVE", "priority" : 40, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "2f793704-d04e-4fe8-8cc2-c8467a3f140e", + "id" : "6e52e23e-d83f-46c2-bc4d-e336999e2293", "alias" : "direct grant", "description" : "OpenID Connect Resource Owner Grant", "providerId" : "basic-flow", @@ -1572,25 +1698,28 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "direct-grant-validate-username", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "direct-grant-validate-password", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "CONDITIONAL", "priority" : 30, + "autheticatorFlow" : true, "flowAlias" : "Direct Grant - Conditional OTP", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "555d28c6-c9c7-43ec-94de-6cfea6a3cd14", + "id" : "6d476080-ebc3-4bce-90ac-93afc891a83e", "alias" : "docker auth", "description" : "Used by Docker clients to authenticate against the IDP", "providerId" : "basic-flow", @@ -1598,13 +1727,14 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "docker-http-basic-authenticator", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "d6c01d47-329c-4333-8eac-5a8409f7bde8", + "id" : "1143f6ea-867a-4b08-974e-86a4b9ba8601", "alias" : "first broker login", "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", "providerId" : "basic-flow", @@ -1613,19 +1743,21 @@ "authenticationExecutions" : [ { "authenticatorConfig" : "review profile config", "authenticator" : "idp-review-profile", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "REQUIRED", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "User creation or linking", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "00bd3ccb-23cc-4a04-8c8f-83556bd7deaf", + "id" : "2090f383-dcab-441c-9f37-5b37504a1692", "alias" : "forms", "description" : "Username, password, otp and other auth forms.", "providerId" : "basic-flow", @@ -1633,19 +1765,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "auth-username-password-form", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "CONDITIONAL", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "Browser - Conditional OTP", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "6cd5ce9b-6a5c-4c2c-bd19-fb2f310aecc4", + "id" : "13395ad8-a0eb-42f4-9d9d-c715c717d181", "alias" : "http challenge", "description" : "An authentication flow based on challenge-response HTTP Authentication Schemes", "providerId" : "basic-flow", @@ -1653,19 +1787,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "no-cookie-redirect", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "REQUIRED", "priority" : 20, + "autheticatorFlow" : true, "flowAlias" : "Authentication Options", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "5549dba2-1397-4f89-aff5-49ca823cabb8", + "id" : "a656e7fc-fa52-46e3-9fc1-654cafe37087", "alias" : "registration", "description" : "registration flow", "providerId" : "basic-flow", @@ -1673,14 +1809,15 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "registration-page-form", + "authenticatorFlow" : true, "requirement" : "REQUIRED", "priority" : 10, + "autheticatorFlow" : true, "flowAlias" : "registration form", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "ac076c79-3b2f-437a-8255-247eb2ce28b6", + "id" : "84e1ffa9-3dd8-4b32-8cd9-e4bbc4631624", "alias" : "registration form", "description" : "registration form", "providerId" : "form-flow", @@ -1688,31 +1825,35 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "registration-user-creation", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "registration-profile-action", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 40, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "registration-password-action", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 50, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "registration-recaptcha-action", + "authenticatorFlow" : false, "requirement" : "DISABLED", "priority" : 60, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] }, { - "id" : "51219395-2175-4be5-8975-e844bbe8985e", + "id" : "68dad811-63ec-484a-a0b9-9656edc6921e", "alias" : "reset credentials", "description" : "Reset credentials for a user if they forgot their password or something", "providerId" : "basic-flow", @@ -1720,31 +1861,35 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "reset-credentials-choose-user", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "reset-credential-email", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 20, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { "authenticator" : "reset-password", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 30, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false }, { + "authenticatorFlow" : true, "requirement" : "CONDITIONAL", "priority" : 40, + "autheticatorFlow" : true, "flowAlias" : "Reset - Conditional OTP", - "userSetupAllowed" : false, - "autheticatorFlow" : true + "userSetupAllowed" : false } ] }, { - "id" : "b6131d9d-55b2-40a5-9b36-f0b1ef662554", + "id" : "9a212f2d-80ae-4051-9d09-28d016809204", "alias" : "saml ecp", "description" : "SAML ECP Profile Authentication Flow", "providerId" : "basic-flow", @@ -1752,20 +1897,21 @@ "builtIn" : true, "authenticationExecutions" : [ { "authenticator" : "http-basic-authenticator", + "authenticatorFlow" : false, "requirement" : "REQUIRED", "priority" : 10, - "userSetupAllowed" : false, - "autheticatorFlow" : false + "autheticatorFlow" : false, + "userSetupAllowed" : false } ] } ], "authenticatorConfig" : [ { - "id" : "d818257f-52f2-461e-b587-55b7a4dc968f", + "id" : "9e437782-7c8f-4732-a1e6-cd84abdf78e3", "alias" : "create unique user config", "config" : { "require.password.update.after.registration" : "false" } }, { - "id" : "6e3771dd-8647-4cff-9bc4-49d824fb0582", + "id" : "8d01fb5d-be3d-42d9-ae27-592fab7d8d14", "alias" : "review profile config", "config" : { "update.profile.on.first.login" : "missing" @@ -1811,6 +1957,14 @@ "defaultAction" : false, "priority" : 50, "config" : { } + }, { + "alias" : "delete_account", + "name" : "Delete Account", + "providerId" : "delete_account", + "enabled" : false, + "defaultAction" : false, + "priority" : 60, + "config" : { } }, { "alias" : "update_user_locale", "name" : "Update User Locale", @@ -1827,11 +1981,29 @@ "clientAuthenticationFlow" : "clients", "dockerAuthenticationFlow" : "docker auth", "attributes" : { + "cibaBackchannelTokenDeliveryMode" : "poll", + "cibaAuthRequestedUserHint" : "login_hint", "clientOfflineSessionMaxLifespan" : "0", + "oauth2DevicePollingInterval" : "5", "clientSessionIdleTimeout" : "0", - "clientSessionMaxLifespan" : "0", - "clientOfflineSessionIdleTimeout" : "0" + "actionTokenGeneratedByUserLifespan-execute-actions" : "", + "actionTokenGeneratedByUserLifespan-verify-email" : "", + "clientOfflineSessionIdleTimeout" : "0", + "actionTokenGeneratedByUserLifespan-reset-credentials" : "", + "cibaInterval" : "5", + "realmReusableOtpCode" : "false", + "cibaExpiresIn" : "120", + "oauth2DeviceCodeLifespan" : "600", + "actionTokenGeneratedByUserLifespan-idp-verify-account-via-email" : "", + "parRequestUriLifespan" : "60", + "clientSessionMaxLifespan" : "0" }, - "keycloakVersion" : "11.0.3", - "userManagedAccessAllowed" : false + "keycloakVersion" : "20.0.0", + "userManagedAccessAllowed" : false, + "clientProfiles" : { + "profiles" : [ ] + }, + "clientPolicies" : { + "policies" : [ ] + } } \ No newline at end of file diff --git a/security-c4po-cfg/cfg/old_c4po_realm_export.json b/security-c4po-cfg/cfg/old_c4po_realm_export.json new file mode 100644 index 0000000..6b62ef4 --- /dev/null +++ b/security-c4po-cfg/cfg/old_c4po_realm_export.json @@ -0,0 +1,1837 @@ +{ + "id" : "c4po_realm_local", + "realm" : "c4po_realm_local", + "displayName" : "C4PO", + "displayNameHtml" : "
