mirror/infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2025-01-18 08:06:16 +01:00
Code Issues

grafana: Use builtin functionality to restrict access

Browse Source 
This reverts commit 649568e7 ("Restrict Grafana access to Arch Linux
Staff group on Keycloak (fixes #151)").
This commit is contained in:
Thorben Günther 2021-07-06 20:41:01 +02:00 committed by Kristian Klausen
parent a898f42e4e
commit e7aa7f09a7
2 changed files with 3 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
roles/grafana/templates/grafana.ini.j2
View File

@ -477,8 +477,8 @@ api_url = https://accounts.archlinux.org/auth/realms/archlinux/protocol/openid-c
;allowed_domains =
;team_ids =
;allowed_organizations =
role_attribute_path: contains(roles[*], 'DevOps') && 'Admin' || contains(roles[*], 'Staff') && 'Viewer'
;role_attribute_strict = false
role_attribute_path: contains(roles[*], 'DevOps') && 'Admin'
role_attribute_strict = true
;tls_skip_verify_insecure = false
;tls_client_cert =
;tls_client_key =

26
tf-stage2/keycloak.tf
View File

@ -419,8 +419,7 @@ resource "keycloak_group_roles" "devops" {
realm_id = "archlinux"
group_id = keycloak_group.staff_groups["DevOps"].id
role_ids = [
keycloak_role.devops.id,
keycloak_role.grafana_archlinux_devops.id
keycloak_role.devops.id
]
}
@ -775,29 +774,6 @@ resource "keycloak_openid_user_realm_role_protocol_mapper" "user_realm_role_mapp
add_to_access_token = false
}
// All of the below is to restrict access to Grafana to members in the Arch Linux DevOps group.
resource "keycloak_role" "grafana_archlinux_devops" {
realm_id = "archlinux"
client_id = keycloak_openid_client.grafana_openid_client.id
name = "DevOps"
description = "Arch Linux Staff Grafana"
}
resource "keycloak_generic_client_role_mapper" "grafana_archlinux_devops_to_email" {
realm_id = "archlinux"
role_id = keycloak_role.grafana_archlinux_devops.id
client_scope_id = keycloak_openid_client_scope.email.id
}
// This needs to be imported from the default client scopes created by Keycloak.
resource "keycloak_openid_client_scope" "email" {
realm_id = "archlinux"
name = "email"
description = "OpenID Connect built-in scope: email"
include_in_token_scope = true
consent_screen_text = "$${emailScopeConsentText}"
}
resource "keycloak_openid_client" "hedgedoc_openid_client" {
realm_id = "archlinux"
client_id = "openid_hedgedoc"