C4PO
", + "notBefore" : 0, + "revokeRefreshToken" : false, + "refreshTokenMaxReuse" : 0, + "accessTokenLifespan" : 300, + "accessTokenLifespanForImplicitFlow" : 900, + "ssoSessionIdleTimeout" : 1800, + "ssoSessionMaxLifespan" : 36000, + "ssoSessionIdleTimeoutRememberMe" : 0, + "ssoSessionMaxLifespanRememberMe" : 0, + "offlineSessionIdleTimeout" : 2592000, + "offlineSessionMaxLifespanEnabled" : false, + "offlineSessionMaxLifespan" : 5184000, + "clientSessionIdleTimeout" : 0, + "clientSessionMaxLifespan" : 0, + "clientOfflineSessionIdleTimeout" : 0, + "clientOfflineSessionMaxLifespan" : 0, + "accessCodeLifespan" : 60, + "accessCodeLifespanUserAction" : 300, + "accessCodeLifespanLogin" : 1800, + "actionTokenGeneratedByAdminLifespan" : 43200, + "actionTokenGeneratedByUserLifespan" : 300, + "enabled" : true, + "sslRequired" : "external", + "registrationAllowed" : false, + "registrationEmailAsUsername" : false, + "rememberMe" : false, + "verifyEmail" : false, + "loginWithEmailAllowed" : true, + "duplicateEmailsAllowed" : false, + "resetPasswordAllowed" : false, + "editUsernameAllowed" : false, + "bruteForceProtected" : false, + "permanentLockout" : false, + "maxFailureWaitSeconds" : 900, + "minimumQuickLoginWaitSeconds" : 60, + "waitIncrementSeconds" : 60, + "quickLoginCheckMilliSeconds" : 1000, + "maxDeltaTimeSeconds" : 43200, + "failureFactor" : 30, + "roles" : { + "realm" : [ { + "id" : "2faaa7e1-01d0-480d-b397-66155bf8a950", + "name" : "uma_authorization", + "description" : "${role_uma_authorization}", + "composite" : false, + "clientRole" : false, + "containerId" : "c4po_realm_local", + "attributes" : { } + }, { + "id" : "1fabc468-65bf-4651-8436-7d8d6a3a79e7", + "name" : "c4po_user", + "description" : "This is a normal c4po User role", + "composite" : true, + "composites" : { + "realm" : [ "offline_access", "uma_authorization" ] + }, + "clientRole" : false, + "containerId" : "c4po_realm_local", + "attributes" : { } + }, { + "id" : "9b6774c4-335d-44fb-82ba-d6e18dde814d", + "name" : "offline_access", + "description" : "${role_offline-access}", + "composite" : false, + "clientRole" : false, + "containerId" : "c4po_realm_local", + "attributes" : { } + }, { + "id" : "3dc67a08-dc0a-4bb1-8808-b49bbf4611b0", + "name" : "c4po_admin", + "description" : "This is an c4po admin role", + "composite" : true, + "composites" : { + "realm" : [ "c4po_user", "offline_access", "uma_authorization" ] + }, + "clientRole" : false, + "containerId" : "c4po_realm_local", + "attributes" : { } + } ], + "client" : { + "realm-management" : [ { + "id" : "72960cc0-cb99-4759-b342-7096bcd3c92a", + "name" : "create-client", + "description" : "${role_create-client}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "c90d908c-7e17-4ada-9f3b-aa623e449ef1", + "name" : "manage-clients", + "description" : "${role_manage-clients}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "dc9e7c69-4ed1-403d-ac42-55c507f3be40", + "name" : "manage-realm", + "description" : "${role_manage-realm}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "3e152bff-b1b3-491e-8b41-5824f417357e", + "name" : "query-groups", + "description" : "${role_query-groups}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "82f7b76d-b528-4fd5-aa9f-d89f1df9e1e1", + "name" : "impersonation", + "description" : "${role_impersonation}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "fa7c22da-a9ef-4895-ae56-57403f279631", + "name" : "view-authorization", + "description" : "${role_view-authorization}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "d0610310-b6e1-46cc-90e3-64a9948f1e1d", + "name" : "view-clients", + "description" : "${role_view-clients}", + "composite" : true, + "composites" : { + "client" : { + "realm-management" : [ "query-clients" ] + } + }, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "c8fb89bc-00a8-4d6b-bb5c-d13cba12840d", + "name" : "manage-identity-providers", + "description" : "${role_manage-identity-providers}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "84338fd5-5a70-4c6a-b580-adb7416cb8b6", + "name" : "view-events", + "description" : "${role_view-events}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "f36d5b71-6f9e-433e-a549-5f8dab3fa39d", + "name" : "query-realms", + "description" : "${role_query-realms}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "d10b3abb-4120-4d28-a3a5-2bc2600502a6", + "name" : "view-realm", + "description" : "${role_view-realm}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "96a21ada-31a8-4d6a-9e26-f7551ca6ec3b", + "name" : "query-clients", + "description" : "${role_query-clients}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "7fcf212c-4371-48be-a75a-ec93830c4f8b", + "name" : "manage-users", + "description" : "${role_manage-users}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "26f88bad-f69b-464f-89f1-43b987589173", + "name" : "manage-authorization", + "description" : "${role_manage-authorization}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "13ff84e3-fef2-4c52-a30b-89602dd22457", + "name" : "query-users", + "description" : "${role_query-users}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "24928355-a003-4dc5-8272-71f32c3982e5", + "name" : "manage-events", + "description" : "${role_manage-events}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "60932726-3a3b-44f0-b668-b1ec55946404", + "name" : "view-users", + "description" : "${role_view-users}", + "composite" : true, + "composites" : { + "client" : { + "realm-management" : [ "query-groups", "query-users" ] + } + }, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "18447ab5-84fc-4dc5-8f1b-ac39bfbd72a6", + "name" : "realm-admin", + "description" : "${role_realm-admin}", + "composite" : true, + "composites" : { + "client" : { + "realm-management" : [ "create-client", "manage-clients", "manage-realm", "query-groups", "impersonation", "view-authorization", "view-clients", "manage-identity-providers", "view-events", "query-realms", "view-realm", "query-clients", "manage-users", "manage-authorization", "query-users", "manage-events", "view-users", "view-identity-providers" ] + } + }, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + }, { + "id" : "ca1a9e13-0f97-4c69-a37a-0edc9a822485", + "name" : "view-identity-providers", + "description" : "${role_view-identity-providers}", + "composite" : false, + "clientRole" : true, + "containerId" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "attributes" : { } + } ], + "security-admin-console" : [ ], + "admin-cli" : [ ], + "c4po_local" : [ { + "id" : "e26a27e7-1648-491b-832a-8bf751d378bb", + "name" : "user", + "composite" : false, + "clientRole" : true, + "containerId" : "6cbc559d-073e-40d7-8b73-b2dcdc438461", + "attributes" : { } + } ], + "security-c4po-api" : [ ], + "account-console" : [ ], + "broker" : [ { + "id" : "ef655eb1-164c-49e3-be85-510395bfd7d9", + "name" : "read-token", + "description" : "${role_read-token}", + "composite" : false, + "clientRole" : true, + "containerId" : "f90fb534-a4bf-4e08-b0d3-8a5552eb5a12", + "attributes" : { } + } ], + "security-c4po-angular" : [ ], + "account" : [ { + "id" : "1d2d7350-47be-4131-b634-297b59731ccf", + "name" : "view-profile", + "description" : "${role_view-profile}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "14139dff-c524-4efd-84a1-9fbb3e8bafae", + "name" : "manage-account", + "description" : "${role_manage-account}", + "composite" : true, + "composites" : { + "client" : { + "account" : [ "manage-account-links" ] + } + }, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "f590afe8-3e54-491d-97b1-e29f56b22df3", + "name" : "manage-account-links", + "description" : "${role_manage-account-links}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "897b62b3-c4d8-4998-9536-9c2d59bd2896", + "name" : "manage-consent", + "description" : "${role_manage-consent}", + "composite" : true, + "composites" : { + "client" : { + "account" : [ "view-consent" ] + } + }, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "34488e12-5873-490b-a25b-986e62a21caa", + "name" : "view-consent", + "description" : "${role_view-consent}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + }, { + "id" : "18770e33-50c1-4bb8-960d-d8acd163f5ab", + "name" : "view-applications", + "description" : "${role_view-applications}", + "composite" : false, + "clientRole" : true, + "containerId" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "attributes" : { } + } ] + } + }, + "groups" : [ ], + "defaultRoles" : [ "uma_authorization", "offline_access" ], + "requiredCredentials" : [ "password" ], + "otpPolicyType" : "totp", + "otpPolicyAlgorithm" : "HmacSHA1", + "otpPolicyInitialCounter" : 0, + "otpPolicyDigits" : 6, + "otpPolicyLookAheadWindow" : 1, + "otpPolicyPeriod" : 30, + "otpSupportedApplications" : [ "FreeOTP", "Google Authenticator" ], + "webAuthnPolicyRpEntityName" : "keycloak", + "webAuthnPolicySignatureAlgorithms" : [ "ES256" ], + "webAuthnPolicyRpId" : "", + "webAuthnPolicyAttestationConveyancePreference" : "not specified", + "webAuthnPolicyAuthenticatorAttachment" : "not specified", + "webAuthnPolicyRequireResidentKey" : "not specified", + "webAuthnPolicyUserVerificationRequirement" : "not specified", + "webAuthnPolicyCreateTimeout" : 0, + "webAuthnPolicyAvoidSameAuthenticatorRegister" : false, + "webAuthnPolicyAcceptableAaguids" : [ ], + "webAuthnPolicyPasswordlessRpEntityName" : "keycloak", + "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ], + "webAuthnPolicyPasswordlessRpId" : "", + "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified", + "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified", + "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified", + "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified", + "webAuthnPolicyPasswordlessCreateTimeout" : 0, + "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false, + "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ], + "users" : [ { + "id" : "f8aab31f-4925-4242-a6fa-f98135b4b031", + "createdTimestamp" : 1628265648730, + "username" : "aaa", + "enabled" : true, + "totp" : false, + "emailVerified" : false, + "firstName" : "test", + "lastName" : "admin", + "credentials" : [ { + "id" : "2aef72e0-1728-429c-b55c-7ff7f3cf65aa", + "type" : "password", + "createdDate" : 1628265679465, + "secretData" : "{\"value\":\"50YE6HhI9bY+we+xCWDwMkWRWVylzSBmhuwZ5ZWfcnG35reKCQwJismV3PiU+URf4EpZtz7GXai1nB7tzfP7Og==\",\"salt\":\"ePpIxzR6oiOY7bmrsI+5EA==\"}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}" + } ], + "disableableCredentialTypes" : [ ], + "requiredActions" : [ ], + "realmRoles" : [ "uma_authorization", "offline_access", "c4po_admin" ], + "clientRoles" : { + "account" : [ "view-profile", "manage-account" ] + }, + "notBefore" : 0, + "groups" : [ ] + }, { + "id" : "10e06d7a-8dd0-4ecd-8963-056b45079c4f", + "createdTimestamp" : 1617897245335, + "username" : "ttt", + "enabled" : true, + "totp" : false, + "emailVerified" : false, + "firstName" : "test", + "lastName" : "user", + "credentials" : [ { + "id" : "7026fefc-ae26-442b-acae-92f1f2d24eac", + "type" : "password", + "createdDate" : 1617897287400, + "secretData" : "{\"value\":\"mhW4yxOg+8bcyPF4yWsfPZnLGUp4oaqc9aNA+WBcpr9qXgs/Jw+rM2VlLEgeD/kXGItcScA8V20sVGrMWT94Yw==\",\"salt\":\"nkH510WAwjKZJqd/ZEkIHA==\"}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}" + } ], + "disableableCredentialTypes" : [ ], + "requiredActions" : [ ], + "realmRoles" : [ "uma_authorization", "c4po_user" ], + "clientRoles" : { + "c4po_local" : [ "user" ], + "account" : [ "view-profile", "manage-account" ] + }, + "notBefore" : 0, + "groups" : [ ] + } ], + "scopeMappings" : [ { + "clientScope" : "offline_access", + "roles" : [ "offline_access" ] + } ], + "clientScopeMappings" : { + "account" : [ { + "client" : "account-console", + "roles" : [ "manage-account" ] + } ] + }, + "clients" : [ { + "id" : "a7f62881-aa9e-4565-afeb-1d6305d3c56e", + "clientId" : "account", + "name" : "${client_account}", + "rootUrl" : "${authBaseUrl}", + "baseUrl" : "/realms/c4po_realm_local/account/", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "defaultRoles" : [ "view-profile", "manage-account" ], + "redirectUris" : [ "/realms/c4po_realm_local/account/*" ], + "webOrigins" : [ ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : false, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "da51d616-1ca6-4434-a16d-b543d2a4e4c0", + "clientId" : "account-console", + "name" : "${client_account-console}", + "rootUrl" : "${authBaseUrl}", + "baseUrl" : "/realms/c4po_realm_local/account/", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ "/realms/c4po_realm_local/account/*" ], + "webOrigins" : [ ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : true, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { + "pkce.code.challenge.method" : "S256" + }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "protocolMappers" : [ { + "id" : "0c5a81d7-f454-4793-b4e4-60c924b73533", + "name" : "audience resolve", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-audience-resolve-mapper", + "consentRequired" : false, + "config" : { } + } ], + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "63cb2215-d2f1-4229-96fc-82fb843e283a", + "clientId" : "admin-cli", + "name" : "${client_admin-cli}", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ ], + "webOrigins" : [ ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : false, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : true, + "serviceAccountsEnabled" : false, + "publicClient" : true, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "f90fb534-a4bf-4e08-b0d3-8a5552eb5a12", + "clientId" : "broker", + "name" : "${client_broker}", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ ], + "webOrigins" : [ ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : false, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "6cbc559d-073e-40d7-8b73-b2dcdc438461", + "clientId" : "c4po_local", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ "http://localhost:4200/*" ], + "webOrigins" : [ "*" ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : true, + "serviceAccountsEnabled" : false, + "publicClient" : true, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { + "saml.assertion.signature" : "false", + "saml.force.post.binding" : "false", + "saml.multivalued.roles" : "false", + "saml.encrypt" : "false", + "saml.server.signature" : "false", + "saml.server.signature.keyinfo.ext" : "false", + "exclude.session.state.from.auth.response" : "false", + "saml_force_name_id_format" : "false", + "saml.client.signature" : "false", + "tls.client.certificate.bound.access.tokens" : "false", + "saml.authnstatement" : "false", + "display.on.consent.screen" : "false", + "saml.onetimeuse.condition" : "false" + }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : true, + "nodeReRegistrationTimeout" : -1, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "fa74c4e8-a9c0-4fa9-bb21-2ad3535b08ef", + "clientId" : "realm-management", + "name" : "${client_realm-management}", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ ], + "webOrigins" : [ ], + "notBefore" : 0, + "bearerOnly" : true, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : false, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "7e165a51-6cb8-43cf-a4fe-1d0ad513586b", + "clientId" : "security-admin-console", + "name" : "${client_security-admin-console}", + "rootUrl" : "${authAdminUrl}", + "baseUrl" : "/admin/c4po_realm_local/console/", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "**********", + "redirectUris" : [ "/admin/c4po_realm_local/console/*" ], + "webOrigins" : [ "+" ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : true, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { + "pkce.code.challenge.method" : "S256" + }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : false, + "nodeReRegistrationTimeout" : 0, + "protocolMappers" : [ { + "id" : "4fd1eab6-f53b-4d37-b65c-bea9845b3e9f", + "name" : "locale", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "locale", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "locale", + "jsonType.label" : "String" + } + } ], + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "7f731c1c-4fd8-470a-a995-b242fc5b550d", + "clientId" : "security-c4po-angular", + "rootUrl" : "", + "adminUrl" : "", + "baseUrl" : "http://localhost:4200/", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "482621c2-e0fe-43b9-bb62-7469158e1966", + "redirectUris" : [ "http://localhost:4200/*" ], + "webOrigins" : [ "*" ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : true, + "serviceAccountsEnabled" : false, + "publicClient" : false, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { + "saml.assertion.signature" : "false", + "saml.force.post.binding" : "false", + "saml.multivalued.roles" : "false", + "saml.encrypt" : "false", + "saml.server.signature" : "false", + "saml.server.signature.keyinfo.ext" : "false", + "exclude.session.state.from.auth.response" : "false", + "saml_force_name_id_format" : "false", + "saml.client.signature" : "false", + "tls.client.certificate.bound.access.tokens" : "false", + "saml.authnstatement" : "false", + "display.on.consent.screen" : "false", + "saml.onetimeuse.condition" : "false" + }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : true, + "nodeReRegistrationTimeout" : -1, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + }, { + "id" : "8badc11a-50e4-44ae-a292-47e3759fcaeb", + "clientId" : "security-c4po-api", + "rootUrl" : "", + "adminUrl" : "", + "baseUrl" : "http://localhost:8443/", + "surrogateAuthRequired" : false, + "enabled" : true, + "alwaysDisplayInConsole" : false, + "clientAuthenticatorType" : "client-secret", + "secret" : "0aef07ba-d8b4-405d-9dcb-f3743f966856", + "redirectUris" : [ "http://localhost:8443/*" ], + "webOrigins" : [ "*" ], + "notBefore" : 0, + "bearerOnly" : false, + "consentRequired" : false, + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : true, + "serviceAccountsEnabled" : false, + "publicClient" : false, + "frontchannelLogout" : false, + "protocol" : "openid-connect", + "attributes" : { + "saml.assertion.signature" : "false", + "saml.force.post.binding" : "false", + "saml.multivalued.roles" : "false", + "saml.encrypt" : "false", + "saml.server.signature" : "false", + "saml.server.signature.keyinfo.ext" : "false", + "exclude.session.state.from.auth.response" : "false", + "saml_force_name_id_format" : "false", + "saml.client.signature" : "false", + "tls.client.certificate.bound.access.tokens" : "false", + "saml.authnstatement" : "false", + "display.on.consent.screen" : "false", + "saml.onetimeuse.condition" : "false" + }, + "authenticationFlowBindingOverrides" : { }, + "fullScopeAllowed" : true, + "nodeReRegistrationTimeout" : -1, + "defaultClientScopes" : [ "web-origins", "role_list", "profile", "roles", "email" ], + "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ] + } ], + "clientScopes" : [ { + "id" : "8d428e56-80df-4505-8e1a-26537e793b31", + "name" : "offline_access", + "description" : "OpenID Connect built-in scope: offline_access", + "protocol" : "openid-connect", + "attributes" : { + "consent.screen.text" : "${offlineAccessScopeConsentText}", + "display.on.consent.screen" : "true" + } + }, { + "id" : "4b171f57-736a-41b4-b67b-585bac1d8d24", + "name" : "role_list", + "description" : "SAML role list", + "protocol" : "saml", + "attributes" : { + "consent.screen.text" : "${samlRoleListScopeConsentText}", + "display.on.consent.screen" : "true" + }, + "protocolMappers" : [ { + "id" : "2b161cf6-2c63-45e8-a698-48f7297cc303", + "name" : "role list", + "protocol" : "saml", + "protocolMapper" : "saml-role-list-mapper", + "consentRequired" : false, + "config" : { + "single" : "false", + "attribute.nameformat" : "Basic", + "attribute.name" : "Role" + } + } ] + }, { + "id" : "ac7d05f9-d505-42e9-9b7c-1984b31e653d", + "name" : "profile", + "description" : "OpenID Connect built-in scope: profile", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${profileScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "2be3fbed-d2c8-46eb-94e0-b2efdf20ad60", + "name" : "middle name", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "middleName", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "middle_name", + "jsonType.label" : "String" + } + }, { + "id" : "d3465101-1321-43a7-8f65-8b782c390297", + "name" : "website", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "website", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "website", + "jsonType.label" : "String" + } + }, { + "id" : "68391807-41ec-4ce2-877d-3a808bb1bbe4", + "name" : "locale", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "locale", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "locale", + "jsonType.label" : "String" + } + }, { + "id" : "d8d837e5-e1f8-45af-96b0-7c5607780e0b", + "name" : "nickname", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "nickname", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "nickname", + "jsonType.label" : "String" + } + }, { + "id" : "0667458d-83c3-4cd1-b60a-436a3bb42d2e", + "name" : "birthdate", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "birthdate", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "birthdate", + "jsonType.label" : "String" + } + }, { + "id" : "e8cd5b57-ee69-46eb-afd7-71cc68ca5384", + "name" : "full name", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-full-name-mapper", + "consentRequired" : false, + "config" : { + "id.token.claim" : "true", + "access.token.claim" : "true", + "userinfo.token.claim" : "true" + } + }, { + "id" : "643f5ffd-4c38-4228-808d-2fd9f2a075ba", + "name" : "family name", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "lastName", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "family_name", + "jsonType.label" : "String" + } + }, { + "id" : "b41a9738-9529-47f8-bd90-461c072212af", + "name" : "username", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "username", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "preferred_username", + "jsonType.label" : "String" + } + }, { + "id" : "29c5817f-6101-48ff-a1e5-dbb23e3b0534", + "name" : "profile", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "profile", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "profile", + "jsonType.label" : "String" + } + }, { + "id" : "a4a193ec-25bb-4457-8287-ca2abaff5940", + "name" : "zoneinfo", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "zoneinfo", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "zoneinfo", + "jsonType.label" : "String" + } + }, { + "id" : "3c132112-0285-4ef4-9317-2d94c58c9bc6", + "name" : "picture", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "picture", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "picture", + "jsonType.label" : "String" + } + }, { + "id" : "7bbf2f74-db95-47f1-8736-8b0864a01d5a", + "name" : "gender", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "gender", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "gender", + "jsonType.label" : "String" + } + }, { + "id" : "7f92e589-d307-4574-bf84-0f34bdbef9f3", + "name" : "updated at", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "updatedAt", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "updated_at", + "jsonType.label" : "String" + } + }, { + "id" : "efe55944-ab38-4fe2-9452-8499f9d52e80", + "name" : "given name", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "firstName", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "given_name", + "jsonType.label" : "String" + } + } ] + }, { + "id" : "32f1098d-79a9-4da4-a94a-c873fcc0f6e1", + "name" : "email", + "description" : "OpenID Connect built-in scope: email", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${emailScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "92afef33-2843-40bc-aba1-58d462fa81cc", + "name" : "email verified", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "emailVerified", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "email_verified", + "jsonType.label" : "boolean" + } + }, { + "id" : "4b4d33d1-ed47-40db-a05f-4253c25dbbff", + "name" : "email", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "email", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "email", + "jsonType.label" : "String" + } + } ] + }, { + "id" : "412cfb80-d33e-44da-a0e2-b0bde0423c00", + "name" : "address", + "description" : "OpenID Connect built-in scope: address", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${addressScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "261a490f-073d-4975-af5b-e2d9e21ea768", + "name" : "address", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-address-mapper", + "consentRequired" : false, + "config" : { + "user.attribute.formatted" : "formatted", + "user.attribute.country" : "country", + "user.attribute.postal_code" : "postal_code", + "userinfo.token.claim" : "true", + "user.attribute.street" : "street", + "id.token.claim" : "true", + "user.attribute.region" : "region", + "access.token.claim" : "true", + "user.attribute.locality" : "locality" + } + } ] + }, { + "id" : "faf5c077-e43d-4433-9f5d-ddfc10f31385", + "name" : "phone", + "description" : "OpenID Connect built-in scope: phone", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${phoneScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "57383851-63a0-4599-8074-ecaddfbf5164", + "name" : "phone number verified", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "phoneNumberVerified", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "phone_number_verified", + "jsonType.label" : "boolean" + } + }, { + "id" : "8992684a-ea4f-490c-8cd4-6af77ab77b64", + "name" : "phone number", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-attribute-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "phoneNumber", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "phone_number", + "jsonType.label" : "String" + } + } ] + }, { + "id" : "21ac5f31-d742-40c7-89a1-cd7f35036450", + "name" : "roles", + "description" : "OpenID Connect scope for add user roles to the access token", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "false", + "display.on.consent.screen" : "true", + "consent.screen.text" : "${rolesScopeConsentText}" + }, + "protocolMappers" : [ { + "id" : "c9ab2a7d-062d-419f-90d4-7682c854857e", + "name" : "realm roles", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-realm-role-mapper", + "consentRequired" : false, + "config" : { + "user.attribute" : "foo", + "access.token.claim" : "true", + "claim.name" : "realm_access.roles", + "jsonType.label" : "String", + "multivalued" : "true" + } + }, { + "id" : "46b6c2ed-6b50-4205-a7c2-d2fd2c93353c", + "name" : "client roles", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-client-role-mapper", + "consentRequired" : false, + "config" : { + "user.attribute" : "foo", + "access.token.claim" : "true", + "claim.name" : "resource_access.${client_id}.roles", + "jsonType.label" : "String", + "multivalued" : "true" + } + }, { + "id" : "60e36e8d-7456-4581-9c35-068942b61a40", + "name" : "audience resolve", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-audience-resolve-mapper", + "consentRequired" : false, + "config" : { } + } ] + }, { + "id" : "cd5f153a-ff23-43d5-81a0-6c8dc6f39a4e", + "name" : "web-origins", + "description" : "OpenID Connect scope for add allowed web origins to the access token", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "false", + "display.on.consent.screen" : "false", + "consent.screen.text" : "" + }, + "protocolMappers" : [ { + "id" : "9a8031f8-997b-4899-ba60-05868f8e4b18", + "name" : "allowed web origins", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-allowed-origins-mapper", + "consentRequired" : false, + "config" : { } + } ] + }, { + "id" : "b18623a4-3595-4993-b2bd-79e94778d28b", + "name" : "microprofile-jwt", + "description" : "Microprofile - JWT built-in scope", + "protocol" : "openid-connect", + "attributes" : { + "include.in.token.scope" : "true", + "display.on.consent.screen" : "false" + }, + "protocolMappers" : [ { + "id" : "a59540b9-81a8-4ca8-b0ff-bff6ceb049c2", + "name" : "upn", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-property-mapper", + "consentRequired" : false, + "config" : { + "userinfo.token.claim" : "true", + "user.attribute" : "username", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "upn", + "jsonType.label" : "String" + } + }, { + "id" : "0eee48de-8c6f-4167-8958-fb4d3ef973cc", + "name" : "groups", + "protocol" : "openid-connect", + "protocolMapper" : "oidc-usermodel-realm-role-mapper", + "consentRequired" : false, + "config" : { + "multivalued" : "true", + "userinfo.token.claim" : "true", + "user.attribute" : "foo", + "id.token.claim" : "true", + "access.token.claim" : "true", + "claim.name" : "groups", + "jsonType.label" : "String" + } + } ] + } ], + "defaultDefaultClientScopes" : [ "role_list", "profile", "email", "roles", "web-origins" ], + "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt" ], + "browserSecurityHeaders" : { + "contentSecurityPolicyReportOnly" : "", + "xContentTypeOptions" : "nosniff", + "xRobotsTag" : "none", + "xFrameOptions" : "SAMEORIGIN", + "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';", + "xXSSProtection" : "1; mode=block", + "strictTransportSecurity" : "max-age=31536000; includeSubDomains" + }, + "smtpServer" : { }, + "eventsEnabled" : false, + "eventsListeners" : [ "jboss-logging" ], + "enabledEventTypes" : [ ], + "adminEventsEnabled" : false, + "adminEventsDetailsEnabled" : false, + "components" : { + "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ { + "id" : "56f53138-a448-42f5-ba77-b026b1b179d0", + "name" : "Allowed Client Scopes", + "providerId" : "allowed-client-templates", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { + "allow-default-scopes" : [ "true" ] + } + }, { + "id" : "46301b5f-58b3-48f2-8844-e82f1b5b5ad3", + "name" : "Max Clients Limit", + "providerId" : "max-clients", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { + "max-clients" : [ "200" ] + } + }, { + "id" : "898437e1-5717-4010-9306-6c3582ca5b09", + "name" : "Allowed Protocol Mapper Types", + "providerId" : "allowed-protocol-mappers", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { + "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ] + } + }, { + "id" : "cc2d0cd7-3d3f-4b0a-ad95-7118f36bf188", + "name" : "Full Scope Disabled", + "providerId" : "scope", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { } + }, { + "id" : "e1ded6a4-e0af-4c3a-bc5d-a142701302c4", + "name" : "Consent Required", + "providerId" : "consent-required", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { } + }, { + "id" : "12513189-c247-4869-8a24-ba7f694e8668", + "name" : "Allowed Client Scopes", + "providerId" : "allowed-client-templates", + "subType" : "authenticated", + "subComponents" : { }, + "config" : { + "allow-default-scopes" : [ "true" ] + } + }, { + "id" : "7511759b-c33d-4bb4-bd46-724599ea2efb", + "name" : "Allowed Protocol Mapper Types", + "providerId" : "allowed-protocol-mappers", + "subType" : "authenticated", + "subComponents" : { }, + "config" : { + "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper" ] + } + }, { + "id" : "92230e65-7480-44c3-af2d-72ddee758cbc", + "name" : "Trusted Hosts", + "providerId" : "trusted-hosts", + "subType" : "anonymous", + "subComponents" : { }, + "config" : { + "host-sending-registration-request-must-match" : [ "true" ], + "client-uris-must-match" : [ "true" ] + } + } ], + "org.keycloak.keys.KeyProvider" : [ { + "id" : "ea025a18-d77a-4bbc-8e3a-c6b55ccf4b3f", + "name" : "hmac-generated", + "providerId" : "hmac-generated", + "subComponents" : { }, + "config" : { + "kid" : [ "ddd6d915-c898-4e32-b9de-f1469a2dfb6a" ], + "secret" : [ "GegBlWTwur6eFVW_fdHBsmbWZmpkLcZrhZS028OOUG3bErTFFxgjqHfH-cZ8au5uOFyquTYB1_IrzKNQB1HyMg" ], + "priority" : [ "100" ], + "algorithm" : [ "HS256" ] + } + }, { + "id" : "d54e6431-5a1c-4783-a9ca-dbbedd0b0f20", + "name" : "aes-generated", + "providerId" : "aes-generated", + "subComponents" : { }, + "config" : { + "kid" : [ "40b8e0ac-9300-4736-9668-713676911d5e" ], + "secret" : [ "kJGFh7LGYAI2ged6rJQVDQ" ], + "priority" : [ "100" ] + } + }, { + "id" : "38c2dd59-c891-4558-8102-c26ada370abd", + "name" : "rsa-generated", + "providerId" : "rsa-generated", + "subComponents" : { }, + "config" : { + "privateKey" : [ "MIIEpAIBAAKCAQEA5l/1wCtrIxaD7HW7/Qlmb4DtH1KdHzXc3J24pyLO914lvwfZBaRz4mcY9nia9/R+oCr62/EjIxVa4/SfA+O7ZUgi2TMJtwtUX3CKRlm+ktK51wnJ1TNN38zYEB9fFKuElP3Sqva+nLlmVTMyqXkDzLLhFJnc1Szu8tWXJKyrim4Oo/iAfvbmTisldgJ1YH/wcqfH08jgVhySDSXde6HejThhuDsM4FqeaPANBztpxDwYDo7sj9mD8UE9NvyzXr2o0NV+JvZv2H0RHth3KUf8iJta5tjo+wY4vQAPvkfOOdwn+XEsWIhZwKGMPeYeqETT6kKQX//UbNc+5YT513U1PQIDAQABAoIBAQCTXRrUfHGiFkr5PS6tZA/0j6IfATekuU24ieOOdkOyFLVMh3aZl2LRlmVvdCKdLfa5+gRSIOP7EzP60YXOdSRwWz5/dZhnUIX+Lv0kl0/Cl61tEsPa72CHIn+rgIXPsQ+0RtE1r3SqyCXfpkpoAhMeI+a6yNlsO7v19g8i1Jk+iIUiQxtsCGGUt+FsTao1cXq/i7F7NCS9PUD5aAVyURI5IEJ5+YXJZN68y0EBf8B2kWToMVEgLM5BJZraH+APuDbndmRFmNqe8w6X1PAYBAzubuAHrNfda/PC6whuSsupI9oRugU4LFIPdBVZLyL833xYQgAA7OaEF4KzK/E00f75AoGBAP7sm2AWtgQ6f0QPQfcS6zJJNwrfU86ay1NDoVL3eYY9rz9FXtAfUq/+Wo6nTnez1YSJjhnLeTpngquTlSlqlJdHqoAgPaOtAnZltVZ21hU3/9KHfF3Bi5X8T0nvoJ8FZTiOCRKKNGr9FEVdYOG+avtF6+TaEQyeW2q7PDkwkSPfAoGBAOdY1RxPEjTvuBrgGGBJ3sDd75okVc3OTxHsmZ2j1dqftk0euU8kNcQ40L2rwJ/OdnThFsyHfnN9lLoEQzc/rDWm74pOgQGqJ+AQZzEt0kWV1TmOwWQEx8dvipxMgI3xWzQ4BnzK3LTWl19LrP2f9V4F/iv//EqqHN3btojIxmpjAoGAT0wGYPNvlw0jPWaJnHOUGcZQit9BUIkyKiplakt0z98sPkAz6AV2USyLusgsTmvwRRQM0dVLVnGQYhK8WW+/3Pb8AHMG+Xz9wRqON+ErYtpSh4iBlSB5bSRY/aS+j/i7rcXw6IV5HLawsYsEcfQrjxIG+N8kYop34VFwwFFtNH0CgYBC4Tlqn6lByHNOwa4KWBCfbQmRZCOyBYxyQBYArpZqR3WqQdGMgYlRmqMt0fMzv7oa+99dbWYu+QT/6a+Mz0l3kTT6pMtCsfApJFTQsNBy8Wfc5doekgs3KpXFrZAUeMvHAtNNTFAVr1u/Xt85yv5iGhVqnuxOoXMK6DOSw4goxQKBgQDvTnYvpyRlHvTFHgutWocGWZA/k9XwwZJJaferWYD79EZkZHG7vkNp1JyxiuL2nuCidQp6psuOl5HeauhPHzFmpnq014Ju49t8CklKbiQt51T8Ir0S3nXs6F3e31c2t9fgMwLDfrNW1713wwHntDCWcQjU2aTDpLk9MY+ZaBaQhg==" ], + "certificate" : [ "MIICrzCCAZcCBgF4ra3edDANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQDDBBjNHBvX3JlYWxtX2xvY2FsMB4XDTIxMDQwNzE4NTA1NloXDTMxMDQwNzE4NTIzNlowGzEZMBcGA1UEAwwQYzRwb19yZWFsbV9sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOZf9cArayMWg+x1u/0JZm+A7R9SnR813NyduKcizvdeJb8H2QWkc+JnGPZ4mvf0fqAq+tvxIyMVWuP0nwPju2VIItkzCbcLVF9wikZZvpLSudcJydUzTd/M2BAfXxSrhJT90qr2vpy5ZlUzMql5A8yy4RSZ3NUs7vLVlySsq4puDqP4gH725k4rJXYCdWB/8HKnx9PI4FYckg0l3Xuh3o04Ybg7DOBanmjwDQc7acQ8GA6O7I/Zg/FBPTb8s169qNDVfib2b9h9ER7YdylH/IibWubY6PsGOL0AD75HzjncJ/lxLFiIWcChjD3mHqhE0+pCkF//1GzXPuWE+dd1NT0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgat1JOdb/cvKGc2rFRH4XuiP7mUrzJo+gCQNbikXEFZQHYeKUci3n9QIeFGUCwALgQdgWeeQG4wR1Hu95FkGFk9uMlt2w5lh5eCuTHX1fW6UMiUL4Cw1kgfyW6Lw8Ffk58qW6BAM76yTKgyYc6o8Hhvgw5X/sqxz4IXWgSB2+Zj8AjdaeThsOtnefpXChSSrGnoJwZqXLc1rLWvqtqiIVtJau0CO4qZ7VXiSHwJvZpF7+vLMWig9zEVnvNX38HGWcfGCymGRxjVP8mjC/GE1WG9jLU55otvE3Fll6/XXhndXh6imRzgvG41qdlvOz/gQgtcI5LBw8YCZ5EJQay93oQ==" ], + "priority" : [ "100" ] + } + } ] + }, + "internationalizationEnabled" : false, + "supportedLocales" : [ ], + "authenticationFlows" : [ { + "id" : "15c4eeb8-2a2b-4e5e-b5e1-98509003683b", + "alias" : "Account verification options", + "description" : "Method with which to verity the existing account", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "idp-email-verification", + "requirement" : "ALTERNATIVE", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "ALTERNATIVE", + "priority" : 20, + "flowAlias" : "Verify Existing Account by Re-authentication", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "e1240eb6-5e97-443f-9759-107179344936", + "alias" : "Authentication Options", + "description" : "Authentication options.", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "basic-auth", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "basic-auth-otp", + "requirement" : "DISABLED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "auth-spnego", + "requirement" : "DISABLED", + "priority" : 30, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "89fcc224-8b2a-4a3f-9b3e-abb9d577cacc", + "alias" : "Browser - Conditional OTP", + "description" : "Flow to determine if the OTP is required for the authentication", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "conditional-user-configured", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "auth-otp-form", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "74e9fa48-2fed-41c9-afa7-3a4beae840ce", + "alias" : "Direct Grant - Conditional OTP", + "description" : "Flow to determine if the OTP is required for the authentication", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "conditional-user-configured", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "direct-grant-validate-otp", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "b898b1e5-7746-4c73-a441-36e7fde9f25b", + "alias" : "First broker login - Conditional OTP", + "description" : "Flow to determine if the OTP is required for the authentication", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "conditional-user-configured", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "auth-otp-form", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "0498a97c-0af7-4316-b5d5-5a3ddbfcd390", + "alias" : "Handle Existing Account", + "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "idp-confirm-link", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "REQUIRED", + "priority" : 20, + "flowAlias" : "Account verification options", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "510b541f-9a5a-4525-bb72-638c6aba43ca", + "alias" : "Reset - Conditional OTP", + "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "conditional-user-configured", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "reset-otp", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "6490f472-d3db-47ce-ba4f-7e8b8048dec5", + "alias" : "User creation or linking", + "description" : "Flow for the existing/non-existing user alternatives", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticatorConfig" : "create unique user config", + "authenticator" : "idp-create-user-if-unique", + "requirement" : "ALTERNATIVE", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "ALTERNATIVE", + "priority" : 20, + "flowAlias" : "Handle Existing Account", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "0cfd20ab-4c6f-4af2-a01f-eef718f79d24", + "alias" : "Verify Existing Account by Re-authentication", + "description" : "Reauthentication of existing account", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "idp-username-password-form", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "CONDITIONAL", + "priority" : 20, + "flowAlias" : "First broker login - Conditional OTP", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "c91d3ef4-70ab-4be0-a9ec-abd17564ef9f", + "alias" : "browser", + "description" : "browser based authentication", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "auth-cookie", + "requirement" : "ALTERNATIVE", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "auth-spnego", + "requirement" : "DISABLED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "identity-provider-redirector", + "requirement" : "ALTERNATIVE", + "priority" : 25, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "ALTERNATIVE", + "priority" : 30, + "flowAlias" : "forms", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "0a39ae03-c439-41ec-b9bc-e4defb358422", + "alias" : "clients", + "description" : "Base authentication for clients", + "providerId" : "client-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "client-secret", + "requirement" : "ALTERNATIVE", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "client-jwt", + "requirement" : "ALTERNATIVE", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "client-secret-jwt", + "requirement" : "ALTERNATIVE", + "priority" : 30, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "client-x509", + "requirement" : "ALTERNATIVE", + "priority" : 40, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "2f793704-d04e-4fe8-8cc2-c8467a3f140e", + "alias" : "direct grant", + "description" : "OpenID Connect Resource Owner Grant", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "direct-grant-validate-username", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "direct-grant-validate-password", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "CONDITIONAL", + "priority" : 30, + "flowAlias" : "Direct Grant - Conditional OTP", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "555d28c6-c9c7-43ec-94de-6cfea6a3cd14", + "alias" : "docker auth", + "description" : "Used by Docker clients to authenticate against the IDP", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "docker-http-basic-authenticator", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "d6c01d47-329c-4333-8eac-5a8409f7bde8", + "alias" : "first broker login", + "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticatorConfig" : "review profile config", + "authenticator" : "idp-review-profile", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "REQUIRED", + "priority" : 20, + "flowAlias" : "User creation or linking", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "00bd3ccb-23cc-4a04-8c8f-83556bd7deaf", + "alias" : "forms", + "description" : "Username, password, otp and other auth forms.", + "providerId" : "basic-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "auth-username-password-form", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "CONDITIONAL", + "priority" : 20, + "flowAlias" : "Browser - Conditional OTP", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "6cd5ce9b-6a5c-4c2c-bd19-fb2f310aecc4", + "alias" : "http challenge", + "description" : "An authentication flow based on challenge-response HTTP Authentication Schemes", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "no-cookie-redirect", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "REQUIRED", + "priority" : 20, + "flowAlias" : "Authentication Options", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "5549dba2-1397-4f89-aff5-49ca823cabb8", + "alias" : "registration", + "description" : "registration flow", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "registration-page-form", + "requirement" : "REQUIRED", + "priority" : 10, + "flowAlias" : "registration form", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "ac076c79-3b2f-437a-8255-247eb2ce28b6", + "alias" : "registration form", + "description" : "registration form", + "providerId" : "form-flow", + "topLevel" : false, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "registration-user-creation", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "registration-profile-action", + "requirement" : "REQUIRED", + "priority" : 40, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "registration-password-action", + "requirement" : "REQUIRED", + "priority" : 50, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "registration-recaptcha-action", + "requirement" : "DISABLED", + "priority" : 60, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + }, { + "id" : "51219395-2175-4be5-8975-e844bbe8985e", + "alias" : "reset credentials", + "description" : "Reset credentials for a user if they forgot their password or something", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "reset-credentials-choose-user", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "reset-credential-email", + "requirement" : "REQUIRED", + "priority" : 20, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "authenticator" : "reset-password", + "requirement" : "REQUIRED", + "priority" : 30, + "userSetupAllowed" : false, + "autheticatorFlow" : false + }, { + "requirement" : "CONDITIONAL", + "priority" : 40, + "flowAlias" : "Reset - Conditional OTP", + "userSetupAllowed" : false, + "autheticatorFlow" : true + } ] + }, { + "id" : "b6131d9d-55b2-40a5-9b36-f0b1ef662554", + "alias" : "saml ecp", + "description" : "SAML ECP Profile Authentication Flow", + "providerId" : "basic-flow", + "topLevel" : true, + "builtIn" : true, + "authenticationExecutions" : [ { + "authenticator" : "http-basic-authenticator", + "requirement" : "REQUIRED", + "priority" : 10, + "userSetupAllowed" : false, + "autheticatorFlow" : false + } ] + } ], + "authenticatorConfig" : [ { + "id" : "d818257f-52f2-461e-b587-55b7a4dc968f", + "alias" : "create unique user config", + "config" : { + "require.password.update.after.registration" : "false" + } + }, { + "id" : "6e3771dd-8647-4cff-9bc4-49d824fb0582", + "alias" : "review profile config", + "config" : { + "update.profile.on.first.login" : "missing" + } + } ], + "requiredActions" : [ { + "alias" : "CONFIGURE_TOTP", + "name" : "Configure OTP", + "providerId" : "CONFIGURE_TOTP", + "enabled" : true, + "defaultAction" : false, + "priority" : 10, + "config" : { } + }, { + "alias" : "terms_and_conditions", + "name" : "Terms and Conditions", + "providerId" : "terms_and_conditions", + "enabled" : false, + "defaultAction" : false, + "priority" : 20, + "config" : { } + }, { + "alias" : "UPDATE_PASSWORD", + "name" : "Update Password", + "providerId" : "UPDATE_PASSWORD", + "enabled" : true, + "defaultAction" : false, + "priority" : 30, + "config" : { } + }, { + "alias" : "UPDATE_PROFILE", + "name" : "Update Profile", + "providerId" : "UPDATE_PROFILE", + "enabled" : true, + "defaultAction" : false, + "priority" : 40, + "config" : { } + }, { + "alias" : "VERIFY_EMAIL", + "name" : "Verify Email", + "providerId" : "VERIFY_EMAIL", + "enabled" : true, + "defaultAction" : false, + "priority" : 50, + "config" : { } + }, { + "alias" : "update_user_locale", + "name" : "Update User Locale", + "providerId" : "update_user_locale", + "enabled" : true, + "defaultAction" : false, + "priority" : 1000, + "config" : { } + } ], + "browserFlow" : "browser", + "registrationFlow" : "registration", + "directGrantFlow" : "direct grant", + "resetCredentialsFlow" : "reset credentials", + "clientAuthenticationFlow" : "clients", + "dockerAuthenticationFlow" : "docker auth", + "attributes" : { + "clientOfflineSessionMaxLifespan" : "0", + "clientSessionIdleTimeout" : "0", + "clientSessionMaxLifespan" : "0", + "clientOfflineSessionIdleTimeout" : "0" + }, + "keycloakVersion" : "11.0.3", + "userManagedAccessAllowed" : false +} \ No newline at end of file diff --git a/security-c4po-cfg/docker-compose.yml b/security-c4po-cfg/docker-compose.yml index 844f367..6b5eb35 100644 --- a/security-c4po-cfg/docker-compose.yml +++ b/security-c4po-cfg/docker-compose.yml @@ -22,6 +22,9 @@ services: c4po-keycloak: container_name: c4po-keycloak image: quay.io/keycloak/keycloak:20.0.0 + environment: + - KEYCLOAK_ADMIN=admin + - KEYCLOAK_ADMIN_PASSWORD=admin volumes: - ./cfg/c4po_realm_export.json/:/opt/keycloak/data/import/c4po_realm_export.json ports: