diff --git a/.dockerignore b/.dockerignore
index d862f96f..6cf0e8ba 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,4 +3,6 @@ Dockerfile
node_modules
npm-debug.log
README.md
-.next
\ No newline at end of file
+.next
+.kube-workflow
+.github
diff --git a/.env.development b/.env.development
index 700d2c7b..1aa8f6e4 100644
--- a/.env.development
+++ b/.env.development
@@ -1,7 +1,10 @@
-NEXT_TELEMETRY_DISABLED=1
-NEXT_PUBLIC_SITE_URL=""
NEXT_PUBLIC_SENTRY_DSN=""
NEXT_PUBLIC_SENTRY_ENV=""
NEXT_PUBLIC_MATOMO_URL=""
NEXT_PUBLIC_MATOMO_SITE_ID=""
-NEXT_PUBLIC_APP_REPOSITORY_URL="https://github.com/SocialGouv/template"
\ No newline at end of file
+NEXT_PUBLIC_APP_REPOSITORY_URL="https://github.com/SocialGouv/template"
+KEYCLOAK_URL="http://localhost:8080/realms/app-realm"
+KEYCLOAK_CLIENT_SECRET="**********"
+KEYCLOAK_CLIENT_ID="app-client"
+NEXTAUTH_URL="http://localhost:3000"
+NEXTAUTH_SECRET="A+EQqudlGhqTLDnBbCvohHBfbhUjTXAbZYy1NKsSsys="
\ No newline at end of file
diff --git a/.env.production b/.env.production
index f655a790..3f4ce703 100644
--- a/.env.production
+++ b/.env.production
@@ -1,5 +1,3 @@
-NEXT_TELEMETRY_DISABLED=1
-NEXT_PUBLIC_SITE_URL="https://template.fabrique.social.gouv.fr/"
NEXT_PUBLIC_SENTRY_DSN="https://67a92c8c0f70486d9f36f2352eff1d19@sentry.fabrique.social.gouv.fr/68"
NEXT_PUBLIC_SENTRY_ENV="production"
NEXT_PUBLIC_MATOMO_URL="https://matomo.fabrique.social.gouv.fr"
diff --git a/.env.staging b/.env.staging
index 5fefb033..0ec7a8b4 100644
--- a/.env.staging
+++ b/.env.staging
@@ -1,7 +1,5 @@
-NEXT_TELEMETRY_DISABLED=1
-NEXT_PUBLIC_SITE_URL="https://template.fabrique.social.gouv.fr/"
NEXT_PUBLIC_SENTRY_DSN="https://67a92c8c0f70486d9f36f2352eff1d19@sentry.fabrique.social.gouv.fr/68"
NEXT_PUBLIC_SENTRY_ENV="development"
NEXT_PUBLIC_MATOMO_URL=""
NEXT_PUBLIC_MATOMO_SITE_ID=""
-NEXT_PUBLIC_APP_REPOSITORY_URL="https://github.com/SocialGouv/template"
\ No newline at end of file
+NEXT_PUBLIC_APP_REPOSITORY_URL="https://github.com/SocialGouv/template"
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d3949959..490152c5 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,5 +1,4 @@
# Protect workflow files
.github/workflows/*.yml @socialgouv/sre
.github/CODEOWNERS @socialgouv/sre
-.k8s/ @socialgouv/sre
-.socialgouv/ @socialgouv/sre
+.kontinuous/ @socialgouv/sre
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 15434656..36c7558c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,7 +8,7 @@ concurrency:
jobs:
build:
- name: Build and export
+ name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout repository
@@ -26,6 +26,6 @@ jobs:
- name: Install dependencies
run: |
yarn install --prefer-offline --frozen-lockfile
- - name: Build and export
+ - name: Build
run: |
- yarn build:export
+ yarn build
diff --git a/.github/workflows/deactivate.yml b/.github/workflows/deactivate.yml
deleted file mode 100644
index e5b28b60..00000000
--- a/.github/workflows/deactivate.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Deactivate
-
-on:
- pull_request:
- types: [closed]
-
-jobs:
- bury_review_env:
- name: Deactivate review branch
- runs-on: ubuntu-latest
- steps:
- - uses: SocialGouv/actions/autodevops-deactivate@v1
- with:
- kube-config: ${{ secrets.KUBECONFIG }}
- github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ks-preproduction.yaml b/.github/workflows/ks-preproduction.yaml
new file mode 100644
index 00000000..669d8cf9
--- /dev/null
+++ b/.github/workflows/ks-preproduction.yaml
@@ -0,0 +1,20 @@
+name: Preproduction
+
+on:
+ push:
+ branches:
+ - master
+ tags-ignore:
+ - v*
+
+concurrency:
+ cancel-in-progress: true
+ group: preproduction
+
+jobs:
+ follow-deployment:
+ environment:
+ name: preproduction
+ url: https://template-preprod.dev.fabrique.social.gouv.fr
+ uses: SocialGouv/kontinuous/.github/workflows/workflow-logs.yaml@v1
+ secrets: inherit
diff --git a/.github/workflows/ks-production.yaml b/.github/workflows/ks-production.yaml
new file mode 100644
index 00000000..1d80e8a3
--- /dev/null
+++ b/.github/workflows/ks-production.yaml
@@ -0,0 +1,18 @@
+name: Production
+
+on:
+ push:
+ tags:
+ - v*
+
+concurrency:
+ group: production
+ cancel-in-progress: true
+
+jobs:
+ follow-deployment:
+ environment:
+ name: production
+ url: https://template.fabrique.social.gouv.fr
+ uses: SocialGouv/kontinuous/.github/workflows/workflow-logs.yaml@v1
+ secrets: inherit
diff --git a/.github/workflows/ks-review-deactivate.yaml b/.github/workflows/ks-review-deactivate.yaml
new file mode 100644
index 00000000..7dc7640c
--- /dev/null
+++ b/.github/workflows/ks-review-deactivate.yaml
@@ -0,0 +1,13 @@
+name: Review Deactivate
+on:
+ pull_request:
+ types: [closed]
+
+concurrency:
+ cancel-in-progress: true
+ group: review-deactivate-${{ github.ref }}
+
+jobs:
+ follow-deactivation:
+ uses: SocialGouv/kontinuous/.github/workflows/workflow-logs.yaml@v1
+ secrets: inherit
diff --git a/.github/workflows/ks-review.yaml b/.github/workflows/ks-review.yaml
new file mode 100644
index 00000000..20ec4e33
--- /dev/null
+++ b/.github/workflows/ks-review.yaml
@@ -0,0 +1,17 @@
+name: Review
+
+on:
+ push:
+ branches-ignore:
+ - master
+ tags-ignore:
+ - v*
+
+concurrency:
+ cancel-in-progress: true
+ group: review-${{ github.ref }}
+
+jobs:
+ follow-deployment:
+ uses: SocialGouv/kontinuous/.github/workflows/workflow-logs.yaml@v1
+ secrets: inherit
diff --git a/.github/workflows/preproduction.yml b/.github/workflows/preproduction.yml
deleted file mode 100644
index d5fca9f5..00000000
--- a/.github/workflows/preproduction.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: Preproduction
-
-on:
- push:
- branches:
- - main
- tags-ignore:
- - v*
-
-concurrency:
- cancel-in-progress: true
- group: preproduction
-
-jobs:
- register:
- name: Build & Register application
- runs-on: ubuntu-latest
- steps:
- - name: Get commit sha
- run: |
- echo "GITHUB_SHA=${GITHUB_SHA}" >> $GITHUB_ENV
- - name: Use autodevops build and register
- uses: SocialGouv/actions/autodevops-build-register@v1
- with:
- environment: preprod
- imagePackage: app
- token: ${{ secrets.GITHUB_TOKEN }}
- dockerbuildargs: |
- GITHUB_SHA=${{ env.GITHUB_SHA }}
-
- deploy:
- name: Deploy application
- runs-on: ubuntu-latest
- needs: [register]
- environment:
- name: preproduction
- url: https://template-preprod.dev.fabrique.social.gouv.fr
- steps:
- - name: Use kube-workflow deployment
- uses: SocialGouv/kube-workflow@v1
- with:
- environment: preprod
- token: ${{ secrets.GITHUB_TOKEN }}
- kubeconfig: ${{ secrets.KUBECONFIG }}
- rancherProjectId: ${{ secrets.RANCHER_PROJECT_ID }}
- rancherProjectName: ${{ secrets.RANCHER_PROJECT_NAME }}
diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
deleted file mode 100644
index 3e9aa3b9..00000000
--- a/.github/workflows/production.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Production
-
-on:
- push:
- tags:
- - v*
-
-concurrency:
- group: production
- cancel-in-progress: true
-
-jobs:
- register:
- name: Build & Register application
- runs-on: ubuntu-latest
- steps:
- - name: Get commit sha
- run: |
- echo "GITHUB_SHA=${GITHUB_SHA}" >> $GITHUB_ENV
- - name: Use autodevops build and register
- uses: SocialGouv/actions/autodevops-build-register@v1
- with:
- environment: prod
- imagePackage: app
- token: ${{ secrets.GITHUB_TOKEN }}
- dockerbuildargs: |
- PRODUCTION=true
- GITHUB_SHA=${{ env.GITHUB_SHA }}
-
- deploy:
- name: Deploy application
- runs-on: ubuntu-latest
- needs: [register]
- environment:
- name: production
- url: https://template.fabrique.social.gouv.fr
- steps:
- - name: Use kube-workflow deployment
- uses: SocialGouv/kube-workflow@v1
- with:
- environment: prod
- token: ${{ secrets.GITHUB_TOKEN }}
- kubeconfig: ${{ secrets.KUBECONFIG }}
- rancherProjectId: ${{ secrets.RANCHER_PROJECT_ID }}
- rancherProjectName: ${{ secrets.RANCHER_PROJECT_NAME }}
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
deleted file mode 100644
index 6329b552..00000000
--- a/.github/workflows/review.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Review
-
-on:
- push:
- branches-ignore:
- - main
- tags-ignore:
- - v*
-
-concurrency:
- cancel-in-progress: true
- group: review-${{ github.ref }}
-
-jobs:
- register:
- name: Build & Register application
- runs-on: ubuntu-latest
- steps:
- - name: Get commit sha
- run: |
- echo "GITHUB_SHA=${GITHUB_SHA}" >> $GITHUB_ENV
- - name: Use autodevops build and register
- uses: SocialGouv/actions/autodevops-build-register@v1
- with:
- environment: dev
- imagePackage: app
- token: ${{ secrets.GITHUB_TOKEN }}
- dockerbuildargs: |
- GITHUB_SHA=${{ env.GITHUB_SHA }}
-
- deploy:
- name: Deploy review branch
- runs-on: ubuntu-latest
- needs: [register]
- steps:
- - name: Use kube-workflow deployment
- uses: SocialGouv/kube-workflow@v1
- with:
- environment: dev
- token: ${{ secrets.GITHUB_TOKEN }}
- kubeconfig: ${{ secrets.KUBECONFIG }}
- rancherProjectId: ${{ secrets.RANCHER_PROJECT_ID }}
- rancherProjectName: ${{ secrets.RANCHER_PROJECT_NAME }}
diff --git a/.gitignore b/.gitignore
index 5ff890ea..7c4966b1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,4 +44,7 @@ cypress/videos
cypress/screenshots
# Robots.txt
-robots.txt
\ No newline at end of file
+robots.txt
+
+# Keycloak extensions deployed
+*.jar.deployed
\ No newline at end of file
diff --git a/.kontinuous/Chart.yaml b/.kontinuous/Chart.yaml
new file mode 100644
index 00000000..95cfbb4e
--- /dev/null
+++ b/.kontinuous/Chart.yaml
@@ -0,0 +1,5 @@
+dependencies:
+ - name: keycloakx
+ repository: https://codecentric.github.io/helm-charts
+ version: 1.3.2
+ # condition: keycloak.enabled
diff --git a/.kontinuous/config.yaml b/.kontinuous/config.yaml
new file mode 100644
index 00000000..9fbcacba
--- /dev/null
+++ b/.kontinuous/config.yaml
@@ -0,0 +1,3 @@
+dependencies:
+ fabrique:
+ import: SocialGouv/kontinuous/plugins/fabrique
diff --git a/.kontinuous/env/dev/templates/app.configmap.yaml b/.kontinuous/env/dev/templates/app.configmap.yaml
new file mode 100644
index 00000000..331089f0
--- /dev/null
+++ b/.kontinuous/env/dev/templates/app.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: app
+data:
+ NEXT_TELEMETRY_DISABLED: "1"
+ KEYCLOAK_URL: "https://keycloak-{{.Values.global.host}}/realms/app-realm"
+ NEXTAUTH_URL: "https://{{.Values.global.host}}"
diff --git a/.kontinuous/env/dev/templates/app.sealed.secret.yaml b/.kontinuous/env/dev/templates/app.sealed.secret.yaml
new file mode 100644
index 00000000..1e62276f
--- /dev/null
+++ b/.kontinuous/env/dev/templates/app.sealed.secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: app
+spec:
+ encryptedData:
+ NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
+ KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO
+ KEYCLOAK_CLIENT_SECRET: AgC2BgDwrXwWXYrpvHDh5vZZMLMNIdebcvWQzxrJE89WlkTAzh70JuKPXKW1s0Aj41xc1Cx00mvUSeEw+EnVmpvxyn6AZxPBCJsVYfZtK5Cd+qzlbwe1r7vAgOgUDEKCEVPGDUesxmaEQwLTW78vkhFTBiOMWhKAew8LBA0y9DIV+CQvAOCEZcB5J5jP1OEmaeZiwOdBbOVyk/s1Qbx1YmmhgMAMAAPlnURIbMAH+RjaQi6/BU4tS+hPEdQZ5yqm4wk63PFgxi1U3GaRYqDP2eVaPyBzu8A9AvR3YLOynw3yMAxFEgfBrtuykZt4X10hu8dRYGe9JSsbonOd9PlZirnknlnifTF/99lzQq074Dhd1rpjNVvnbTM0PmyxpXAD0Ydf7CTvZoeD/dQNTEzafkr5HpiS9X1788a+0VsAWVS2ux/4V/khS0pkoExZWsxFfQVlNRkMKyR7N5fFRS2VOEAzomOqMdjcf2iaizWdDd0YkQF6LTjLs87nrJaIJSLccpAUy7lPxKs9+pRuqpay61+V54tcv2vwhZHlOc7JFxY6NgCvz07UaI665koa/67TdbSjYww/NfqhJdf/8ybtcN85Yu+SzU0l89Z0AwMnH7rDP9Pwv2OW+MWn8eDqu1E4/duCAxhKMS/sjPHHU83CFM6Ycd9MXA6e+HlLQBEPBV/08KLynhtAycotMraUQ9hmU4HrBDJqmZFtpO/ZUW9CP1gZ0ZsFyv2r2qyUUqvIyFLbUA==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: app
+ type: Opaque
diff --git a/.kontinuous/env/dev/templates/franceconnect.sealed.secret.yaml b/.kontinuous/env/dev/templates/franceconnect.sealed.secret.yaml
new file mode 100644
index 00000000..e31d16b4
--- /dev/null
+++ b/.kontinuous/env/dev/templates/franceconnect.sealed.secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: franceconnect
+spec:
+ encryptedData:
+ FRANCE_CONNECT_CLIENT_ID: AgCbLEqJcxaUphThDCEtuwLv6tGCVWn5pGADStG7x+yx7w2OQ2Ucdr9srt7Zev5GH4RIu+t3WY/LEcNXkxnJWraPYPsON5iQ0zj8R2UJIpv/kmLixOTaeLxBODknpSoVSUehOKCHVtqggLCTVPAJNSJgR2cDebW3bH8w9uvAgX1fXu0weLIjm5q815iwbeQmkEXejkWuGYALfwa08YlexbMmTg/HDGNl7T843XGZjNbPO4rRwfjEAYkA30WxJ7hSxOhqZTDBJT/agWoxei5QvNykm/wU88pr6Ume7wmMGG/vizWfRweXkiGuWF687Nt1xq+SEAGK/GZuujHIp3VbHPI0CIfjU0NrTK4qpCp7bDl3rdvdzx6a5ubNjhv0Z3dwF+Y1UFyB5NIWkpJn8qxa060I5fFWbvw4xe7kJTufx8jVL7h8HQK1iCw2DEhx4M3L0KslpNby6OFSUINTdZhDbj9/l5tBMrxbtxsnubxbuUvCBSurI6iNUrEXu4pruaN4VautwkN1M1EHMtMxE+PzpoV61GMdGwZmrfZzOrLYYXdKaCAcRNAGOo156wapdk7QBNqK6GrbGbsaIJo0QruVebPS36rmgsc+0JDKYruIvcA94wkbzvScy0RwiSpfqBhcUHZXq2dCRhgrkJnFfXJbpKziVGcvQmMYPQEH78jJgzswdoK2tCZnxg4jXSJv6pn+2BWmAAMvMRXT3Zb+styCVkODPwcgvIcl6h9VgaTyc4Tu+kjKkHvQS6Age0/9M0W5Z9/4ngzJQNzDxl0PU+oGckiJ
+ FRANCE_CONNECT_CLIENT_SECRET: AgAq5ZXB3fz9RjjI/bE0I92LcxwNTVih56O8n7xxoxzea10nsV+6Tu76vjE8znLw71QobQeLnuoI61WcSl1f0NBQwl5fIGDSRjCgSUAz1+2T4NF7Q1b9wqIsAsC4dvMMSiNF19P+4/galSbwxJ5qWVjmYt3iC3hBrgs1nuaFVDUlo1X9Qwi9eutFnjesZIcT4WnlU7onSlTQgmshUUfc2IBcgLYWftl35dhIvXKifka2tUTiCsJkLjfmOrKYtfOfw1a4MOCn74LMhzoZNAUFHwlJRZTw+PbAWFKz+Z/5wvEDB1pevU8j5Kdg6qgCwrExCsHFGxsg46Io6HChH0ktIWxaPV7U1Xx0h8VxOo2VgStQq1pWEy3hq3BVxiVGTgywhPtwWhJWWlFCcrnO7Za9nZtYmtM+DSUlbrGQdSK9Z1U5kpeJdLpNe72oPZ/hJ5Fl6i4kO6iH6xDnKfgjZpU1OeL9tpa5Dpujp+chQNFVI8+7nZY389Z53NxGEMMRWS42JH0N+yejtVZsHipfo9s/Y4TdaR7cjoKHnvHi+rVo8TI3NwwEvQBRmT2dHX1XXOz5O4hx30gy3XHqCYaX5i9evXexy5xRXL3lpQqfx3VmFf7eJEC/AJrvdMxwhDnzaq2lxjgRfx38ty5wKy+EFvsBFAf0hKtnmlwO0Vpz78Zuj5t+GeJ4exYHwUA7NVwOVzqbwwsZctM7kTNc99DxSg68MsSDsZcXiWhNL5J9PowD38fG/fXHiOpb3TxSSwVTIR7OzozZ3fYpRQ6gbgQiFOHnSZmk
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: franceconnect
+ type: Opaque
diff --git a/.kontinuous/env/dev/templates/keycloak.sealed.secret.yaml b/.kontinuous/env/dev/templates/keycloak.sealed.secret.yaml
new file mode 100644
index 00000000..5e9c6895
--- /dev/null
+++ b/.kontinuous/env/dev/templates/keycloak.sealed.secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: keycloak-secrets
+spec:
+ encryptedData:
+ KEYCLOAK_ADMIN: AgBWye/9Iav1llY6ZLWgL4to/75FMWvu21ploogsvNSQoig2vUxNO9e9wpfSf2I8CJDic0RStCI65nvBcJr7UhaV3WXvutbV2JBMgqF6VPGJh1BYu7UERzaBFdfYaV8foFJsLHW5RvPRGALhhiovvR2mjNgNtBdhyf6bmOss+lj/UxN66/vmdBu2PwCRmuyDCCnIbzQw/31KZjA2v9OZC4PLtFB6TTITsZmG6MN5fbz4QFk6TGXDPfYVuN3voFOn1uICcRsk2WY/4N3RYqlhF1vxO974rphuObnzwWOWzfg7dZRx0CdvtbGZsWG4LcMekUHO8mj4gFM1GmS0hkKfQnALattYtfo0Lo42FRFFRm4CSc07BkjW6a/JzEyeYDV+wcZtvcEhLG6UyF9m9eW12ukZyS3K7o/UH/8VR1Z+G65L8KlIpg9gjIXxGyX/cCSFRYt/OvWj5fjpstdAvgcHt4sTlMPaqQpeH3FflRb2VhhXhgBFaXYc0kjl1vDgSV/dCu1OhLcIg1Z4V+z1BAoPESd7syOC9OFxqFacIoK7Uz/vR7svkvFfJrm7Iamnf/CklwuO0BRZrL67Tf1anT4A/WCsFEd/Ha0j9PaxP8UptkfLkDPNICE1qbUkf/vFOQA6d7V2PC+HYkwLrpYnc0Y5ze8gTB4GlOUfQNXGZpaEI9EGguHA7YbAyIXHhyUyYBEeCptdd83u3gaff7RW6Avo/75qT/oiVgUX08eXqp8xo/DRCB/h6JKiAwbpgzADuA==
+ KEYCLOAK_ADMIN_PASSWORD: AgBkcJ8Y/h6hIP6OKMl25ryKcL2WTqvRmu6U1wUMvSzI5r+ZJxaMpYNisGgSSDdQmkLGhkMeRmHxfWVSRNSUb5YJ6Aw9MQRHEHXmDDRN8iBuLlpG/uB+rpuILdyKz4z8lxFVUw4ZYd/sR4ge8E+HADVokmFVHPGg+ZDchz7AJ+4qmp/Ey/TRPl47U8xWfLj1P8TpyZCqFgceFoNGLo7OCzhgFAeaiTU0sP2jc1NR0QS0kWK+NhOHZ24AvkQnZo2kPTWY3kFLbh6uz8N7gYif55CIbZSEyfp+OZyfBGzn4xNRe7i004/vDFWhGnAQdaAFDhlc6fHzwIUWTcNUR6E/aA0wX/8HmLKncNQ8UO6UIYOvak0UMT2GnVMkRYaqw2QEKrODbuPwoAJjdrrDxA/s97ZwOSa5iysisa562IMk/dKT6/k4jEdNH0h0PpD4ZE+MYLa8nDNn6yMGeoO4p22U03UjQLzyjMvxWfFLkLTyMy6ct8Lxp++xqm9g58K29dSvXpSxCa1382RjA7ocOqpa4Qy1y4gzVBBvVZLeTXyywqSu4bc3+ZBiAWy1SDadNyin28/krRQ4F7gK7BgzT0cHXPC3xIdI52hsf5Cg9FAZwXd9xBpAMHdkIbrD7/3LvC7FbwjdkqUVX7pjEXfqX0qUHRWjrYcomuRxiBwb+qtWWiqgcMWBiBoddwfdSQudeNHY770LSLtWzNK7j9kFaSDofJPoHdaAO9gP6MpDh03BBpILfmg0YhGp6KrsJDwlHA==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: keycloak-secrets
+ type: Opaque
diff --git a/.kontinuous/env/dev/templates/smtp.sealed.secret.yaml b/.kontinuous/env/dev/templates/smtp.sealed.secret.yaml
new file mode 100644
index 00000000..386ab60e
--- /dev/null
+++ b/.kontinuous/env/dev/templates/smtp.sealed.secret.yaml
@@ -0,0 +1,20 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: smtp
+spec:
+ encryptedData:
+ SMTP_USER: AgCtNiTWL+F2ywZRtxhFDIvdGk+/qZk/gZChvX3zGc3FqyWmPD37lOldwWMdWsT3mHh8JabZQzuG4JbJEI63Gkm/BZhwwLE7ETgay/nyIOSagr0Y4gedwcfSrxj9CGWnPZ3V6vXFmMbhuLnW6nhngNkToN+3+ZjXrLm9DPwRP6LxEo/EToN06Ep7z/0/zCyq/ocAuoYRIari1jLbppAbxQdNqmCtM56V9EvMN1MWtoBtW16Eirgwf5Vk5283g4JbCdkkKDku577Jl4qHjThOLE6Oanxmf2DhjnXvxBgr15P4kWdoWlRf4CtS2JzbFAOeuEaxDiYZkd9SpqpKJdD+6ehC0nquO/R70KLoHBp0w+LEfmc3Qns5svfDm05yEimwc6oANLWH1HE50clORENlwr3yhskjQb2c7nR8UqkdqNN9CLWIhWVftSYVkKSOPsQUFwtFYNfXw0SQSi5H787XV4oMAwvpzE5+nWD4nrjkkAUrgZB/P1uXCM67vNKFvHacZyzRahVlDdZzXx7hlwG9EFY3WNzFsNqDIvqIVDjU/QfxXityKIMNc8WU/20P9J0rrTjN70UoBnO1jy1nuAV9tga3yULiikUoVKyErlOPZji1c40dCuQa0NFOzhpoWWdk85sCYDoWSsALRqYJJqufUDTldWBeZuBgmGEwYstMY2uNNbvyPhA5yb112l0YHTD8uPhHmwfqB+9kwQFoyTf44oF9bnyOWY1L/tU7ZzR/j+dyRA==
+ SMTP_PASSWORD: AgAldT2Lys9V5J8O4Z8E45ke0BPrNNBWJ0ALBVQwpFZBjXiqhaTEPmoebUpYG5GLdKyjbP4Qy7SATESmRGvX9LOq85ylErpRjF4X1PaLHczkFGApJBcBdtdRF8c6vw+AS2hXfOMsY8a/hpx+CvBpUhFt9M9r4qRyuaUpi7Hn3w1kcr7mKxt4dPCJR4dY2Dz6PkO3k+1VPWR9FdNknaYmy+PuvMsQugIzisZlVf7X7vLb8bUAlEPooxUG96Px2EzVYv7G391f5l8/WMnrbjfsjnrBbs/Tp2+QRtsyu4f6KdyPvJkItkrR2Xizrdu1D93uMg8C30cBWZAP/0Tx2dh7glMR2ba3PEY0Q7F+ZK1Or1PScmcD6DpRCHXxbBCx619b9dhJMuslTFrMDf+macf5G8H/qsJUvugQnYEAsEBCw/rwO+BSyBSiyV3H+kgz9Sy2Y//nymZP66BD3bctZ/tjnkmqbPXgpU7NnZaKSe6uFkIp5OHzDZdUko545JThxNbjnD+Mc+LxhB2V+VkmQKHrrDWAEz3zQ1xxOMFp5CGjLQDYLG7Qcahm9DRINgcEp/lo2ghJXHNEH+JhulLoJn3KnldKQzg9uYw6uGs8FzhjS7j2jS0yVKQNl0Uy8ayWG1YLA3CldjkVTKqJqyyCB5WpGhuXLa26RhiwEYpkQZCPPxh44kyQgOQlhNVkuMtpJGSkkL5RrnqgWwsiBtdqciZmJoD7UTEFyWiWD+lDWB/xhAUsWg==
+ SMTP_HOST: AgAeDmXALosJO6zUJfFS368NcULX6QycNtLQbsXwSYGKk3J7VHdTgd55XJCRCDafsgSu3nLltSUPnAm4g9ck/bvVTwLFCc8FqYsxtE4mMn9RX5ZTYzaoWTGK/UiY2Vm7fg5QdiaLrQ6TxRT75RXd2NYL1CHp2grsZGihBnIOfPkc/Ma98dkaapPOjfvW58NNbdLh18eCVMP0xTCR1DHpiygIDZ0/H5wASQZEDxmpWpbJEj4eFTK9qNQwFbYL7kQJ8VGzrcLIkgkrUgeiRhVDt8nBDKG44FT+o9hBBX3yEzRM4oTmOoji8iU1OU5o9/XT+MMnD14SCSmLRyJohxtad7UFObCiYktsAy5UHM2Q2Ec2SERXbCYwiwNqDPX7Svlz8X2loVZNRQ8MPYAzvo+rwVRKH+R1X6djqw0VVdwaq//A73iWrTyd+PYUWUOtzerEtLLRdEtey/Jt1w1kwVQKpe4awLad3zdyr3sEm5/i1RKtKdB5vEj0bCZpCqdHYcOrjLvyF3bKb6mKClhuaRqWAce5LgpnMsJOU2PRgaoiolaJxzOs8/d2yDGUND+jdMDluOaG/OqfwtTS/S8WmiaMYLAkypGCk1SvjLXZmGnLkCT7vpdMskIO2YzjSZHTbHk78R+L3Zp+Z0R1F2AG0Sa2rYHcUf1wyeGiS8YVPer9YJDP5fyiFpQN8YiZLFamAGiM/TS7neNvXhobwM/4wyc8gjjKpQ==
+ SMTP_PORT: AgBtKRelkMjrFkfvsQZjYBK+51a3gz1PEopnHf3JNtWAiVRpIG6ktCFFE+0zQFb83FTpgpsXdttfZ+qnmEGJUchyAj0NqEbERkLgSz0chOPp7Ov3aI/iMiS1e9Z6GnGP6j9npUPWzkTS2VJBTIFCqWNMYI2x9viX7TeKXAs7G5EtaWWHv1bxTdv8gfLao7GkFcfjl1WWlN1jbYDbAyp40LfJ/VamwoYW8PNjn2O3XhXfEJGn5261zlvDvCgtzizWHafWCXH5Y0GCAh5ryDc6V6Yop21QGlARdg0Aoj6Fm6gryNzf2JGHBppYQHYTpx2dtJbH2DTxfc5R2uuozIboiYsbTZmeKXy5HXzWO/feUMVk33nPErX7qZZp5ydOXK2qI6225oIrEsZDPYfBGiQwyk/iYSLW9NNW4bNDW6+4GlYuR5MwOzjUmerguIV0Xvt8jnHF4Ak/DZ1P/qa9GvvzNWh4VIo27c5hEGt8Tn9zhqDs6xEv120kyQyYK42HXCvzgnYBo7KJViKigSUiT5GiaDL1wQXVvnfi38AW04Uy/3I9Uyb5N/Ij1yObrtk+sYcFIS2g9njmfDYkhfg8UAfc5AjK+VUtJCZ8i3xhRX/gNO4W0/EUU6gsn0vh9D9HwuhO+u/gsQlslKuJpiO7fS03bIgGGE820InTaoJgPKVelr9vztOvNMWVOZSzd1Z6cqLWuva08Ns=
+ SMTP_FROM: AgCrI5KJy3W+jd1pa0oIX9JoHIGFJqvqMHzh4WnTFW5gT6Sket0ur0ocWWop+FQwwZvEfxtRBnITVYOiqmx9WWk5NQyX61bj+JYcv83m29vdUyG2E7JNvX3jUY/KGOnd/yrrG5xLGZXjYOCwAXn+diSmaeMD2K4NW75hrECUf4ljrqFz2tZCSQ6i7YrwO5SnhcspRydJzS+tm5WXKyP/NiE6tF44L8FlNVYXv8c5+Mg4irnE5lVOtZfix8rt0lWr45uUxPdOsHN8WOUiJCRKL+SHlsMWR0eJC/wzf9SCCiB6UZc1nmOz4IBFYMYjALfZ78P/71Vy6j/TGs07Nf2fCn6EyU/hT1yhVRYRqmx3fpqKFUjmtmMNdHo0Dt3hlBj15Y5EFg7VQRziN7oswVzFKzCRWSUu1Z29NgnCUxtDJuFpXpv/m4EyR8KS/0AcPYX7UiqKiJpFe2O/6PCpcDPBB5PgaWOgeoaaVagvxoSGe0EuRDsf0i7CbkHb4hMgz1nrLWwHzRzm5hDnrmEiqjMfJ9gURpunLDKG+nnKB5IcvwWELVhlzvQv7LC9RPNAQlPkcmYNokZeP43dQjB1y/94m+tMm7HdZyeFr5wQvzqONi0U6QnFDhVke0o/FhoWAyMm+UCWS/7rw6TMaSOmWHURIj/dKXlxRtwvmSYp7NcCW4nHaJbQKt260pWrIDm3AhEG4fOhCbvmnk4ccYBXCV31byXEwWSfkzmEsJ3VPatp0p8O
+ SMTP_SSL: AgDJiC/Ji50KcRv64cvKmln1vqIAz5Zt3f3/9S+eEGZQD8fznYIp0JKSsitTXeoHNP268g+AKH+TuEr8y6H2pB/rfv3bwjjxc1cECOkPzg/Vn9AaSpMC/j2mfEi8Zsvuc6NlK2PxtFj9CETRBD7iMbOhQvegmeEcfGEoW4pVe3Xygm22Z3wbrstkDtpcn/oO6f24CfZU0RLmjqi4RPsBXiDSjruJt9gi5tmV7vR1OVzNx0dns/u3uPbwwYPGWTUnJahXiOdVNMm6Ul3HgjygvPra+SUyj2rkZQ80snMB6E2zTZaC7Oqrk1kIOlPv0XTr9Zzk+Z4ZyXocCa3DsNNaMmiVtQ9e3m7YFfonr9yND3BBgs0xtsuGx+TU7gzxeCyFpeHeKfXFYR+RY+eO0CO5uXrFEcblBPRuUW77toGwaRCdrXpj/2TlQmXhROQn/KcLWxj3e1sksjw8i7LlccP34Lo17GWXReMReyLT/B7rfmfgj7bewCdN6b72K73nVCeUosYTm3Dx3/OCHhQURbYuELb5ayXypLklEvFCk+pEjzjWS7Z/5o6qLd1gFFRgH5kZ0LyRtNvc2T9RF+LudyNySFny9qSTIGSLnv2IUXvfFQJ1Pk0JGI00oimEjrv1VxEPWqLEgSkONxmVwomVggubrpc5s2StoorwmFtbaCYOmdFozzVA3wl/imKZp5UnTdgbWuGcg1tdfg==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: smtp
+ type: Opaque
diff --git a/.kontinuous/env/dev/values.yaml b/.kontinuous/env/dev/values.yaml
new file mode 100644
index 00000000..07d38617
--- /dev/null
+++ b/.kontinuous/env/dev/values.yaml
@@ -0,0 +1,41 @@
+jobs:
+ runs:
+ build-app:
+ use: SocialGouv/kontinuous/plugins/fabrique/jobs/build@v1
+ with:
+ imageProject: fabrique
+ imageRepository: template
+ imagePackage: app
+ registrySecretRefName: harbor
+ buildArgs:
+ NEXT_PUBLIC_APP_VERSION_COMMIT: "{{ $.Values.global.sha }}"
+ db-keycloak:
+ use: SocialGouv/kontinuous/plugins/fabrique/jobs/create-db@v1
+ with:
+ pgAdminSecretRefName: pg-scaleway
+ pgSecretName: "keycloak-db-{{ .Values.global.branchSlug32 }}"
+ database: "keycloak_{{ .Values.global.branchSlug32 }}"
+ pgUser: "keycloak_{{ .Values.global.branchSlug32 }}"
+
+keycloakx:
+ needs: [build-app, db-keycloak]
+ #statefulsetAnnotations:
+ # kapp.k14s.io/change-rule: "upsert after upserting kube-workflow/db-keycloak.{{ .Values.global.namespace }}"
+ extraEnvFrom: |
+ - secretRef:
+ name: "keycloak-db-{{ .Values.global.branchSlug32 }}"
+ - secretRef:
+ name: keycloak-secrets
+
+jobs-deactivate:
+ enabled: false
+ runs:
+ deactivate:
+ use: SocialGouv/kontinuous/plugins/fabrique/jobs/deactivate
+ with:
+ pgAdminSecretRefName: pg-scaleway
+ drop-db:
+ use: SocialGouv/kontinuous/plugins/fabrique/jobs/drop-db
+ with:
+ pgAdminSecretRefName: pg-scaleway
+ database: "keycloak_{{ .Values.global.branchSlug32 }}"
diff --git a/.kontinuous/env/preprod/templates/app.configmap.yaml b/.kontinuous/env/preprod/templates/app.configmap.yaml
new file mode 100644
index 00000000..331089f0
--- /dev/null
+++ b/.kontinuous/env/preprod/templates/app.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: app
+data:
+ NEXT_TELEMETRY_DISABLED: "1"
+ KEYCLOAK_URL: "https://keycloak-{{.Values.global.host}}/realms/app-realm"
+ NEXTAUTH_URL: "https://{{.Values.global.host}}"
diff --git a/.kontinuous/env/preprod/templates/app.sealed.secret.yaml b/.kontinuous/env/preprod/templates/app.sealed.secret.yaml
new file mode 100644
index 00000000..1e62276f
--- /dev/null
+++ b/.kontinuous/env/preprod/templates/app.sealed.secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: app
+spec:
+ encryptedData:
+ NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
+ KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO
+ KEYCLOAK_CLIENT_SECRET: AgC2BgDwrXwWXYrpvHDh5vZZMLMNIdebcvWQzxrJE89WlkTAzh70JuKPXKW1s0Aj41xc1Cx00mvUSeEw+EnVmpvxyn6AZxPBCJsVYfZtK5Cd+qzlbwe1r7vAgOgUDEKCEVPGDUesxmaEQwLTW78vkhFTBiOMWhKAew8LBA0y9DIV+CQvAOCEZcB5J5jP1OEmaeZiwOdBbOVyk/s1Qbx1YmmhgMAMAAPlnURIbMAH+RjaQi6/BU4tS+hPEdQZ5yqm4wk63PFgxi1U3GaRYqDP2eVaPyBzu8A9AvR3YLOynw3yMAxFEgfBrtuykZt4X10hu8dRYGe9JSsbonOd9PlZirnknlnifTF/99lzQq074Dhd1rpjNVvnbTM0PmyxpXAD0Ydf7CTvZoeD/dQNTEzafkr5HpiS9X1788a+0VsAWVS2ux/4V/khS0pkoExZWsxFfQVlNRkMKyR7N5fFRS2VOEAzomOqMdjcf2iaizWdDd0YkQF6LTjLs87nrJaIJSLccpAUy7lPxKs9+pRuqpay61+V54tcv2vwhZHlOc7JFxY6NgCvz07UaI665koa/67TdbSjYww/NfqhJdf/8ybtcN85Yu+SzU0l89Z0AwMnH7rDP9Pwv2OW+MWn8eDqu1E4/duCAxhKMS/sjPHHU83CFM6Ycd9MXA6e+HlLQBEPBV/08KLynhtAycotMraUQ9hmU4HrBDJqmZFtpO/ZUW9CP1gZ0ZsFyv2r2qyUUqvIyFLbUA==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: app
+ type: Opaque
diff --git a/.kontinuous/env/preprod/templates/franceconnect.sealed.secret.yaml b/.kontinuous/env/preprod/templates/franceconnect.sealed.secret.yaml
new file mode 100644
index 00000000..e31d16b4
--- /dev/null
+++ b/.kontinuous/env/preprod/templates/franceconnect.sealed.secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: franceconnect
+spec:
+ encryptedData:
+ FRANCE_CONNECT_CLIENT_ID: AgCbLEqJcxaUphThDCEtuwLv6tGCVWn5pGADStG7x+yx7w2OQ2Ucdr9srt7Zev5GH4RIu+t3WY/LEcNXkxnJWraPYPsON5iQ0zj8R2UJIpv/kmLixOTaeLxBODknpSoVSUehOKCHVtqggLCTVPAJNSJgR2cDebW3bH8w9uvAgX1fXu0weLIjm5q815iwbeQmkEXejkWuGYALfwa08YlexbMmTg/HDGNl7T843XGZjNbPO4rRwfjEAYkA30WxJ7hSxOhqZTDBJT/agWoxei5QvNykm/wU88pr6Ume7wmMGG/vizWfRweXkiGuWF687Nt1xq+SEAGK/GZuujHIp3VbHPI0CIfjU0NrTK4qpCp7bDl3rdvdzx6a5ubNjhv0Z3dwF+Y1UFyB5NIWkpJn8qxa060I5fFWbvw4xe7kJTufx8jVL7h8HQK1iCw2DEhx4M3L0KslpNby6OFSUINTdZhDbj9/l5tBMrxbtxsnubxbuUvCBSurI6iNUrEXu4pruaN4VautwkN1M1EHMtMxE+PzpoV61GMdGwZmrfZzOrLYYXdKaCAcRNAGOo156wapdk7QBNqK6GrbGbsaIJo0QruVebPS36rmgsc+0JDKYruIvcA94wkbzvScy0RwiSpfqBhcUHZXq2dCRhgrkJnFfXJbpKziVGcvQmMYPQEH78jJgzswdoK2tCZnxg4jXSJv6pn+2BWmAAMvMRXT3Zb+styCVkODPwcgvIcl6h9VgaTyc4Tu+kjKkHvQS6Age0/9M0W5Z9/4ngzJQNzDxl0PU+oGckiJ
+ FRANCE_CONNECT_CLIENT_SECRET: AgAq5ZXB3fz9RjjI/bE0I92LcxwNTVih56O8n7xxoxzea10nsV+6Tu76vjE8znLw71QobQeLnuoI61WcSl1f0NBQwl5fIGDSRjCgSUAz1+2T4NF7Q1b9wqIsAsC4dvMMSiNF19P+4/galSbwxJ5qWVjmYt3iC3hBrgs1nuaFVDUlo1X9Qwi9eutFnjesZIcT4WnlU7onSlTQgmshUUfc2IBcgLYWftl35dhIvXKifka2tUTiCsJkLjfmOrKYtfOfw1a4MOCn74LMhzoZNAUFHwlJRZTw+PbAWFKz+Z/5wvEDB1pevU8j5Kdg6qgCwrExCsHFGxsg46Io6HChH0ktIWxaPV7U1Xx0h8VxOo2VgStQq1pWEy3hq3BVxiVGTgywhPtwWhJWWlFCcrnO7Za9nZtYmtM+DSUlbrGQdSK9Z1U5kpeJdLpNe72oPZ/hJ5Fl6i4kO6iH6xDnKfgjZpU1OeL9tpa5Dpujp+chQNFVI8+7nZY389Z53NxGEMMRWS42JH0N+yejtVZsHipfo9s/Y4TdaR7cjoKHnvHi+rVo8TI3NwwEvQBRmT2dHX1XXOz5O4hx30gy3XHqCYaX5i9evXexy5xRXL3lpQqfx3VmFf7eJEC/AJrvdMxwhDnzaq2lxjgRfx38ty5wKy+EFvsBFAf0hKtnmlwO0Vpz78Zuj5t+GeJ4exYHwUA7NVwOVzqbwwsZctM7kTNc99DxSg68MsSDsZcXiWhNL5J9PowD38fG/fXHiOpb3TxSSwVTIR7OzozZ3fYpRQ6gbgQiFOHnSZmk
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: franceconnect
+ type: Opaque
diff --git a/.kontinuous/env/preprod/templates/keycloak.sealed.secret.yaml b/.kontinuous/env/preprod/templates/keycloak.sealed.secret.yaml
new file mode 100644
index 00000000..d903ca31
--- /dev/null
+++ b/.kontinuous/env/preprod/templates/keycloak.sealed.secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: keycloak-secrets
+spec:
+ encryptedData:
+ KEYCLOAK_USER: AgBWye/9Iav1llY6ZLWgL4to/75FMWvu21ploogsvNSQoig2vUxNO9e9wpfSf2I8CJDic0RStCI65nvBcJr7UhaV3WXvutbV2JBMgqF6VPGJh1BYu7UERzaBFdfYaV8foFJsLHW5RvPRGALhhiovvR2mjNgNtBdhyf6bmOss+lj/UxN66/vmdBu2PwCRmuyDCCnIbzQw/31KZjA2v9OZC4PLtFB6TTITsZmG6MN5fbz4QFk6TGXDPfYVuN3voFOn1uICcRsk2WY/4N3RYqlhF1vxO974rphuObnzwWOWzfg7dZRx0CdvtbGZsWG4LcMekUHO8mj4gFM1GmS0hkKfQnALattYtfo0Lo42FRFFRm4CSc07BkjW6a/JzEyeYDV+wcZtvcEhLG6UyF9m9eW12ukZyS3K7o/UH/8VR1Z+G65L8KlIpg9gjIXxGyX/cCSFRYt/OvWj5fjpstdAvgcHt4sTlMPaqQpeH3FflRb2VhhXhgBFaXYc0kjl1vDgSV/dCu1OhLcIg1Z4V+z1BAoPESd7syOC9OFxqFacIoK7Uz/vR7svkvFfJrm7Iamnf/CklwuO0BRZrL67Tf1anT4A/WCsFEd/Ha0j9PaxP8UptkfLkDPNICE1qbUkf/vFOQA6d7V2PC+HYkwLrpYnc0Y5ze8gTB4GlOUfQNXGZpaEI9EGguHA7YbAyIXHhyUyYBEeCptdd83u3gaff7RW6Avo/75qT/oiVgUX08eXqp8xo/DRCB/h6JKiAwbpgzADuA==
+ KEYCLOAK_PASSWORD: AgBkcJ8Y/h6hIP6OKMl25ryKcL2WTqvRmu6U1wUMvSzI5r+ZJxaMpYNisGgSSDdQmkLGhkMeRmHxfWVSRNSUb5YJ6Aw9MQRHEHXmDDRN8iBuLlpG/uB+rpuILdyKz4z8lxFVUw4ZYd/sR4ge8E+HADVokmFVHPGg+ZDchz7AJ+4qmp/Ey/TRPl47U8xWfLj1P8TpyZCqFgceFoNGLo7OCzhgFAeaiTU0sP2jc1NR0QS0kWK+NhOHZ24AvkQnZo2kPTWY3kFLbh6uz8N7gYif55CIbZSEyfp+OZyfBGzn4xNRe7i004/vDFWhGnAQdaAFDhlc6fHzwIUWTcNUR6E/aA0wX/8HmLKncNQ8UO6UIYOvak0UMT2GnVMkRYaqw2QEKrODbuPwoAJjdrrDxA/s97ZwOSa5iysisa562IMk/dKT6/k4jEdNH0h0PpD4ZE+MYLa8nDNn6yMGeoO4p22U03UjQLzyjMvxWfFLkLTyMy6ct8Lxp++xqm9g58K29dSvXpSxCa1382RjA7ocOqpa4Qy1y4gzVBBvVZLeTXyywqSu4bc3+ZBiAWy1SDadNyin28/krRQ4F7gK7BgzT0cHXPC3xIdI52hsf5Cg9FAZwXd9xBpAMHdkIbrD7/3LvC7FbwjdkqUVX7pjEXfqX0qUHRWjrYcomuRxiBwb+qtWWiqgcMWBiBoddwfdSQudeNHY770LSLtWzNK7j9kFaSDofJPoHdaAO9gP6MpDh03BBpILfmg0YhGp6KrsJDwlHA==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: "true"
+ name: keycloak-secrets
+ type: Opaque
diff --git a/.kontinuous/env/preprod/templates/smtp.sealed.secret.yaml b/.kontinuous/env/preprod/templates/smtp.sealed.secret.yaml
new file mode 100644
index 00000000..14b6ecc3
--- /dev/null
+++ b/.kontinuous/env/preprod/templates/smtp.sealed.secret.yaml
@@ -0,0 +1,20 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: 'true'
+ name: smtp
+spec:
+ encryptedData:
+ SMTP_USER: AgCtNiTWL+F2ywZRtxhFDIvdGk+/qZk/gZChvX3zGc3FqyWmPD37lOldwWMdWsT3mHh8JabZQzuG4JbJEI63Gkm/BZhwwLE7ETgay/nyIOSagr0Y4gedwcfSrxj9CGWnPZ3V6vXFmMbhuLnW6nhngNkToN+3+ZjXrLm9DPwRP6LxEo/EToN06Ep7z/0/zCyq/ocAuoYRIari1jLbppAbxQdNqmCtM56V9EvMN1MWtoBtW16Eirgwf5Vk5283g4JbCdkkKDku577Jl4qHjThOLE6Oanxmf2DhjnXvxBgr15P4kWdoWlRf4CtS2JzbFAOeuEaxDiYZkd9SpqpKJdD+6ehC0nquO/R70KLoHBp0w+LEfmc3Qns5svfDm05yEimwc6oANLWH1HE50clORENlwr3yhskjQb2c7nR8UqkdqNN9CLWIhWVftSYVkKSOPsQUFwtFYNfXw0SQSi5H787XV4oMAwvpzE5+nWD4nrjkkAUrgZB/P1uXCM67vNKFvHacZyzRahVlDdZzXx7hlwG9EFY3WNzFsNqDIvqIVDjU/QfxXityKIMNc8WU/20P9J0rrTjN70UoBnO1jy1nuAV9tga3yULiikUoVKyErlOPZji1c40dCuQa0NFOzhpoWWdk85sCYDoWSsALRqYJJqufUDTldWBeZuBgmGEwYstMY2uNNbvyPhA5yb112l0YHTD8uPhHmwfqB+9kwQFoyTf44oF9bnyOWY1L/tU7ZzR/j+dyRA==
+ SMTP_PASSWORD: AgAldT2Lys9V5J8O4Z8E45ke0BPrNNBWJ0ALBVQwpFZBjXiqhaTEPmoebUpYG5GLdKyjbP4Qy7SATESmRGvX9LOq85ylErpRjF4X1PaLHczkFGApJBcBdtdRF8c6vw+AS2hXfOMsY8a/hpx+CvBpUhFt9M9r4qRyuaUpi7Hn3w1kcr7mKxt4dPCJR4dY2Dz6PkO3k+1VPWR9FdNknaYmy+PuvMsQugIzisZlVf7X7vLb8bUAlEPooxUG96Px2EzVYv7G391f5l8/WMnrbjfsjnrBbs/Tp2+QRtsyu4f6KdyPvJkItkrR2Xizrdu1D93uMg8C30cBWZAP/0Tx2dh7glMR2ba3PEY0Q7F+ZK1Or1PScmcD6DpRCHXxbBCx619b9dhJMuslTFrMDf+macf5G8H/qsJUvugQnYEAsEBCw/rwO+BSyBSiyV3H+kgz9Sy2Y//nymZP66BD3bctZ/tjnkmqbPXgpU7NnZaKSe6uFkIp5OHzDZdUko545JThxNbjnD+Mc+LxhB2V+VkmQKHrrDWAEz3zQ1xxOMFp5CGjLQDYLG7Qcahm9DRINgcEp/lo2ghJXHNEH+JhulLoJn3KnldKQzg9uYw6uGs8FzhjS7j2jS0yVKQNl0Uy8ayWG1YLA3CldjkVTKqJqyyCB5WpGhuXLa26RhiwEYpkQZCPPxh44kyQgOQlhNVkuMtpJGSkkL5RrnqgWwsiBtdqciZmJoD7UTEFyWiWD+lDWB/xhAUsWg==
+ SMTP_HOST: AgAeDmXALosJO6zUJfFS368NcULX6QycNtLQbsXwSYGKk3J7VHdTgd55XJCRCDafsgSu3nLltSUPnAm4g9ck/bvVTwLFCc8FqYsxtE4mMn9RX5ZTYzaoWTGK/UiY2Vm7fg5QdiaLrQ6TxRT75RXd2NYL1CHp2grsZGihBnIOfPkc/Ma98dkaapPOjfvW58NNbdLh18eCVMP0xTCR1DHpiygIDZ0/H5wASQZEDxmpWpbJEj4eFTK9qNQwFbYL7kQJ8VGzrcLIkgkrUgeiRhVDt8nBDKG44FT+o9hBBX3yEzRM4oTmOoji8iU1OU5o9/XT+MMnD14SCSmLRyJohxtad7UFObCiYktsAy5UHM2Q2Ec2SERXbCYwiwNqDPX7Svlz8X2loVZNRQ8MPYAzvo+rwVRKH+R1X6djqw0VVdwaq//A73iWrTyd+PYUWUOtzerEtLLRdEtey/Jt1w1kwVQKpe4awLad3zdyr3sEm5/i1RKtKdB5vEj0bCZpCqdHYcOrjLvyF3bKb6mKClhuaRqWAce5LgpnMsJOU2PRgaoiolaJxzOs8/d2yDGUND+jdMDluOaG/OqfwtTS/S8WmiaMYLAkypGCk1SvjLXZmGnLkCT7vpdMskIO2YzjSZHTbHk78R+L3Zp+Z0R1F2AG0Sa2rYHcUf1wyeGiS8YVPer9YJDP5fyiFpQN8YiZLFamAGiM/TS7neNvXhobwM/4wyc8gjjKpQ==
+ SMTP_PORT: AgBtKRelkMjrFkfvsQZjYBK+51a3gz1PEopnHf3JNtWAiVRpIG6ktCFFE+0zQFb83FTpgpsXdttfZ+qnmEGJUchyAj0NqEbERkLgSz0chOPp7Ov3aI/iMiS1e9Z6GnGP6j9npUPWzkTS2VJBTIFCqWNMYI2x9viX7TeKXAs7G5EtaWWHv1bxTdv8gfLao7GkFcfjl1WWlN1jbYDbAyp40LfJ/VamwoYW8PNjn2O3XhXfEJGn5261zlvDvCgtzizWHafWCXH5Y0GCAh5ryDc6V6Yop21QGlARdg0Aoj6Fm6gryNzf2JGHBppYQHYTpx2dtJbH2DTxfc5R2uuozIboiYsbTZmeKXy5HXzWO/feUMVk33nPErX7qZZp5ydOXK2qI6225oIrEsZDPYfBGiQwyk/iYSLW9NNW4bNDW6+4GlYuR5MwOzjUmerguIV0Xvt8jnHF4Ak/DZ1P/qa9GvvzNWh4VIo27c5hEGt8Tn9zhqDs6xEv120kyQyYK42HXCvzgnYBo7KJViKigSUiT5GiaDL1wQXVvnfi38AW04Uy/3I9Uyb5N/Ij1yObrtk+sYcFIS2g9njmfDYkhfg8UAfc5AjK+VUtJCZ8i3xhRX/gNO4W0/EUU6gsn0vh9D9HwuhO+u/gsQlslKuJpiO7fS03bIgGGE820InTaoJgPKVelr9vztOvNMWVOZSzd1Z6cqLWuva08Ns=
+ SMTP_FROM: AgCrI5KJy3W+jd1pa0oIX9JoHIGFJqvqMHzh4WnTFW5gT6Sket0ur0ocWWop+FQwwZvEfxtRBnITVYOiqmx9WWk5NQyX61bj+JYcv83m29vdUyG2E7JNvX3jUY/KGOnd/yrrG5xLGZXjYOCwAXn+diSmaeMD2K4NW75hrECUf4ljrqFz2tZCSQ6i7YrwO5SnhcspRydJzS+tm5WXKyP/NiE6tF44L8FlNVYXv8c5+Mg4irnE5lVOtZfix8rt0lWr45uUxPdOsHN8WOUiJCRKL+SHlsMWR0eJC/wzf9SCCiB6UZc1nmOz4IBFYMYjALfZ78P/71Vy6j/TGs07Nf2fCn6EyU/hT1yhVRYRqmx3fpqKFUjmtmMNdHo0Dt3hlBj15Y5EFg7VQRziN7oswVzFKzCRWSUu1Z29NgnCUxtDJuFpXpv/m4EyR8KS/0AcPYX7UiqKiJpFe2O/6PCpcDPBB5PgaWOgeoaaVagvxoSGe0EuRDsf0i7CbkHb4hMgz1nrLWwHzRzm5hDnrmEiqjMfJ9gURpunLDKG+nnKB5IcvwWELVhlzvQv7LC9RPNAQlPkcmYNokZeP43dQjB1y/94m+tMm7HdZyeFr5wQvzqONi0U6QnFDhVke0o/FhoWAyMm+UCWS/7rw6TMaSOmWHURIj/dKXlxRtwvmSYp7NcCW4nHaJbQKt260pWrIDm3AhEG4fOhCbvmnk4ccYBXCV31byXEwWSfkzmEsJ3VPatp0p8O
+ SMTP_SSL: AgDJiC/Ji50KcRv64cvKmln1vqIAz5Zt3f3/9S+eEGZQD8fznYIp0JKSsitTXeoHNP268g+AKH+TuEr8y6H2pB/rfv3bwjjxc1cECOkPzg/Vn9AaSpMC/j2mfEi8Zsvuc6NlK2PxtFj9CETRBD7iMbOhQvegmeEcfGEoW4pVe3Xygm22Z3wbrstkDtpcn/oO6f24CfZU0RLmjqi4RPsBXiDSjruJt9gi5tmV7vR1OVzNx0dns/u3uPbwwYPGWTUnJahXiOdVNMm6Ul3HgjygvPra+SUyj2rkZQ80snMB6E2zTZaC7Oqrk1kIOlPv0XTr9Zzk+Z4ZyXocCa3DsNNaMmiVtQ9e3m7YFfonr9yND3BBgs0xtsuGx+TU7gzxeCyFpeHeKfXFYR+RY+eO0CO5uXrFEcblBPRuUW77toGwaRCdrXpj/2TlQmXhROQn/KcLWxj3e1sksjw8i7LlccP34Lo17GWXReMReyLT/B7rfmfgj7bewCdN6b72K73nVCeUosYTm3Dx3/OCHhQURbYuELb5ayXypLklEvFCk+pEjzjWS7Z/5o6qLd1gFFRgH5kZ0LyRtNvc2T9RF+LudyNySFny9qSTIGSLnv2IUXvfFQJ1Pk0JGI00oimEjrv1VxEPWqLEgSkONxmVwomVggubrpc5s2StoorwmFtbaCYOmdFozzVA3wl/imKZp5UnTdgbWuGcg1tdfg==
+ template:
+ metadata:
+ annotations:
+ sealedsecrets.bitnami.com/cluster-wide: 'true'
+ name: smtp
+ type: Opaque
diff --git a/.kontinuous/env/prod/templates/app.configmap.yaml b/.kontinuous/env/prod/templates/app.configmap.yaml
new file mode 100644
index 00000000..331089f0
--- /dev/null
+++ b/.kontinuous/env/prod/templates/app.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: app
+data:
+ NEXT_TELEMETRY_DISABLED: "1"
+ KEYCLOAK_URL: "https://keycloak-{{.Values.global.host}}/realms/app-realm"
+ NEXTAUTH_URL: "https://{{.Values.global.host}}"
diff --git a/.kontinuous/env/prod/templates/app.sealed.secret.yaml b/.kontinuous/env/prod/templates/app.sealed.secret.yaml
new file mode 100644
index 00000000..1f199bdb
--- /dev/null
+++ b/.kontinuous/env/prod/templates/app.sealed.secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations: {}
+ name: app
+ namespace: template
+spec:
+ encryptedData:
+ NEXTAUTH_SECRET: AgBiEd0sy4cmpgNv3+FgBvCm880l30ZYaUk+E564m4Sc+NEiHGzxrfoAgHkjsVnj+1wcqmLRnu5khXTEXPG0a4x3BYfEfxEMu77PszBoAnxfpRqGFER34+adSt0FlT+0gHwxnmDiyBoN37DguEi78j51SWINTcdswaCBF8n5amYAoZwr4eISU08JqDg/W/cCMQNlCFWIzbFY2RGOlsAOzdw52l2yXEHooz9JX+ZNSfCQpj02LRnAOtE3CQobLNSggRaaasuRwJniddvbgsTLfH80hp915UpHdwCla6W5cSsDpiEk+K+L/Mat5ghXcY70jrfFNEMGLhDYUO6e+g47sj8yqcCkq9HD95iA59ur+O/CuChwly2PDsQ0if9U2IBrlSy5eShmNqv6V4knxqa9Uc286F+SPiA29vHK42TNum3CZyxJG7ZJugteTIJyQnbJcF/M7rOPpx1hzkHVBFto5w9ENB3qdMfWYteRHtSEOFyHxqbEOicvKxRX5bl7jKcSpdiXTvj+rFZbbnAxDj97J2qq4JGBBr/FCJzFJZrfywRs+HiTbveZjfbPaLYL6DmKNMPMbj7lZlvmnsXqFpidWJsmTkPRqilltypHWZsml59T0whEVgFlRNzqygCcdFKK+HS6YdPZyXVyMYAaSunc3T3ISXsiL4MPiBz83gyq8Zzc0OXyZOB3ewM2G3k4kjKGJLFMUD7hLRqEEoWHAHZaaCfwgkLYriL4nPvBmqCrR34oOrTOOGuYwnzeV82daQ==
+ KEYCLOAK_CLIENT_ID: AgCDnaDRZORXdjgk0i1M+v5m6k4Mhckw9r66j0yTjV1wDCKTOHqQXeMukLqm0yxofmNrowbluMv/OMx1I8IWeu+q0aP8YVFSXhTxOIJ4B8FiBlV1pBdEgMq8oGZY8offfuIZ8Iwy5pOXv5HiGb/boy4zGoRyigQNbG6ly++5SMKjbpWgLIRGGD1OwDau5okprXFvSI6qDYK5NJtNuY5TcRjznH5vtOKnrlyTnpnrmFBbo3t/pVsuFZJZDmGZX1021aNhGr2cYIX2yooPfJR8OxSE6YTFzTavg+M6TDSUO6oWFsuPhB5l28SAJ0i224lDtqMVmKrNbcC4y/oK4oURgXeeclr52++PHkOTvgFj9nWFALOuKtwglN/8lGUZ4wRkNKYDJMmXI1XtePA39Rs8sDVtTAVUUs6Nrt+8rVLqTEwkLczkqmCxImQRCWSTQPn8idm2rmoNuBvtOjE1NK3udPrgJn8p2T0ikV6HxI0ZD8ATYKuAxDvUzNsMZCcFLcJRsewodxHdy70R287FXpFF7XW33+AnKYwcO7shvgvRU92tScrhS2U9RjjKCU4oHFvnbyQgSuxduqsy1b4DYEAz0L+S5dhCmfHLIyWzZnJXlGffqUjQCHC3L1qqwhcYeIl9v5YS85S0g01nTCYPwLzf7VVehtEfYIWyX5x4S/zDboybNBTz6t15nqBpOibp1+0xtUVr9OScVffVb06Y
+ KEYCLOAK_CLIENT_SECRET: AgBL1MiUBlFdcVdPay6PiBkHeW2aDSIynYbdOJ6uvTfKJg8G2JUSjvn8n/Q0Eq6DJJ5MyxjucExmSivX0TVwuaWCI8GyT1lNcsiKAALcwFD13jqFiRkFN5E+xHp5QoYLs8xOb7vTlBf/dsjnl6qkOMTAecPRGGpZBxVJ11Z+4y5NmohR8BFmqNKjPP3bydlfJpdPp45z/huJmfXOhafx3x+yu8LcOndAjMqwfYuKT8GgNOcJ/BIJHv3r7zuDmWcuSUWUYIfJSgJiDYbFvTGvJ7+HN9e4B7up9A/3CveCLR265AVvZ91c4anPuQNh0RZqHbxcPPUIRsk4z1c+ZJVJKE0xWGnMk7Vcy6KNYPv0oHguHFDtvqFM2ySpN3BE8FxhtYAuVX4ail0qCbU3RlHwG/nV+uVYRoHXskuQ0D/E1OWm4HUFccKvxfmL6mwD/x6p3ksNXGBCIsEDqxwQ5c2Rr2xDsozrFkS1Gd/9AJVTnoZLz0VsYue9UY5aDMGeywP6Pne9pNYcuZy7zbPVvqF1J5zDyPppw9ALuI/pIEGl+g79BaxdKEI/JbkpeEJBCdESytpVQKpnH0wiekKTEWuakZ8tgvqWnX+8/PPIzjCeZJ3CaziGy45C+14hicvLZBjsE/W/2sqasuFoUWKs1WduMs8G8RgRyhtrrj0RMokjvCSfoKFj6KVaR3jcgtCrH1aGO3wFZQkyBGq80k7SpLZmI3TVOKQvASNjOzFFC+iQcVPpRg==
+ template:
+ metadata:
+ annotations: {}
+ name: app
+ type: Opaque
diff --git a/.kontinuous/env/prod/templates/franceconnect.sealed.secret.yaml b/.kontinuous/env/prod/templates/franceconnect.sealed.secret.yaml
new file mode 100644
index 00000000..4cfd8c1d
--- /dev/null
+++ b/.kontinuous/env/prod/templates/franceconnect.sealed.secret.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations: {}
+ name: franceconnect
+ namespace: template
+spec:
+ encryptedData:
+ FRANCE_CONNECT_CLIENT_ID: AgAcmx6FhrRwRSxkzlYXz2CZ+GFt2OPDRc2ESclEWM8Gu2qdZosGX61XqqOKGdwHFcBnqyghkYvWe0xirYGhhwo3XSkiXtoGqkfLxCtL5DMvYeTBqZBUffth4EauuTRVAkl425JhQVZ2dQJR/VNiT4ivP1m2jVdaakWiuHQm4g+f2zO9alNWbUHPBevZwwTl9LWjJON2FN4DYNKdzFOxZ8P5dmaWRT077agHj27ckOql21zItFRPbGSzNya0FnjqWbgyB4rRA3BJEQOcnmgRonGst1WzlBefV0GSAUJBZTsOYyByUHrBayG+e2eBo+5zICfz4cj29NrU5lhMN1lyn3j8PQzMXejmUo6KRTnrco85UaKbjK3ZdrchbcpzDm8X9Cz9m2SR47lMMYoOngCBB3LRdmKwflL+gafvHeZ0gVdQt8GMxv+BdqWR5JBR15IDX1abeySmJ9/oqNOUFdHpcbRKYvd4VfF4WUmJn7KaBH/Zpc34kAU0a8Zke1k+lrt66jNRXRz2VHFBX09+Y4npiLNnscuq8V2BBMWF9cOu0RUGOc5z24Zu1PWA9ujv8CyVLEWzWIlOHU675qhcCpfcylecl7S7uCHQnU2mnPYz4jo+xTrbXQpcKUHVV6cm0yVWAOZcYiJuCGfJEbFNre+IWdKgwKfhQVmngjSVh3Ufe+smeHxJ1SlfAD8UgBKjYSJe/if/NHe+W+yvsiBh7TxPMrc/DcjcpDBHyC4K28jv8akycljLXBhh6aPfytEJbOvZIOBMyZW3eJgRkQkKOUXCBgCo
+ FRANCE_CONNECT_CLIENT_SECRET: AgASrXrNwrvFl+jdV2+s7tDJDqKuXX0PDeCMqRdx/5yoNAV+BpEbxPnf5flbVJQ0Y5dNrjP8M2iXuBSTVN46h2COQjr6q85FYoTjEmbSPEDfYpAii22LmZEoflnCD/1fHp2ZCgY8P4IcXbiPd8wGaLXzqWpaBeNkBhQcro/1YwLjhvlfQNZcK49h2rfeWVIsFrVffvLsLb3SXir2pb2LRpHMRSTj6dyhrMtbDskhtT7k+maVTuDCJO34WYv/4Qh+MOd0VFDW9W1/Yip7egZ8zgn53G+U6TeXLCX7m+1u6nHME7/huAI6paOfPMNXoL69foFlrn4iZH+LFd6UZ0ffU/HNfjEsLds6L0sBa4f7g7eZxtOf08P8e7qtpHDae7jAJNYj5oX6BmGVDzRhApnLZsoWzotAko9v6ZjueuZAI74eCSnMYaTTSwVUum07VH2/AfsFlRHng3UCrxKghmZQ6f/30FkUn9nm5jeZUnKf3myTUhSDfOVxXf9pdIpOsIjoZoysu2VDASG8YOLLsIhvHRcAcM848wOQDci1mBPfonfluZ3FRGmRmoVQd9yKjVo+2OgE0TAdqb92fGEMuqE1s28cnox9QYYzgwhOaZplnNSwiBLPh5RkKf56RbjkizM3H2+ftgnY9BGc2ow5njysM6dAsGsAibVLYZ1l+T/OqhUw+byOXbROD5rgkmSgTAoMAau06OAlawunJXEAvjlWlIwvE0DxlV/6v3a1mCDW0CWGjQe2dRpfXjmJeqSXUrq5IPwe20I20sQswcfYraY+QISg
+ template:
+ metadata:
+ annotations: {}
+ name: franceconnect
+ type: Opaque
diff --git a/.kontinuous/env/prod/templates/keycloak.sealed.secret.yaml b/.kontinuous/env/prod/templates/keycloak.sealed.secret.yaml
new file mode 100644
index 00000000..14857998
--- /dev/null
+++ b/.kontinuous/env/prod/templates/keycloak.sealed.secret.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ annotations: {}
+ name: keycloak-secrets
+ namespace: template
+spec:
+ encryptedData:
+ KEYCLOAK_USER: AgAmkMw1hg+J2IXVdtyFQhU3Pv7ACCtQ5OPBlsyZhqWz24bvYiZ4riuweosyDHsjFAiRPEl1fY9RLqI8N7yfBUYtwwOYEs5cTwgBtCh9pNYM2S9iB+TsUvbv4Vfu10ZvKSPz1+CH3xa7OX/91VfgzTnnzvif7QRobNu5SILqdn+govfCy/+91AAr4NYsJNCsOd9n99nqe6dJmBREh3OKrzIsc/ysKYbV2nteWSrYoZ3K+e/AomlNYodfjgjZ8MdeqXpRHSXIDrF26pZ95OJPtvZ3yDKrnFTY4ennvTTgU+N8U1VBXO6b908kdcw+sdhHMZ6d+2vHAgGtnTIW+pK4O6Zq32ZDjbyvQBqd5rnnVloubaOoWlZykyFUk6aaP3dG8Z3JPUyOnUO6xvQgyFLms3nubrvRVIUh5wmjlh/E3X1aiVF3wRHfQtiY5T0/QYA0JOHXb4DSjoWV1l4AMzn9Y/BJ6yYqwse+eOtLkK0mZyBrkqeQfAMO9bNAsRPPFko7aK9zris7Z/68vYCWyWo5kzzI3PC6EFKi2n3Neu3rsmXGmYc7KZBPU0OXItJnvA+Nu8wBH970tLMRYp3sAiPSl9VDVHjoFEH/GFDNDdIR1qSv/6JDlaRxr/s5vRYY4afE0rjPigb0OSssCTPBUe7Y99jBmAmd5502Wg3DoXkQpBhwTRPWJBHiS1mRCj8tsTkzLum73YzYJnFxy29oWxITgmruf5P1h17ml5aiYpSpkqhbmbHb14fPd/D1XaCTbA==
+ KEYCLOAK_PASSWORD: AgBl/zogbHO7rk8fceEzraXA3nZSUstHauTG9B6mFvm4BEASBBVZQIeF7H+3kDp/Qn7rMCVnhBqgI9arU8bOUSUzC5WPK9oz1uGdrsV45R0Bg9tdfK4baR68lq6BaeupidmGPF9wK7XtAdMeQ6DVTGdb7Gc8QL1wpGNpM/uL23t7h0LOodhzDfzopHTEYlKfXOdMmn/79Hw+K7uNoRDC9qS0N9ugnwbmPOfHGZTLYt96RoezYWVoM15HCSiHsG6K11yb71nwUlfVTR98Nr/yl1CRhx/znM+vXpHXb5y+d6cYvhRUjVf88YkbUJkiR2GEcrZnH74/rGSdBekp4d+aT4A34YW2uKJgp4vnWjmqc9PNOziG3DXnAIa+R1+X3YmHgIooAlgUEtLw0dFgorjmuVgMBOSBMT6N8fuLYd2RP292412T0mIoa7epmLutaM6I1xAmyT+KUb4WWpHs3USof9M17IE+f+3MkYL6ATs29oAKtyXzj75yviaqHKyhalJNUE5Yt4pRJAj3SO3xvXki9jrRRu9iry2UjIOPb55o2T2IQLwtYNs+yegZ6Oj0gyttZT8e6tMKw6ioOfo04x0TvYvHDozZ38oibjviWWEfggUJ4qifXXAtl51yLFt5oT17lIEb+oqJWtBf9x6cpMzbt6oAEO2EZOwbZ6Kn3reuuI8pYHVeXymu1+EL6NdTCBOoTfNwb0SwN0On679mHbe9/MTGUIni35EfdVbqXn3jh3DcOsI2CflAmIu+VgoTRw==
+ template:
+ metadata:
+ annotations: {}
+ name: keycloak-secrets
+ type: Opaque
\ No newline at end of file
diff --git a/.kontinuous/env/prod/templates/smtp.sealed.secret.yaml b/.kontinuous/env/prod/templates/smtp.sealed.secret.yaml
new file mode 100644
index 00000000..3bf2a349
--- /dev/null
+++ b/.kontinuous/env/prod/templates/smtp.sealed.secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+ name: smtp
+ namespace: template
+spec:
+ encryptedData:
+ SMTP_USER: AgAzF+3jEna1lq+Jrq9lXyliD3yA76xrnjWfkmpgEoXqulIvVmeIoaTi8/FNTJJxGEd4mjIyB3JyiJ6BT5eSci+obq+U4/WDAJWgvTmX9azmx1imIlSM3qHOfJwGIzAVWCnDl3yDWWIBx47MHmxlg3lW91abnqm/5Nb38ypVfWkoFIxr9Xwkku2IafVG8mMRGfVtdxosaZbqS46WYtapo/3Z+eYSYY8iEJ02qUjkbHhJSFJpxG/gUaiZyJDtv4+8ZMVe+u9nWLIz1Z8bA5xI3aeSzzG+JB5vqhtGkgS/slZWmQLw6NXkdn7OTlsiy/v1b3EZpkdeOhkLRcGeMtJfjXYElUnBphErvSFvI0EesI8fZJX289rVLRQg6a8hFc6ryg78fkMCDSCmgPakQ5k1pHeC9yZytr+DHAkbRIXQyc+dptJvbijtTrj+1lsARRybLe9BzmfElLHEIw4bbAOCSpaUq9uH9P1FVpMF19LlK9acFcfXWLpWgtttcskIo/27TSO6G74RvACI+vJyj1eqXP/lRdTInQw+h4gBnSdLTKtF6GqWceWq4PW6l/ZJJA+p7b3tTBS32QCNvZL1y8+XK9dGUd/MdehGfwqRQ8mZxGpAmCfayKHHXWeGdL0zcwWA0e83Ij4XxxjNSONHn0MeSmBEq49fR9WCxdA3gTI3nxjtI9mfv0qHuVQtGDZKUZUqTti68IZarxVJmDnMYKIH69AUYTOxSaeImTciF6UDQOzs3w==
+ SMTP_PASSWORD: AgCfxEYngen/v7w41Mh0LQKalvExCRlbCd5hS3agIW+mTFRb9JZxMNDd+DqcHdkevuB/FOEZTTwvFc3GQjXpplUY2OkfhioyXNFJY0WLAxRx/kfJs13qlYYU6BVi1mvAU9HqP8Xppl+PSHv2KFzwxl/US6ug9pCQ/3kXy2YWvoy8fq+bex7yJqAWSp4qjE0pD648KmP2/45VilH68IzuHcbAoUPeRMOKHEpDdmPPk8uVGZTtn8YPsPgY0/e7VzQhssrjXtZhO32FDj6UkBZmdHoBGhEu+oVT1jGk1zDC6REfJzBKde2zv/WoF/QO1wBbWqGQ+GYmiGVCMRSk0Qg6ROx0nYghZqpRXCRKkgYC/ImlDATDHHn7uYpoXnbogcKn5tPyoHB7//Xho5bccDUwrR8tcqAKaQwzFZQ+nA++M0p1gvf2SoMclJjxOB/LJPlAiz8bHZXz+aOOYr36S3RacT4q2jZZG97TBTHzBGsVa+zePPEyw+IaNuXkKcd0oXBwdJ0pCErM1vw4LMWpxsQ/ra5n0FypC4P4IshwcFIfvAbwfsKcDajWgBKGXoIHVJXTmw8422dT1Nw2Goxya7EGWyzK9NhwUbcC9uIwO2fK2y/wf4CVQE4D7hRJQ7D83jGY2K5wCl2en9Jk87bYqUiWZFCiu8EnlpD0m1tPvaKVUKsyCbgyugmSU7fMFpTozR6PQnipg1IPFX+bKcfomVLBiUZnCBZ+yikp0IvOaTpB2c0JXQ==
+ SMTP_HOST: AgCXoja6aY3/0o8L0e4XWebQig2L7iGWI6lgNgyMxOVsxkJv9YsgpuNBSuJvpDPPTovS6k7I0PWK78npViwQ8MeJT4kEpGTgEkc2rAswgZQelyceCXmQxWhUVtzZPwgc8q/jSGGNujRyCPO411pFL/MV+u9pGKSyEvOkaFh80GgHv61MzaKl5hQpXoOzDiHnNtfQvThOIwc3VNCPFmujVyplHkLnzWno/wnWmbPA4Hqkw7GkWl790GacEh+Le3hJIeyN3fC5RkR9qkLzk0PuECDObIDTHWRRrh0tPnkdDq4EvLWsA+NL+DZsg951fbKnHGcKSPXpyhxLx3YqfMAmEU/3++BX3ulg0OImgtuGU/OF6EvSbT9Im0kkFnrhagutzIqsi0GakzzqZ3OYwK1gGPkxfHNPfwuZmxN/t/ARAhvrd3nrl9w1X+R4Ot6M/qENHB6s7fwu94DDouXXEroptK/n4VRJ6k3JY5lLGEfp7hnnxJ7C/15gJD99Ml5k4YO/SmxM9t6qOLWfCxJ3f8vEBzNSfmpj5um/is/iReCVre4w3AWNzv/RVQWniY65LOBAFMomGNkk8IQnlUrTFPfTQkbPKUGElLZ4Bl7GQv9aUVbesTNAAJH0OT/d+txIXhXjmoSHml+PHoqfN/cpFZrbCBhRSRLtRSz0yzNf6Ry+W0M3ZPnBt10hlI/kiUEhP3jvJFKMq2HGzsUAKQuRM8GdiQovQQ==
+ SMTP_PORT: AgBg+mPYjU9K5VwUlN0ue3iEJQTn6sCYUIZXVRsOq0EpC06IL0i/a6QwOaIvOfrUy1lIRbHuDPePlU1/sCbBKrNFMjkoPJRpHvhIvBpe8pzZMGPejQ49eNm97sKBDnKSpRBQOAqu5V7dkLF8+Y8GTwPhxisexvPnuHcpEXb+iSl4bdDnWExWQA5aUh4IJtck27siN9SplgSWsMTBYc2ixKSxi8UukvykvIo+/ypqaec51PwYL59+9hSesL978YmKPhDFEvwa6b6ppdz2ngADVSQuFI4CDKDIebB9GA2F9SjEGVzJ/vjYtrPC5l8fQg3NqJIhUg79WRYc3fBP3MFC/zW6nrZ063a3dyE0cVd/N4+74ve3NJxUxHvEYVHCTmdHBswnlJZh39qfmlwoALdOmr0mPc9JHQ5XqP43exhFWeYKVb3Mt/Ds1wPcQ1wY0NS3FmVsUoUwo/9IGI2mGSdwgsfjzR2wHZ5QtRnD++4RDlrIoRRG3ILVuQyQgq7sthFpnxbPcq+7KwUA1M7NlIz27/AT7jKREa/wJ3ufk/4resTQjXQSrZmeCk9BXs4Xrh0cu/saCr6Sf3fgvh2dqfWzk0JziIdxDTul+u/YRl/drR6OakMvChDvj6Zk+WWlTyFADdMe9xSbuVTN17/TM1FrWamoEs3jbZw5aZUNgB03P09S/GPVCCdmmpBVO9q+346rsfVvDh8=
+ SMTP_FROM: AgB0dXgeufo8gyxwGOkroqF0Zg4N3bFS9aEz/c9nvGx4aIqHI1eVOFd/Hphk/PgXZlT3/I3vgSX8SKINqrkdrrw6vE2lWZ3wmpcXwpU/5sXxOiT7DBPTa94jExwwIBouT8+Ia5nf32nCcd4PbjulQOYTXlbK5zobE3exgq17nyy4I6y6uEBNmkxAIVxtPEVDQbRuhdjIynRXDuK2jUlujrpnHzsw/oHQ7n23BLOR+p33/V51DIKDz0z8skRXhrx5rxRXKvm7DXXD7j71xjlnY30453VzHYYcBZuxOaPmVzH4XFn8j0HMEsP3GLApkoRO5C6hywF9LBqUQIM+8RtZ+JXStZCGtfg6EK5c56tkelgcDF9j671iD5OQQFes/7puL2Xcy2f8J1qM5Fs9cUQQVVRo00eskkv74Pu5NXt9zVKD5mMbwzNBD8hDY9CriXQlaFq/XT1aQ6iJzqksRsKDdqJeTzbZs8+JUs3sVrvs5BWIv7HpDCXodQ7FTJcolpu7geC82p0O8fyhH+k7OtKoXTUswtdDIbB2d/j7t2pJqWQ9/Vt3Qy5ODWKUZjPaYxZ3GWyFM4R6y7Gur0Hwp+SdVbQKF/uCHHQebe1sO30Tf4Euea1mJGpbVjKJbG894jcH2qvYk/kzJ/pCP1YW/bOVRsGaFVcKEMdLIKfur9pOjr8BOmBGdrTMINGfetNoPBm5wdButopZk34yVoJWtuchHKP0j8mLG1ZNtgese/bcnZfU
+ SMTP_SSL: AgA9H5bjSXUSefLME3cQpijeFJjsp6CnF/p4quHiNwQ+7Z5w9mj1BHEPcvHfBk9IAisWgxmSugQa+jIzNu+0YGoHhyeOlL9bSxf65FNE7XbIG5wYjWRli+j+xyZMr9Hs6yXshK5/SiqPdHUQvUOrAgzuqhCRw+ah/oALzzVpnUwHVy4a5WCWlUutpdNr1xSY4PHYx8dW+Ak1RIf3TSDMwn32cik+vwm39uDD1mu4PFQbrUYRZ9PWKXee/XfjDwxZP7kxexcX1aBK9AILSqCnFVfmvsbgPn5orjTjxqAILvdVe9CQ7245LidGSyPDQ62Kc6VZz8+oIDJ+iPNCUqezJcy835NHs1b8W+2JFuCWHHRksFJjKKfTbPxWMVzaaUUOKCSzm20fKfq0663CJMSOehlFVlwaBWBt0q1IENg1Nt/UZ3m057MlE/ijVtBEoMAiGPnPjNTqZVRIexKE30yuHpWhXq8MZB0LroB7ZQ9D1NtK5Df+QMAGtRMqWbk5ur2qKk5l7o9oGFevJw3NWZIKFkg23DqSFxRcm0ei/F8m2IZRUS6ge2m2dOVy5v78PLzQAuXsEyckmJIT10xfNpGeYTlycp5dTvzz4aS5WqoeFftdzjx6VmrT3YncekJZp6UDAS+U4r1pxyGuX3A1GK/woZFy3jpsXozGtq+LUZ3CMk/ZpKVAXFSIqa3q4Fx58EkUo9aJPI3swA==
+ template:
+ metadata:
+ name: smtp
+ type: Opaque
diff --git a/.kontinuous/env/prod/values.yaml b/.kontinuous/env/prod/values.yaml
new file mode 100644
index 00000000..85c7a2df
--- /dev/null
+++ b/.kontinuous/env/prod/values.yaml
@@ -0,0 +1,17 @@
+keycloakx:
+ ingress:
+ annotations:
+ cert-manager.io: cluster-issuer
+ cert-manager.io/cluster-issuer: letsencrypt-prod
+ kubernetes.io/tls-acme: "true"
+ tls:
+ - hosts:
+ - "keycloak-{{ .Values.global.host }}"
+ secretName: keycloak-crt
+
+jobs:
+ runs:
+ build-app:
+ with:
+ buildArgs:
+ NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT: "true"
diff --git a/.kontinuous/files/realm-export.json b/.kontinuous/files/realm-export.json
new file mode 100644
index 00000000..29a1eb1d
--- /dev/null
+++ b/.kontinuous/files/realm-export.json
@@ -0,0 +1,2316 @@
+{
+ "id": "app-realm",
+ "realm": "app-realm",
+ "notBefore": 0,
+ "defaultSignatureAlgorithm": "RS256",
+ "revokeRefreshToken": false,
+ "refreshTokenMaxReuse": 0,
+ "accessTokenLifespan": 300,
+ "accessTokenLifespanForImplicitFlow": 900,
+ "ssoSessionIdleTimeout": 1800,
+ "ssoSessionMaxLifespan": 36000,
+ "ssoSessionIdleTimeoutRememberMe": 0,
+ "ssoSessionMaxLifespanRememberMe": 0,
+ "offlineSessionIdleTimeout": 2592000,
+ "offlineSessionMaxLifespanEnabled": false,
+ "offlineSessionMaxLifespan": 5184000,
+ "clientSessionIdleTimeout": 0,
+ "clientSessionMaxLifespan": 0,
+ "clientOfflineSessionIdleTimeout": 0,
+ "clientOfflineSessionMaxLifespan": 0,
+ "accessCodeLifespan": 60,
+ "accessCodeLifespanUserAction": 300,
+ "accessCodeLifespanLogin": 1800,
+ "actionTokenGeneratedByAdminLifespan": 43200,
+ "actionTokenGeneratedByUserLifespan": 300,
+ "oauth2DeviceCodeLifespan": 600,
+ "oauth2DevicePollingInterval": 5,
+ "enabled": true,
+ "sslRequired": "external",
+ "registrationAllowed": true,
+ "registrationEmailAsUsername": true,
+ "rememberMe": true,
+ "verifyEmail": false,
+ "loginWithEmailAllowed": true,
+ "duplicateEmailsAllowed": false,
+ "resetPasswordAllowed": true,
+ "editUsernameAllowed": true,
+ "bruteForceProtected": true,
+ "permanentLockout": false,
+ "maxFailureWaitSeconds": 900,
+ "minimumQuickLoginWaitSeconds": 60,
+ "waitIncrementSeconds": 60,
+ "quickLoginCheckMilliSeconds": 1000,
+ "maxDeltaTimeSeconds": 43200,
+ "failureFactor": 30,
+ "roles": {
+ "realm": [
+ {
+ "id": "69ca30b2-65d1-4150-aee6-141fbda034c1",
+ "name": "offline_access",
+ "description": "${role_offline-access}",
+ "composite": false,
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ },
+ {
+ "id": "eb95c41a-9dfd-46ee-928e-b894afce7cb2",
+ "name": "uma_authorization",
+ "description": "${role_uma_authorization}",
+ "composite": false,
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ },
+ {
+ "id": "320b2fce-7133-422c-a295-f83133ddce75",
+ "name": "default-roles-app-realm",
+ "description": "${role_default-roles}",
+ "composite": true,
+ "composites": {
+ "realm": ["offline_access", "uma_authorization"],
+ "client": {
+ "account": ["manage-account", "view-profile"]
+ }
+ },
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ }
+ ],
+ "client": {
+ "realm-management": [
+ {
+ "id": "240846bf-bdd3-4c0f-b683-f56ad314a20b",
+ "name": "view-authorization",
+ "description": "${role_view-authorization}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "79a7cea2-bdd0-481f-b1c8-cb48c014dbf3",
+ "name": "query-realms",
+ "description": "${role_query-realms}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "ef31c25b-e421-48dd-ba81-ee4916cca1bb",
+ "name": "manage-identity-providers",
+ "description": "${role_manage-identity-providers}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "888be148-f0b6-42fa-9b66-f36f0c6ac4c1",
+ "name": "view-clients",
+ "description": "${role_view-clients}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": ["query-clients"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "a70e9eda-c368-4934-8ef6-7893aa9d46e4",
+ "name": "manage-realm",
+ "description": "${role_manage-realm}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "7c6fe149-5249-4510-a98d-55243e8e6f3b",
+ "name": "view-realm",
+ "description": "${role_view-realm}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "150c04ee-1f88-46a3-9f42-c2d0c859a1f0",
+ "name": "manage-authorization",
+ "description": "${role_manage-authorization}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "e7771d92-f573-4058-aed1-2671f57e877c",
+ "name": "query-users",
+ "description": "${role_query-users}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "8c2aaa20-28d2-401b-a0d8-1601b33dcf61",
+ "name": "view-users",
+ "description": "${role_view-users}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": ["query-groups", "query-users"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "331c196f-8592-4446-bc94-ae1b239726f1",
+ "name": "manage-events",
+ "description": "${role_manage-events}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "51f8bf46-407c-476f-8fd6-60013d9c3b21",
+ "name": "view-events",
+ "description": "${role_view-events}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "2ecdfe9e-d8ed-4581-ab63-9a4f1bad8056",
+ "name": "create-client",
+ "description": "${role_create-client}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "9a89fc6e-bd34-4293-b4dd-4950400a7f5f",
+ "name": "query-groups",
+ "description": "${role_query-groups}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "b20b99e3-bc32-4265-a30f-e8f5f77c4ac5",
+ "name": "view-identity-providers",
+ "description": "${role_view-identity-providers}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "19753aed-4521-4143-888a-815ecde3da50",
+ "name": "realm-admin",
+ "description": "${role_realm-admin}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": [
+ "view-authorization",
+ "query-realms",
+ "manage-identity-providers",
+ "view-clients",
+ "manage-realm",
+ "view-realm",
+ "manage-authorization",
+ "query-users",
+ "view-users",
+ "manage-events",
+ "view-events",
+ "create-client",
+ "query-groups",
+ "view-identity-providers",
+ "manage-users",
+ "query-clients",
+ "manage-clients",
+ "impersonation"
+ ]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "b1894b09-8908-462a-9521-6c4e032406bb",
+ "name": "manage-users",
+ "description": "${role_manage-users}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "756be009-ece9-47ef-9a63-deb7ff2e5b32",
+ "name": "query-clients",
+ "description": "${role_query-clients}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "e3cfd494-4795-4458-a6e4-191ea8bcbdc9",
+ "name": "manage-clients",
+ "description": "${role_manage-clients}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "5e96bde4-5c0f-4c6b-ac6a-c35c7369fb56",
+ "name": "impersonation",
+ "description": "${role_impersonation}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ }
+ ],
+ "app-client": [],
+ "security-admin-console": [],
+ "admin-cli": [],
+ "account-console": [],
+ "broker": [
+ {
+ "id": "12a263a7-8244-4b57-a7d8-1dadeaf47e3b",
+ "name": "read-token",
+ "description": "${role_read-token}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "ed799cda-87f5-4036-b03b-b58fd7162c61",
+ "attributes": {}
+ }
+ ],
+ "account": [
+ {
+ "id": "e32d6169-9999-4544-9c84-18751dd4557e",
+ "name": "manage-consent",
+ "description": "${role_manage-consent}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "account": ["view-consent"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "4240e837-a3a7-49a2-b488-28a6b3d13fc9",
+ "name": "delete-account",
+ "description": "${role_delete-account}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "ebb27698-b603-426a-96b9-1c14db092a30",
+ "name": "view-consent",
+ "description": "${role_view-consent}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "3f8723fc-4cfc-46bf-b3c5-f1d5579b1057",
+ "name": "manage-account",
+ "description": "${role_manage-account}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "account": ["manage-account-links"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "d36398d6-1e44-4a30-a938-1417a2d67dc4",
+ "name": "view-applications",
+ "description": "${role_view-applications}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "57131503-1484-4a02-b7f2-8762dcebc74f",
+ "name": "manage-account-links",
+ "description": "${role_manage-account-links}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "926fc739-9993-4ddb-9b05-c13a54695aea",
+ "name": "view-profile",
+ "description": "${role_view-profile}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ }
+ ]
+ }
+ },
+ "groups": [],
+ "defaultRole": {
+ "id": "320b2fce-7133-422c-a295-f83133ddce75",
+ "name": "default-roles-app-realm",
+ "description": "${role_default-roles}",
+ "composite": true,
+ "clientRole": false,
+ "containerId": "app-realm"
+ },
+ "requiredCredentials": ["password"],
+ "passwordPolicy": "length(12) and notUsername(undefined) and notEmail(undefined) and digits(1) and specialChars(1) and forceExpiredPasswordChange(365)",
+ "otpPolicyType": "totp",
+ "otpPolicyAlgorithm": "HmacSHA1",
+ "otpPolicyInitialCounter": 0,
+ "otpPolicyDigits": 6,
+ "otpPolicyLookAheadWindow": 1,
+ "otpPolicyPeriod": 30,
+ "otpSupportedApplications": ["FreeOTP", "Google Authenticator"],
+ "webAuthnPolicyRpEntityName": "keycloak",
+ "webAuthnPolicySignatureAlgorithms": ["ES256"],
+ "webAuthnPolicyRpId": "",
+ "webAuthnPolicyAttestationConveyancePreference": "not specified",
+ "webAuthnPolicyAuthenticatorAttachment": "not specified",
+ "webAuthnPolicyRequireResidentKey": "not specified",
+ "webAuthnPolicyUserVerificationRequirement": "not specified",
+ "webAuthnPolicyCreateTimeout": 0,
+ "webAuthnPolicyAvoidSameAuthenticatorRegister": false,
+ "webAuthnPolicyAcceptableAaguids": [],
+ "webAuthnPolicyPasswordlessRpEntityName": "keycloak",
+ "webAuthnPolicyPasswordlessSignatureAlgorithms": ["ES256"],
+ "webAuthnPolicyPasswordlessRpId": "",
+ "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
+ "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
+ "webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
+ "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
+ "webAuthnPolicyPasswordlessCreateTimeout": 0,
+ "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
+ "webAuthnPolicyPasswordlessAcceptableAaguids": [],
+ "users": [
+ {
+ "id": "8632b28f-b32d-4f40-9123-3391bfcc8a56",
+ "createdTimestamp": 1652087242872,
+ "username": "service-account-app-client",
+ "enabled": true,
+ "totp": false,
+ "emailVerified": false,
+ "serviceAccountClientId": "app-client",
+ "disableableCredentialTypes": [],
+ "requiredActions": [],
+ "realmRoles": ["default-roles-app-realm"],
+ "notBefore": 0,
+ "groups": []
+ }
+ ],
+ "scopeMappings": [
+ {
+ "clientScope": "offline_access",
+ "roles": ["offline_access"]
+ }
+ ],
+ "clientScopeMappings": {
+ "account": [
+ {
+ "client": "account-console",
+ "roles": ["manage-account"]
+ }
+ ]
+ },
+ "clients": [
+ {
+ "id": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "clientId": "account",
+ "name": "${client_account}",
+ "rootUrl": "${authBaseUrl}",
+ "baseUrl": "/realms/app-realm/account/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/realms/app-realm/account/*"],
+ "webOrigins": ["${authBaseUrl}"],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "09f59fad-fa72-4a5a-ba3a-70b8492a5dff",
+ "clientId": "account-console",
+ "name": "${client_account-console}",
+ "rootUrl": "${authBaseUrl}",
+ "baseUrl": "/realms/app-realm/account/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/realms/app-realm/account/*"],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "pkce.code.challenge.method": "S256"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "protocolMappers": [
+ {
+ "id": "f06c2857-b04a-4604-9dd4-487e71a140d7",
+ "name": "audience resolve",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-audience-resolve-mapper",
+ "consentRequired": false,
+ "config": {}
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "d9760586-8015-4746-9ca5-5d65659e87a5",
+ "clientId": "admin-cli",
+ "name": "${client_admin-cli}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": false,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": true,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "68a4be1f-06df-470f-88c9-3624f205f201",
+ "clientId": "app-client",
+ "rootUrl": "",
+ "adminUrl": "",
+ "baseUrl": "{{ getenv `NEXTAUTH_URL` }}/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "secret": "{{ getenv `KEYCLOAK_CLIENT_SECRET` }}",
+ "redirectUris": ["{{ getenv `NEXTAUTH_URL` }}/*"],
+ "webOrigins": [""],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": true,
+ "serviceAccountsEnabled": true,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "saml.force.post.binding": "false",
+ "saml.multivalued.roles": "false",
+ "frontchannel.logout.session.required": "false",
+ "oauth2.device.authorization.grant.enabled": "true",
+ "backchannel.logout.revoke.offline.tokens": "false",
+ "saml.server.signature.keyinfo.ext": "false",
+ "use.refresh.tokens": "true",
+ "oidc.ciba.grant.enabled": "false",
+ "backchannel.logout.session.required": "false",
+ "client_credentials.use_refresh_token": "false",
+ "require.pushed.authorization.requests": "false",
+ "saml.client.signature": "false",
+ "saml.allow.ecp.flow": "false",
+ "id.token.as.detached.signature": "false",
+ "saml.assertion.signature": "false",
+ "client.secret.creation.time": "1652084534",
+ "saml.encrypt": "false",
+ "login_theme": "keycloak-dsfr",
+ "saml.server.signature": "false",
+ "exclude.session.state.from.auth.response": "false",
+ "saml.artifact.binding": "false",
+ "saml_force_name_id_format": "false",
+ "acr.loa.map": "{}",
+ "tls.client.certificate.bound.access.tokens": "false",
+ "saml.authnstatement": "false",
+ "display.on.consent.screen": "false",
+ "token.response.type.bearer.lower-case": "false",
+ "saml.onetimeuse.condition": "false"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": true,
+ "nodeReRegistrationTimeout": -1,
+ "protocolMappers": [
+ {
+ "id": "14861571-230e-45e8-809c-a214e48b8e2b",
+ "name": "Client ID",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientId",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientId",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "e28c58af-dc28-41e2-80e0-2bd63d3ba12d",
+ "name": "Client IP Address",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientAddress",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientAddress",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "fc9923bd-c3b7-49b1-98c7-9605b3bd2951",
+ "name": "Client Host",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientHost",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientHost",
+ "jsonType.label": "String"
+ }
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "ed799cda-87f5-4036-b03b-b58fd7162c61",
+ "clientId": "broker",
+ "name": "${client_broker}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": true,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "clientId": "realm-management",
+ "name": "${client_realm-management}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": true,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "aadfca8d-04df-42e8-91be-4f2fe3b2a08e",
+ "clientId": "security-admin-console",
+ "name": "${client_security-admin-console}",
+ "rootUrl": "${authAdminUrl}",
+ "baseUrl": "/admin/app-realm/console/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/admin/app-realm/console/*"],
+ "webOrigins": ["+"],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "pkce.code.challenge.method": "S256"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "protocolMappers": [
+ {
+ "id": "02457ef6-5741-4c46-bfee-c2f0eed6b52a",
+ "name": "locale",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "locale",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "locale",
+ "jsonType.label": "String"
+ }
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ }
+ ],
+ "clientScopes": [
+ {
+ "id": "993e7b62-6229-46fa-8122-882d6574148c",
+ "name": "email",
+ "description": "OpenID Connect built-in scope: email",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${emailScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "a5d4046a-f3b2-4453-9d09-4093f32b3a61",
+ "name": "email verified",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "emailVerified",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "email_verified",
+ "jsonType.label": "boolean"
+ }
+ },
+ {
+ "id": "d350ed11-9689-4edf-addc-2b3101ed3dc8",
+ "name": "email",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "email",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "email",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "829e0988-a78b-44c6-9841-e20464458eff",
+ "name": "phone",
+ "description": "OpenID Connect built-in scope: phone",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${phoneScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "72a53970-9a6b-45fa-ab4a-e822b3c51494",
+ "name": "phone number",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "phoneNumber",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "phone_number",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "422559f3-a8de-4a8e-a12c-c06578f383c6",
+ "name": "phone number verified",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "phoneNumberVerified",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "phone_number_verified",
+ "jsonType.label": "boolean"
+ }
+ }
+ ]
+ },
+ {
+ "id": "16388bbf-e020-47f8-9dda-55c80182e076",
+ "name": "offline_access",
+ "description": "OpenID Connect built-in scope: offline_access",
+ "protocol": "openid-connect",
+ "attributes": {
+ "consent.screen.text": "${offlineAccessScopeConsentText}",
+ "display.on.consent.screen": "true"
+ }
+ },
+ {
+ "id": "29671011-4905-47ac-b908-4a2a4330311b",
+ "name": "web-origins",
+ "description": "OpenID Connect scope for add allowed web origins to the access token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "false",
+ "consent.screen.text": ""
+ },
+ "protocolMappers": [
+ {
+ "id": "12e40775-549e-4b3b-8134-50962b44ef04",
+ "name": "allowed web origins",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-allowed-origins-mapper",
+ "consentRequired": false,
+ "config": {}
+ }
+ ]
+ },
+ {
+ "id": "844bdd5c-a473-41f1-9215-16f93cd506af",
+ "name": "profile",
+ "description": "OpenID Connect built-in scope: profile",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${profileScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "be3256f9-16c8-4748-968c-759139e6c498",
+ "name": "website",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "website",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "website",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "af100d54-da24-4873-9014-241d5016c94e",
+ "name": "updated at",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "updatedAt",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "updated_at",
+ "jsonType.label": "long"
+ }
+ },
+ {
+ "id": "7be2ce3d-ae12-4f9c-bb57-02354a67fee9",
+ "name": "gender",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "gender",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "gender",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "edc57e15-1453-4f76-bc37-6e9529b124f7",
+ "name": "zoneinfo",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "zoneinfo",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "zoneinfo",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "f51f380a-e0ed-41c5-b0f0-6f7097c68c0b",
+ "name": "full name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-full-name-mapper",
+ "consentRequired": false,
+ "config": {
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "userinfo.token.claim": "true"
+ }
+ },
+ {
+ "id": "8a598a3d-5782-4b92-9c48-8c9444b8fa16",
+ "name": "profile",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "profile",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "profile",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "89b14094-e5c8-4737-9b3c-46dd5dbbb2f2",
+ "name": "nickname",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "nickname",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "nickname",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "2a11c304-241f-40d4-a8da-59d735d01e0c",
+ "name": "locale",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "locale",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "locale",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "8bf7c54d-d864-4e38-b8e3-18343adae67a",
+ "name": "username",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "username",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "preferred_username",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "c2a1884c-53b2-4306-99c9-afa4f89f47fc",
+ "name": "given name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "firstName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "given_name",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "cb929373-6174-4f20-b57e-c53019f66c0e",
+ "name": "picture",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "picture",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "picture",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "636c69ed-84ac-45a2-b9d7-147d4299bc47",
+ "name": "birthdate",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "birthdate",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "birthdate",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "2163b9d8-0ba8-4a85-8b40-76159dae4d75",
+ "name": "family name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "lastName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "family_name",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "30e328ac-9e81-44bf-8087-7a3ae46b86bd",
+ "name": "middle name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "middleName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "middle_name",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "b6ff78fa-487b-4a6a-a033-ac8cb8e547cf",
+ "name": "roles",
+ "description": "OpenID Connect scope for add user roles to the access token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${rolesScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "dab2a7dc-e619-4896-a3f0-1bec742f23ef",
+ "name": "client roles",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-client-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute": "foo",
+ "access.token.claim": "true",
+ "claim.name": "resource_access.${client_id}.roles",
+ "jsonType.label": "String",
+ "multivalued": "true"
+ }
+ },
+ {
+ "id": "81c310ca-755c-4120-8893-71aa214c1ace",
+ "name": "audience resolve",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-audience-resolve-mapper",
+ "consentRequired": false,
+ "config": {}
+ },
+ {
+ "id": "10226444-2ac1-4233-8d86-b351f639d0c5",
+ "name": "realm roles",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute": "foo",
+ "access.token.claim": "true",
+ "claim.name": "realm_access.roles",
+ "jsonType.label": "String",
+ "multivalued": "true"
+ }
+ }
+ ]
+ },
+ {
+ "id": "7bb640c4-7db0-4a3e-8ca2-a07b530758bb",
+ "name": "microprofile-jwt",
+ "description": "Microprofile - JWT built-in scope",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "false"
+ },
+ "protocolMappers": [
+ {
+ "id": "7bcb9077-5cd1-4157-98fc-ba59f645f063",
+ "name": "upn",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "username",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "upn",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "85c170a3-1066-4534-b189-663b40b23057",
+ "name": "groups",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "multivalued": "true",
+ "userinfo.token.claim": "true",
+ "user.attribute": "foo",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "groups",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "f1c3966a-4910-489e-963b-b69738a6d984",
+ "name": "acr",
+ "description": "OpenID Connect scope for add acr (authentication context class reference) to the token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "false"
+ },
+ "protocolMappers": [
+ {
+ "id": "1066caeb-f587-4b70-a865-9a7775f5cc26",
+ "name": "acr loa level",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-acr-mapper",
+ "consentRequired": false,
+ "config": {
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "userinfo.token.claim": "true"
+ }
+ }
+ ]
+ },
+ {
+ "id": "ea57d137-081a-4dec-9b85-c946d85c7b8c",
+ "name": "role_list",
+ "description": "SAML role list",
+ "protocol": "saml",
+ "attributes": {
+ "consent.screen.text": "${samlRoleListScopeConsentText}",
+ "display.on.consent.screen": "true"
+ },
+ "protocolMappers": [
+ {
+ "id": "e91ecc51-0518-412c-aacd-14f74a037279",
+ "name": "role list",
+ "protocol": "saml",
+ "protocolMapper": "saml-role-list-mapper",
+ "consentRequired": false,
+ "config": {
+ "single": "false",
+ "attribute.nameformat": "Basic",
+ "attribute.name": "Role"
+ }
+ }
+ ]
+ },
+ {
+ "id": "49c1a546-bed5-4c48-a826-a3e942629d32",
+ "name": "address",
+ "description": "OpenID Connect built-in scope: address",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${addressScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "1aa230cb-9fdf-40ba-a1f9-52cdb0e0bd62",
+ "name": "address",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-address-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute.formatted": "formatted",
+ "user.attribute.country": "country",
+ "user.attribute.postal_code": "postal_code",
+ "userinfo.token.claim": "true",
+ "user.attribute.street": "street",
+ "id.token.claim": "true",
+ "user.attribute.region": "region",
+ "access.token.claim": "true",
+ "user.attribute.locality": "locality"
+ }
+ }
+ ]
+ }
+ ],
+ "defaultDefaultClientScopes": [
+ "role_list",
+ "profile",
+ "email",
+ "roles",
+ "web-origins",
+ "acr"
+ ],
+ "defaultOptionalClientScopes": [
+ "offline_access",
+ "address",
+ "phone",
+ "microprofile-jwt"
+ ],
+ "browserSecurityHeaders": {
+ "contentSecurityPolicyReportOnly": "",
+ "xContentTypeOptions": "nosniff",
+ "xRobotsTag": "none",
+ "xFrameOptions": "SAMEORIGIN",
+ "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+ "xXSSProtection": "1; mode=block",
+ "strictTransportSecurity": "max-age=31536000; includeSubDomains"
+ },
+ "smtpServer": {
+ "starttls": "{{ or (getenv `SMTP_STARTTLS`) `true` }}",
+ "auth": "{{ or (getenv `SMTP_AUTH`) `true` }}",
+ "host": "{{ getenv `SMTP_HOST` }}",
+ "from": "{{ or (getenv `SMTP_FROM`) `` }}",
+ "port": "{{ or (getenv `SMTP_PORT`) `587` }}",
+ "ssl": "{{ or (getenv `SMTP_SSL`) `true` }}",
+ "user": "{{ getenv `SMTP_USER` }}",
+ "password": "{{ getenv `SMTP_PASSWORD` }}"
+ },
+ "loginTheme": "keycloak-dsfr",
+ "eventsEnabled": true,
+ "eventsExpiration": 86400,
+ "eventsListeners": ["jboss-logging"],
+ "enabledEventTypes": [],
+ "adminEventsEnabled": true,
+ "adminEventsDetailsEnabled": false,
+ "identityProviders": [
+ {
+ "alias": "franceconnect-particulier",
+ "internalId": "811dc141-3dbc-4f36-b434-e916b63cce84",
+ "providerId": "franceconnect-particulier",
+ "enabled": true,
+ "updateProfileFirstLoginMode": "on",
+ "trustEmail": false,
+ "storeToken": false,
+ "addReadTokenRoleOnCreate": false,
+ "authenticateByDefault": false,
+ "linkOnly": false,
+ "firstBrokerLoginFlowAlias": "first broker login",
+ "config": {
+ "eidas_values": "eidas1",
+ "isCreated": "true",
+ "clientId": "{{ getenv `FRANCE_CONNECT_CLIENT_ID` }}",
+ "fc_environment": "integration_v1",
+ "syncMode": "IMPORT",
+ "clientSecret": "{{ getenv `FRANCE_CONNECT_CLIENT_SECRET` }}",
+ "defaultScope": "openid email",
+ "useJwksUrl": "true"
+ }
+ }
+ ],
+ "identityProviderMappers": [
+ {
+ "id": "f3aae5e1-89ca-40b1-9ee6-6b988bd857ff",
+ "name": "firstName",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "given_name",
+ "user.attribute": "firstName"
+ }
+ },
+ {
+ "id": "213673a8-0d44-43ea-89b3-abf9f3ea0769",
+ "name": "provider",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "hardcoded-attribute-idp-mapper",
+ "config": {
+ "attribute.value": "FC",
+ "syncMode": "INHERIT",
+ "attribute": "provider"
+ }
+ },
+ {
+ "id": "fb1a4128-0e26-4ec2-9ee4-827d04d31327",
+ "name": "lastName",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "family_name",
+ "user.attribute": "lastName"
+ }
+ },
+ {
+ "id": "d62e0104-20d5-4fb8-b8b3-f351c570aaf1",
+ "name": "email",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "email",
+ "user.attribute": "email"
+ }
+ }
+ ],
+ "components": {
+ "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
+ {
+ "id": "d9fa6d0d-ca14-4ff5-a604-4224c0e6b5c3",
+ "name": "Full Scope Disabled",
+ "providerId": "scope",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {}
+ },
+ {
+ "id": "d155a354-0713-413e-9b6d-2cab023dda09",
+ "name": "Trusted Hosts",
+ "providerId": "trusted-hosts",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "host-sending-registration-request-must-match": ["true"],
+ "client-uris-must-match": ["true"]
+ }
+ },
+ {
+ "id": "7e0fdbb8-cd10-42f2-a9cd-b0749c4d8f07",
+ "name": "Allowed Client Scopes",
+ "providerId": "allowed-client-templates",
+ "subType": "authenticated",
+ "subComponents": {},
+ "config": {
+ "allow-default-scopes": ["true"]
+ }
+ },
+ {
+ "id": "5b8508c1-1077-4a67-83d5-1931d7028ae1",
+ "name": "Allowed Protocol Mapper Types",
+ "providerId": "allowed-protocol-mappers",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "allowed-protocol-mapper-types": [
+ "saml-user-property-mapper",
+ "oidc-usermodel-attribute-mapper",
+ "saml-user-attribute-mapper",
+ "saml-role-list-mapper",
+ "oidc-usermodel-property-mapper",
+ "oidc-full-name-mapper",
+ "oidc-sha256-pairwise-sub-mapper",
+ "oidc-address-mapper"
+ ]
+ }
+ },
+ {
+ "id": "661574d5-9c7e-472d-b2e8-500358fd4202",
+ "name": "Consent Required",
+ "providerId": "consent-required",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {}
+ },
+ {
+ "id": "435264a5-7be1-4476-ac55-8c4e8cf2e2c2",
+ "name": "Max Clients Limit",
+ "providerId": "max-clients",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "max-clients": ["200"]
+ }
+ },
+ {
+ "id": "4e672291-b498-4bc6-841e-221ef10716b1",
+ "name": "Allowed Protocol Mapper Types",
+ "providerId": "allowed-protocol-mappers",
+ "subType": "authenticated",
+ "subComponents": {},
+ "config": {
+ "allowed-protocol-mapper-types": [
+ "oidc-usermodel-property-mapper",
+ "saml-role-list-mapper",
+ "oidc-usermodel-attribute-mapper",
+ "oidc-full-name-mapper",
+ "saml-user-property-mapper",
+ "saml-user-attribute-mapper",
+ "oidc-address-mapper",
+ "oidc-sha256-pairwise-sub-mapper"
+ ]
+ }
+ },
+ {
+ "id": "01706ca3-d0a4-4e33-addc-77b47ef45ff6",
+ "name": "Allowed Client Scopes",
+ "providerId": "allowed-client-templates",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "allow-default-scopes": ["true"]
+ }
+ }
+ ],
+ "org.keycloak.userprofile.UserProfileProvider": [
+ {
+ "id": "3a66433c-1fb9-480a-9266-f89370f9163b",
+ "providerId": "declarative-user-profile",
+ "subComponents": {},
+ "config": {}
+ }
+ ],
+ "org.keycloak.keys.KeyProvider": [
+ {
+ "id": "874258e0-a7b7-4f4d-bbc8-bff008034771",
+ "name": "hmac-generated",
+ "providerId": "hmac-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"],
+ "algorithm": ["HS256"]
+ }
+ },
+ {
+ "id": "194a1f68-7c81-4430-bda3-4df117acff81",
+ "name": "aes-generated",
+ "providerId": "aes-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"]
+ }
+ },
+ {
+ "id": "32cf572a-a632-44f4-bd78-e7e74d5c6dff",
+ "name": "rsa-enc-generated",
+ "providerId": "rsa-enc-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"],
+ "algorithm": ["RSA-OAEP"]
+ }
+ },
+ {
+ "id": "e6793a0b-37b5-4ba7-afd6-b5efb592b281",
+ "name": "rsa-generated",
+ "providerId": "rsa-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"]
+ }
+ }
+ ]
+ },
+ "internationalizationEnabled": true,
+ "supportedLocales": [
+ "de",
+ "no",
+ "ru",
+ "sv",
+ "pt-BR",
+ "lt",
+ "en",
+ "it",
+ "fr",
+ "hu",
+ "zh-CN",
+ "es",
+ "cs",
+ "ja",
+ "sk",
+ "pl",
+ "da",
+ "ca",
+ "nl",
+ "tr"
+ ],
+ "defaultLocale": "fr",
+ "authenticationFlows": [
+ {
+ "id": "9fecefb4-86da-46b6-a942-12ae1bb972c7",
+ "alias": "Account verification options",
+ "description": "Method with which to verity the existing account",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-email-verification",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Verify Existing Account by Re-authentication",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "038ef19f-7553-487c-a3e2-62b6ddffa5bb",
+ "alias": "Authentication Options",
+ "description": "Authentication options.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "basic-auth",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "basic-auth-otp",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-spnego",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "de1da099-2cf0-463c-992b-34152215c884",
+ "alias": "Browser - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-otp-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "6c151ab1-bae0-4af3-9aaf-ceae80230f6a",
+ "alias": "Direct Grant - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "direct-grant-validate-otp",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "b31cb115-ac43-42c3-aea2-03437f4debe6",
+ "alias": "First broker login - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-otp-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "f6c89b0d-92f7-4452-b0b2-4328ff03ed4e",
+ "alias": "Handle Existing Account",
+ "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-confirm-link",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Account verification options",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "547ba007-bf6c-4ee8-ac37-7f5d50567f49",
+ "alias": "Reset - Conditional OTP",
+ "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-otp",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7d509daf-9267-429e-9a77-6d515028df30",
+ "alias": "User creation or linking",
+ "description": "Flow for the existing/non-existing user alternatives",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticatorConfig": "create unique user config",
+ "authenticator": "idp-create-user-if-unique",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Handle Existing Account",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "4e58afd5-42f9-400a-98b0-efff7c6e45f1",
+ "alias": "Verify Existing Account by Re-authentication",
+ "description": "Reauthentication of existing account",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-username-password-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "First broker login - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "bfd251da-826e-4e08-bbe6-573a47d03d60",
+ "alias": "browser",
+ "description": "browser based authentication",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "auth-cookie",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-spnego",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "identity-provider-redirector",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 25,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 30,
+ "autheticatorFlow": true,
+ "flowAlias": "forms",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "0688e4ec-888a-4a9b-9e5f-5fe7f9f8bc3e",
+ "alias": "clients",
+ "description": "Base authentication for clients",
+ "providerId": "client-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "client-secret",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-jwt",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-secret-jwt",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-x509",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 40,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "9a83a302-1ef6-44b9-b8bd-2efd0b143535",
+ "alias": "direct grant",
+ "description": "OpenID Connect Resource Owner Grant",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "direct-grant-validate-username",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "direct-grant-validate-password",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 30,
+ "autheticatorFlow": true,
+ "flowAlias": "Direct Grant - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "a3686832-308e-4f00-b1f5-7fe247520fc2",
+ "alias": "docker auth",
+ "description": "Used by Docker clients to authenticate against the IDP",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "docker-http-basic-authenticator",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "ffe5edf2-d51c-4de2-b866-deb4c7c2e22f",
+ "alias": "first broker login",
+ "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticatorConfig": "review profile config",
+ "authenticator": "idp-review-profile",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "User creation or linking",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7e8e1b3e-3162-4a89-91e7-6ac30067f910",
+ "alias": "forms",
+ "description": "Username, password, otp and other auth forms.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "auth-username-password-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Browser - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "33c79d8a-5000-4165-ab71-9a3bb811c0af",
+ "alias": "http challenge",
+ "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "no-cookie-redirect",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Authentication Options",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "49a680e1-0358-489f-b7e7-fcd32f739354",
+ "alias": "registration",
+ "description": "registration flow",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "registration-page-form",
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": true,
+ "flowAlias": "registration form",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "b93852b8-d7c2-4548-a4f9-5d2f44ee15a5",
+ "alias": "registration form",
+ "description": "registration form",
+ "providerId": "form-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "registration-user-creation",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-profile-action",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 40,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-password-action",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 50,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-recaptcha-action",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 60,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "f234aee1-2af8-4c5d-a4cb-a5bb89b26e9f",
+ "alias": "reset credentials",
+ "description": "Reset credentials for a user if they forgot their password or something",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "reset-credentials-choose-user",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-credential-email",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-password",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 40,
+ "autheticatorFlow": true,
+ "flowAlias": "Reset - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7cd9b926-259b-4665-bb6e-bd97ab17ea92",
+ "alias": "saml ecp",
+ "description": "SAML ECP Profile Authentication Flow",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "http-basic-authenticator",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ }
+ ],
+ "authenticatorConfig": [
+ {
+ "id": "231d66cc-34c0-4354-9018-f48434b6b3cc",
+ "alias": "create unique user config",
+ "config": {
+ "require.password.update.after.registration": "false"
+ }
+ },
+ {
+ "id": "3e3c05d1-f0af-43bb-952d-73b1e1627a43",
+ "alias": "review profile config",
+ "config": {
+ "update.profile.on.first.login": "missing"
+ }
+ }
+ ],
+ "requiredActions": [
+ {
+ "alias": "CONFIGURE_TOTP",
+ "name": "Configure OTP",
+ "providerId": "CONFIGURE_TOTP",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 10,
+ "config": {}
+ },
+ {
+ "alias": "terms_and_conditions",
+ "name": "Terms and Conditions",
+ "providerId": "terms_and_conditions",
+ "enabled": false,
+ "defaultAction": false,
+ "priority": 20,
+ "config": {}
+ },
+ {
+ "alias": "UPDATE_PASSWORD",
+ "name": "Update Password",
+ "providerId": "UPDATE_PASSWORD",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 30,
+ "config": {}
+ },
+ {
+ "alias": "UPDATE_PROFILE",
+ "name": "Update Profile",
+ "providerId": "UPDATE_PROFILE",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 40,
+ "config": {}
+ },
+ {
+ "alias": "VERIFY_EMAIL",
+ "name": "Verify Email",
+ "providerId": "VERIFY_EMAIL",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 50,
+ "config": {}
+ },
+ {
+ "alias": "delete_account",
+ "name": "Delete Account",
+ "providerId": "delete_account",
+ "enabled": false,
+ "defaultAction": false,
+ "priority": 60,
+ "config": {}
+ },
+ {
+ "alias": "update_user_locale",
+ "name": "Update User Locale",
+ "providerId": "update_user_locale",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 1000,
+ "config": {}
+ }
+ ],
+ "browserFlow": "browser",
+ "registrationFlow": "registration",
+ "directGrantFlow": "direct grant",
+ "resetCredentialsFlow": "reset credentials",
+ "clientAuthenticationFlow": "clients",
+ "dockerAuthenticationFlow": "docker auth",
+ "attributes": {
+ "cibaBackchannelTokenDeliveryMode": "poll",
+ "cibaExpiresIn": "120",
+ "cibaAuthRequestedUserHint": "login_hint",
+ "oauth2DeviceCodeLifespan": "600",
+ "clientOfflineSessionMaxLifespan": "0",
+ "oauth2DevicePollingInterval": "5",
+ "clientSessionIdleTimeout": "0",
+ "userProfileEnabled": "false",
+ "parRequestUriLifespan": "60",
+ "clientSessionMaxLifespan": "0",
+ "clientOfflineSessionIdleTimeout": "0",
+ "cibaInterval": "5"
+ },
+ "keycloakVersion": "18.0.0",
+ "userManagedAccessAllowed": true,
+ "clientProfiles": {
+ "profiles": []
+ },
+ "clientPolicies": {
+ "policies": []
+ }
+}
diff --git a/.kontinuous/templates/realm.configmap.yaml b/.kontinuous/templates/realm.configmap.yaml
new file mode 100644
index 00000000..e8e73a88
--- /dev/null
+++ b/.kontinuous/templates/realm.configmap.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: keycloak-realm
+data:
+ realm.json.envtpl: |
+ {{- .Files.Get "files/realm-export.json" | nindent 4}}
diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml
new file mode 100644
index 00000000..019880d9
--- /dev/null
+++ b/.kontinuous/values.yaml
@@ -0,0 +1,153 @@
+global:
+ registry: harbor.fabrique.social.gouv.fr
+
+app-front:
+ needs: [build-app]
+ host: "{{.Values.global.host}}"
+ imageProject: fabrique
+ imageRepository: template
+ imagePackage: app
+ containerPort: 3000
+ probesPath: "/healthz"
+ envFrom:
+ - configMapRef:
+ name: app
+ - secretRef:
+ name: app
+
+jobs:
+ runs:
+ build-app:
+ use: SocialGouv/kontinuous/plugins/fabrique/jobs/build@v1
+ with:
+ imageProject: fabrique
+ imageRepository: template
+ imagePackage: app
+ registrySecretRefName: harbor
+ buildArgs:
+ NEXT_PUBLIC_APP_VERSION_COMMIT: "{{ $.Values.global.sha }}"
+
+keycloakx:
+ fullnameOverride: keycloakx
+ enabled: true
+
+ serviceAccount:
+ create: false
+ image:
+ tag: "18.0.0"
+ database:
+ vendor: postgres
+ cache:
+ stack: custom
+ http:
+ relativePath: /
+ service:
+ httpPort: 8080
+
+ # hack for import + start prior to keycloak 18
+ command:
+ - "/opt/keycloak/bin/kc.sh"
+ - "start"
+ - "--auto-build"
+ - "--http-enabled=true" # SSL is provided at ingress level
+ - "--http-port=8080"
+ - "--hostname-strict=true"
+ - "--hostname-strict-https=true"
+ - "--import-realm"
+ - "--features=admin2"
+ - "--spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true" # allow redirect_uri on logout see https://www.keycloak.org/2022/04/keycloak-1800-released.html
+ # - "--spi-events-listener-jboss-logging-success-level=info"
+ # - "--spi-events-listener-jboss-logging-error-level=warn"
+
+ statefulsetAnnotations:
+ kapp.k14s.io/nonce: ""
+ kapp.k14s.io/update-strategy: fallback-on-replace
+ kapp.k14s.io/change-group: "kontinuous/keycloak.{{ .Values.global.namespace }}"
+ kapp.k14s.io/disable-original: ""
+ kapp.k14s.io/create-strategy: fallback-on-update
+
+ extraEnvFrom: |
+ - secretRef:
+ name: pg-user-keycloak
+ - secretRef:
+ name: keycloak-secrets
+ extraEnv: |
+ - name: KC_DB_URL_HOST
+ value: "$(PGHOST)"
+ - name: KC_DB_URL_PORT
+ value: "$(PGPORT)"
+ - name: KC_DB_URL_DATABASE
+ value: "$(PGDATABASE)"
+ - name: KC_DB_USERNAME
+ value: "$(PGUSER)"
+ - name: KC_DB_PASSWORD
+ value: "$(PGPASSWORD)"
+ - name: KC_HOSTNAME
+ value: "keycloak-{{ .Values.global.host }}"
+ - name: KC_LOG_LEVEL
+ value: "INFO"
+
+ extraVolumes: |
+ - name: keycloak-realm-tpl
+ configMap:
+ name: keycloak-realm
+ - name: keycloak-realm
+ emptyDir: {}
+ - name: providers
+ emptyDir: {}
+ extraVolumeMounts: |
+ - name: keycloak-realm
+ mountPath: "/opt/keycloak/data/import"
+ readOnly: true
+ - name: providers
+ mountPath: "/opt/keycloak/providers"
+ extraInitContainers: |
+ - name: compile-realm
+ image: hairyhenderson/gomplate:v3.10.0-alpine
+ imagePullPolicy: IfNotPresent
+ volumeMounts:
+ - name: keycloak-realm-tpl
+ mountPath: "/realm-tpl/"
+ readOnly: true
+ - name: keycloak-realm
+ mountPath: "/realm/"
+ envFrom:
+ - configMapRef:
+ name: app
+ - secretRef:
+ name: app
+ - secretRef:
+ name: franceconnect
+ - secretRef:
+ name: smtp
+ command:
+ - sh
+ args:
+ - -c
+ - "cat /realm-tpl/realm.json.envtpl | gomplate > /realm/realm.json"
+ - name: fetch-keycloak-providers
+ image: curlimages/curl
+ imagePullPolicy: IfNotPresent
+ command:
+ - sh
+ args:
+ - -c
+ - curl -L -f -S -o /providers/keycloak-dsfr-latest.jar https://github.com/SocialGouv/keycloak-dsfr/releases/latest/download/keycloak-theme.jar -o /providers/keycloak-franceconnect-4.1.0.jar https://github.com/InseeFr/Keycloak-FranceConnect/releases/download/4.1.0/keycloak-franceconnect-4.1.0.jar
+ volumeMounts:
+ - name: providers
+ mountPath: /providers
+
+ ingress:
+ enabled: true
+ annotations:
+ nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
+ kubernetes.io/ingress.class: nginx
+ tls:
+ - hosts:
+ - "keycloak-{{ .Values.global.host }}"
+ secretName: wildcard-crt
+ rules:
+ - host: "keycloak-{{ .Values.global.host }}"
+ paths:
+ - path: /
+ pathType: Prefix
diff --git a/.kube-workflow/common/values.yaml b/.kube-workflow/common/values.yaml
deleted file mode 100644
index 5660e7f1..00000000
--- a/.kube-workflow/common/values.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# here you can customize your deployment according to : https://github.com/SocialGouv/actions/blob/master/autodevops-helm-deploy/chart/values.yaml
-app:
- enabled: true
- probesPath: /healthz
- containerPort: 8080
diff --git a/.storybook/main.js b/.storybook/main.js
index 3bc6657e..b17397d2 100644
--- a/.storybook/main.js
+++ b/.storybook/main.js
@@ -22,6 +22,7 @@ module.exports = {
"@hooks": path.resolve(__dirname, "../src/hooks"),
"@modules": path.resolve(__dirname, "../src/modules"),
"@lib": path.resolve(__dirname, "../src/lib"),
+ "@types": path.resolve(__dirname, "../src/types"),
};
return config;
},
diff --git a/Dockerfile b/Dockerfile
index ac1bcbad..15e66e2a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,41 +1,44 @@
ARG NODE_VERSION=16-alpine
-# Install dependencies only when needed
-FROM node:$NODE_VERSION AS prepare
-RUN apk add --no-cache libc6-compat=1.2.2-r7
-WORKDIR /app
-COPY package.json yarn.lock ./
+# Builder
+FROM node:$NODE_VERSION AS builder
-# Keep yarn install cache when bumping version and dependencies still the sames
-RUN node -e " \
- const package = JSON.parse(fs.readFileSync('/app/package.json')); \
- const packageZero = { ...package, version: '0.0.0' }; \
- fs.writeFileSync('/app/package.json', JSON.stringify(packageZero));"
+ARG NEXT_PUBLIC_APP_VERSION_COMMIT
+ENV NEXT_PUBLIC_APP_VERSION_COMMIT $NEXT_PUBLIC_APP_VERSION_COMMIT
+ARG NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT
+ENV NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT $NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT
+ARG NEXT_PUBLIC_HOST
+ENV NEXT_PUBLIC_HOST $NEXT_PUBLIC_HOST
-FROM node:$NODE_VERSION as deps
WORKDIR /app
-COPY --from=prepare /app/package.json /app/yarn.lock ./
-RUN yarn install --frozen-lockfile
-# Rebuild the source code only when needed
-FROM node:$NODE_VERSION AS builder
-ARG PRODUCTION
-ENV NODE_ENV production
-ARG GITHUB_SHA
-ENV GITHUB_SHA $GITHUB_SHA
-WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
+COPY package.json yarn.lock /app/
+
COPY . .
-RUN if [ -z "$PRODUCTION" ]; then \
- echo "Overriding .env for staging"; \
- cp .env.staging .env.production; \
- fi && \
- yarn build:export
-# Production image, copy all the files and run next
-FROM ghcr.io/socialgouv/docker/nginx:7.0.0 AS runner
+RUN yarn install --frozen-lockfile && yarn build && yarn install --production && if [ -z "$NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT" ]; then echo "Copy staging values"; cp .env.staging .env.production; fi
-COPY --from=builder /app/out /usr/share/nginx/html
+# Runner
+FROM node:$NODE_VERSION AS runner
-# Disable nextjs telemetry
+WORKDIR /app
+
+ENV NODE_ENV production
ENV NEXT_TELEMETRY_DISABLED 1
+
+COPY --from=builder /app/next.config.js .
+COPY --from=builder /app/sentry.client.config.ts .
+COPY --from=builder /app/sentry.server.config.ts .
+COPY --from=builder /app/package.json .
+COPY --from=builder /app/.env.production .
+COPY --from=builder /app/.env.staging .
+COPY --from=builder /app/csp.config.js .
+COPY --from=builder /app/next-seo.config.js .
+COPY --from=builder /app/src ./src
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder --chown=node:node /app/.next ./.next
+
+USER 1001
+
+CMD ["yarn", "start"]
diff --git a/README.md b/README.md
index 72a26694..388a5e3f 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,11 @@
# template
-Template est une application [next](https://nextjs.org/) développée par la [Fabrique des ministères sociaux](https://www.fabrique.social.gouv.fr/).
+Template est une application [Next](https://nextjs.org/) développée par la [Fabrique des ministères sociaux](https://www.fabrique.social.gouv.fr/) suivant les préconisations du [Système de Design de l'État](https://gouvfr.atlassian.net/wiki/spaces/DB/overview).
-La version actuelle produit un site statique, mais le Dockerfile peut facilement être adapté.
+L'application dispose de deux branches principales :
-Version en production du projet : .
-
-Storybook liés à la branche principale du projet : .
+- [`main`](https://github.com/SocialGouv/template) qui est la branche principale du projet, celle-ci dispose d'une instance keycloak connectée avec sa base de données `postgres`
+- [`static`](https://github.com/SocialGouv/template/tree/static) qui est un template de site en statique sans la partie authentification
## Description
@@ -22,6 +21,9 @@ Ce template est composé de page :
- Déclaration d'accessibilité
- Healthz
- Page 404
+- Page d'authentification gérée par keycloak (exclusive à `main`)
+- Page d'inscription gérée par keycloak (exclusive à `main`)
+- Page profil (exclusive à `main`)
### D'un point de vue technique
@@ -33,14 +35,8 @@ Ce template est composé de page :
- [cypress](https://www.cypress.io/) pour tester en e2e le frontend
- [matomo](https://matomo.org/) pour sauvegarder de manière anonyme les statistiques d'utilisation
- [sentry](https://sentry.io/) pour gérer les erreurs
-
-#### Gestion des environnements
-
-Les variables issues des docker build-args, sont à utiliser dans `next.config.js`, pour les autres, il faut les définir dans les différents [`.env.*`](https://nextjs.org/docs/basic-features/environment-variables#environment-variable-load-order).
-
-Le fichier `.env.staging` est utilisé pour les environnements de review et de pré-production.
-
-:warning: Les variables d'environnement sont publiques (utilisées durant le build), ne commitez donc pas de variables privées dans ces fichiers.
+- [keycloak](https://www.keycloak.org/) qui est un serveur d'authentification (exclusive à `main`)
+- [next-auth](https://next-auth.js.org/) qui est un wrapper pour gérer l'authentification au sein de l'application (exclusive à `main`)
## Lancer le code
@@ -48,15 +44,47 @@ Après avoir cloné le projet :
### Développement
+:warning: Avant de lancer le projet, vous devez installer `gomplate`
+
```bash
-yarn
-yarn dev
+docker-compose up -d # to run keycloak and postgres in background
+yarn # to install dependencies
+yarn dev # to run in dev mode
```
### Production
```bash
-yarn
-yarn build
-yarn export
+yarn # to install dependencies
+yarn build # to build code
+yarn start # to start
```
+
+### Gestion des environnements
+
+Les variables issues des docker build-args, sont à utiliser dans `next.config.js`, pour les autres, il faut les définir dans les différents [`.env.*`](https://nextjs.org/docs/basic-features/environment-variables#environment-variable-load-order).
+
+Le fichier `.env.staging` est utilisé pour les environnements de review et de pré-production.
+
+Le fichier `.env.development` est utilisé pour l'environnement de développement.
+
+:warning: Les variables d'environnement sont publiques (utilisées durant le build), ne commitez donc pas de variables privées dans ces fichiers.
+
+### KeyCloak
+
+Le template intègre [Next-auth](https://next-auth.js.org/) et [KeyCloak 18](https://www.keycloak.org/) qui assure tous les workflows d'authentification.
+
+Le `realm` par défaut est dans [.kontinuous/files/realm-export.json](.kontinuous/files/realm-export.json). Pour générer realm utilisable par `docker-compose` à partir de celui-ci, utilisez `yarn keycloak`.
+
+Le thème keycloak est basé sur le design-système de l'état, cf [keycloak-dsfr](https://github.com/SocialGouv/keycloak-dsfr).
+
+#### FranceConnect
+
+Cf https://partenaires.franceconnect.gouv.fr/fcp/fournisseur-service
+
+Dans les URLs de callback définies [sur le compte FranceConnect](), utiliser `https://[votre-hostname]/realms/app-realm/broker/franceconnect-particulier/endpoint` et `https://[votre-hostname]/realms/app-realm/broker/franceconnect-particulier/endpoint/logout_response`.
+
+## Liens
+
+- : Version en production du projet
+- : Storybook liés à la branche principale du projet
diff --git a/csp.config.js b/csp.config.js
index 666a54b2..20eec866 100644
--- a/csp.config.js
+++ b/csp.config.js
@@ -1,10 +1,16 @@
const ContentSecurityPolicy = `
- default-src 'self' *.fabrique.social.gouv.fr;
+ default-src 'self' *.fabrique.social.gouv.fr ${
+ // allow local keycloak in development
+ process.env.NODE_ENV !== "production" && "http://localhost:8080"
+ };
img-src 'self' data: *.fabrique.social.gouv.fr https://dummyimage.com/;
script-src 'self' *.fabrique.social.gouv.fr ${
process.env.NODE_ENV !== "production" && "'unsafe-eval'"
};
- frame-src 'self' *.fabrique.social.gouv.fr;
+ frame-src 'self' *.fabrique.social.gouv.fr ${
+ // allow local keycloak in development
+ process.env.NODE_ENV !== "production" && "http://localhost:8080"
+ };
style-src 'self' 'unsafe-inline';
font-src 'self' data: blob:;
`;
diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 00000000..21dcdfae
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,34 @@
+version: "3"
+
+volumes:
+ postgres_data:
+ driver: local
+
+services:
+ postgres:
+ image: postgres
+ volumes:
+ - postgres_data:/var/lib/postgresql/data
+ environment:
+ POSTGRES_DB: keycloak
+ POSTGRES_USER: keycloak
+ POSTGRES_PASSWORD: password
+ keycloak:
+ image: quay.io/keycloak/keycloak:18.0.0
+ environment:
+ KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak"
+ KC_DB: postgres
+ KC_METRICS_ENABLED: "true"
+ KC_DB_USERNAME: keycloak
+ KC_DB_PASSWORD: password
+ KEYCLOAK_ADMIN: admin
+ KEYCLOAK_ADMIN_PASSWORD: admin
+ KC_LOG_LEVEL: INFO
+ ports:
+ - 8080:8080
+ depends_on:
+ - postgres
+ volumes:
+ - ./keycloak/config:/opt/keycloak/data/import
+ - ./keycloak/providers:/opt/keycloak/providers
+ command: "start --import-realm --auto-build --db=postgres --features admin2 --http-enabled=true --http-port=8080 --hostname-strict=false --hostname-strict-https=false --spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true "
diff --git a/jest.config.js b/jest.config.js
index 53f28d78..738823c6 100644
--- a/jest.config.js
+++ b/jest.config.js
@@ -25,6 +25,7 @@ const customJestConfig = {
"@hooks": "/src/hooks",
"@modules": "/src/modules",
"@lib": "/src/lib",
+ "@types": "/src/types",
},
setupFilesAfterEnv: ["/jest-setup.ts"],
};
diff --git a/keycloak/config/realm-export-local.json b/keycloak/config/realm-export-local.json
new file mode 100644
index 00000000..fa3ccec7
--- /dev/null
+++ b/keycloak/config/realm-export-local.json
@@ -0,0 +1,2307 @@
+{
+ "id": "app-realm",
+ "realm": "app-realm",
+ "notBefore": 0,
+ "defaultSignatureAlgorithm": "RS256",
+ "revokeRefreshToken": false,
+ "refreshTokenMaxReuse": 0,
+ "accessTokenLifespan": 300,
+ "accessTokenLifespanForImplicitFlow": 900,
+ "ssoSessionIdleTimeout": 1800,
+ "ssoSessionMaxLifespan": 36000,
+ "ssoSessionIdleTimeoutRememberMe": 0,
+ "ssoSessionMaxLifespanRememberMe": 0,
+ "offlineSessionIdleTimeout": 2592000,
+ "offlineSessionMaxLifespanEnabled": false,
+ "offlineSessionMaxLifespan": 5184000,
+ "clientSessionIdleTimeout": 0,
+ "clientSessionMaxLifespan": 0,
+ "clientOfflineSessionIdleTimeout": 0,
+ "clientOfflineSessionMaxLifespan": 0,
+ "accessCodeLifespan": 60,
+ "accessCodeLifespanUserAction": 300,
+ "accessCodeLifespanLogin": 1800,
+ "actionTokenGeneratedByAdminLifespan": 43200,
+ "actionTokenGeneratedByUserLifespan": 300,
+ "oauth2DeviceCodeLifespan": 600,
+ "oauth2DevicePollingInterval": 5,
+ "enabled": true,
+ "sslRequired": "external",
+ "registrationAllowed": true,
+ "registrationEmailAsUsername": true,
+ "rememberMe": true,
+ "verifyEmail": false,
+ "loginWithEmailAllowed": true,
+ "duplicateEmailsAllowed": false,
+ "resetPasswordAllowed": true,
+ "editUsernameAllowed": true,
+ "bruteForceProtected": true,
+ "permanentLockout": false,
+ "maxFailureWaitSeconds": 900,
+ "minimumQuickLoginWaitSeconds": 60,
+ "waitIncrementSeconds": 60,
+ "quickLoginCheckMilliSeconds": 1000,
+ "maxDeltaTimeSeconds": 43200,
+ "failureFactor": 30,
+ "roles": {
+ "realm": [
+ {
+ "id": "69ca30b2-65d1-4150-aee6-141fbda034c1",
+ "name": "offline_access",
+ "description": "${role_offline-access}",
+ "composite": false,
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ },
+ {
+ "id": "eb95c41a-9dfd-46ee-928e-b894afce7cb2",
+ "name": "uma_authorization",
+ "description": "${role_uma_authorization}",
+ "composite": false,
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ },
+ {
+ "id": "320b2fce-7133-422c-a295-f83133ddce75",
+ "name": "default-roles-app-realm",
+ "description": "${role_default-roles}",
+ "composite": true,
+ "composites": {
+ "realm": ["offline_access", "uma_authorization"],
+ "client": {
+ "account": ["manage-account", "view-profile"]
+ }
+ },
+ "clientRole": false,
+ "containerId": "app-realm",
+ "attributes": {}
+ }
+ ],
+ "client": {
+ "realm-management": [
+ {
+ "id": "240846bf-bdd3-4c0f-b683-f56ad314a20b",
+ "name": "view-authorization",
+ "description": "${role_view-authorization}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "79a7cea2-bdd0-481f-b1c8-cb48c014dbf3",
+ "name": "query-realms",
+ "description": "${role_query-realms}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "ef31c25b-e421-48dd-ba81-ee4916cca1bb",
+ "name": "manage-identity-providers",
+ "description": "${role_manage-identity-providers}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "888be148-f0b6-42fa-9b66-f36f0c6ac4c1",
+ "name": "view-clients",
+ "description": "${role_view-clients}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": ["query-clients"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "a70e9eda-c368-4934-8ef6-7893aa9d46e4",
+ "name": "manage-realm",
+ "description": "${role_manage-realm}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "7c6fe149-5249-4510-a98d-55243e8e6f3b",
+ "name": "view-realm",
+ "description": "${role_view-realm}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "150c04ee-1f88-46a3-9f42-c2d0c859a1f0",
+ "name": "manage-authorization",
+ "description": "${role_manage-authorization}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "e7771d92-f573-4058-aed1-2671f57e877c",
+ "name": "query-users",
+ "description": "${role_query-users}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "8c2aaa20-28d2-401b-a0d8-1601b33dcf61",
+ "name": "view-users",
+ "description": "${role_view-users}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": ["query-groups", "query-users"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "331c196f-8592-4446-bc94-ae1b239726f1",
+ "name": "manage-events",
+ "description": "${role_manage-events}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "51f8bf46-407c-476f-8fd6-60013d9c3b21",
+ "name": "view-events",
+ "description": "${role_view-events}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "2ecdfe9e-d8ed-4581-ab63-9a4f1bad8056",
+ "name": "create-client",
+ "description": "${role_create-client}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "9a89fc6e-bd34-4293-b4dd-4950400a7f5f",
+ "name": "query-groups",
+ "description": "${role_query-groups}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "b20b99e3-bc32-4265-a30f-e8f5f77c4ac5",
+ "name": "view-identity-providers",
+ "description": "${role_view-identity-providers}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "19753aed-4521-4143-888a-815ecde3da50",
+ "name": "realm-admin",
+ "description": "${role_realm-admin}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "realm-management": [
+ "view-authorization",
+ "query-realms",
+ "manage-identity-providers",
+ "view-clients",
+ "manage-realm",
+ "view-realm",
+ "manage-authorization",
+ "query-users",
+ "view-users",
+ "manage-events",
+ "view-events",
+ "create-client",
+ "query-groups",
+ "view-identity-providers",
+ "manage-users",
+ "query-clients",
+ "manage-clients",
+ "impersonation"
+ ]
+ }
+ },
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "b1894b09-8908-462a-9521-6c4e032406bb",
+ "name": "manage-users",
+ "description": "${role_manage-users}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "756be009-ece9-47ef-9a63-deb7ff2e5b32",
+ "name": "query-clients",
+ "description": "${role_query-clients}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "e3cfd494-4795-4458-a6e4-191ea8bcbdc9",
+ "name": "manage-clients",
+ "description": "${role_manage-clients}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ },
+ {
+ "id": "5e96bde4-5c0f-4c6b-ac6a-c35c7369fb56",
+ "name": "impersonation",
+ "description": "${role_impersonation}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "attributes": {}
+ }
+ ],
+ "app-client": [],
+ "security-admin-console": [],
+ "admin-cli": [],
+ "account-console": [],
+ "broker": [
+ {
+ "id": "12a263a7-8244-4b57-a7d8-1dadeaf47e3b",
+ "name": "read-token",
+ "description": "${role_read-token}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "ed799cda-87f5-4036-b03b-b58fd7162c61",
+ "attributes": {}
+ }
+ ],
+ "account": [
+ {
+ "id": "e32d6169-9999-4544-9c84-18751dd4557e",
+ "name": "manage-consent",
+ "description": "${role_manage-consent}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "account": ["view-consent"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "4240e837-a3a7-49a2-b488-28a6b3d13fc9",
+ "name": "delete-account",
+ "description": "${role_delete-account}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "ebb27698-b603-426a-96b9-1c14db092a30",
+ "name": "view-consent",
+ "description": "${role_view-consent}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "3f8723fc-4cfc-46bf-b3c5-f1d5579b1057",
+ "name": "manage-account",
+ "description": "${role_manage-account}",
+ "composite": true,
+ "composites": {
+ "client": {
+ "account": ["manage-account-links"]
+ }
+ },
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "d36398d6-1e44-4a30-a938-1417a2d67dc4",
+ "name": "view-applications",
+ "description": "${role_view-applications}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "57131503-1484-4a02-b7f2-8762dcebc74f",
+ "name": "manage-account-links",
+ "description": "${role_manage-account-links}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ },
+ {
+ "id": "926fc739-9993-4ddb-9b05-c13a54695aea",
+ "name": "view-profile",
+ "description": "${role_view-profile}",
+ "composite": false,
+ "clientRole": true,
+ "containerId": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "attributes": {}
+ }
+ ]
+ }
+ },
+ "groups": [],
+ "defaultRole": {
+ "id": "320b2fce-7133-422c-a295-f83133ddce75",
+ "name": "default-roles-app-realm",
+ "description": "${role_default-roles}",
+ "composite": true,
+ "clientRole": false,
+ "containerId": "app-realm"
+ },
+ "requiredCredentials": ["password"],
+ "passwordPolicy": "length(12) and notUsername(undefined) and notEmail(undefined) and digits(1) and specialChars(1) and forceExpiredPasswordChange(365)",
+ "otpPolicyType": "totp",
+ "otpPolicyAlgorithm": "HmacSHA1",
+ "otpPolicyInitialCounter": 0,
+ "otpPolicyDigits": 6,
+ "otpPolicyLookAheadWindow": 1,
+ "otpPolicyPeriod": 30,
+ "otpSupportedApplications": ["FreeOTP", "Google Authenticator"],
+ "webAuthnPolicyRpEntityName": "keycloak",
+ "webAuthnPolicySignatureAlgorithms": ["ES256"],
+ "webAuthnPolicyRpId": "",
+ "webAuthnPolicyAttestationConveyancePreference": "not specified",
+ "webAuthnPolicyAuthenticatorAttachment": "not specified",
+ "webAuthnPolicyRequireResidentKey": "not specified",
+ "webAuthnPolicyUserVerificationRequirement": "not specified",
+ "webAuthnPolicyCreateTimeout": 0,
+ "webAuthnPolicyAvoidSameAuthenticatorRegister": false,
+ "webAuthnPolicyAcceptableAaguids": [],
+ "webAuthnPolicyPasswordlessRpEntityName": "keycloak",
+ "webAuthnPolicyPasswordlessSignatureAlgorithms": ["ES256"],
+ "webAuthnPolicyPasswordlessRpId": "",
+ "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
+ "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
+ "webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
+ "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
+ "webAuthnPolicyPasswordlessCreateTimeout": 0,
+ "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
+ "webAuthnPolicyPasswordlessAcceptableAaguids": [],
+ "users": [
+ {
+ "id": "8632b28f-b32d-4f40-9123-3391bfcc8a56",
+ "createdTimestamp": 1652087242872,
+ "username": "service-account-app-client",
+ "enabled": true,
+ "totp": false,
+ "emailVerified": false,
+ "serviceAccountClientId": "app-client",
+ "disableableCredentialTypes": [],
+ "requiredActions": [],
+ "realmRoles": ["default-roles-app-realm"],
+ "notBefore": 0,
+ "groups": []
+ }
+ ],
+ "scopeMappings": [
+ {
+ "clientScope": "offline_access",
+ "roles": ["offline_access"]
+ }
+ ],
+ "clientScopeMappings": {
+ "account": [
+ {
+ "client": "account-console",
+ "roles": ["manage-account"]
+ }
+ ]
+ },
+ "clients": [
+ {
+ "id": "6daccad8-0c0a-4b57-b835-fa5faf6217e5",
+ "clientId": "account",
+ "name": "${client_account}",
+ "rootUrl": "${authBaseUrl}",
+ "baseUrl": "/realms/app-realm/account/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/realms/app-realm/account/*"],
+ "webOrigins": ["${authBaseUrl}"],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "09f59fad-fa72-4a5a-ba3a-70b8492a5dff",
+ "clientId": "account-console",
+ "name": "${client_account-console}",
+ "rootUrl": "${authBaseUrl}",
+ "baseUrl": "/realms/app-realm/account/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/realms/app-realm/account/*"],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "pkce.code.challenge.method": "S256"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "protocolMappers": [
+ {
+ "id": "f06c2857-b04a-4604-9dd4-487e71a140d7",
+ "name": "audience resolve",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-audience-resolve-mapper",
+ "consentRequired": false,
+ "config": {}
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "d9760586-8015-4746-9ca5-5d65659e87a5",
+ "clientId": "admin-cli",
+ "name": "${client_admin-cli}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": false,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": true,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "68a4be1f-06df-470f-88c9-3624f205f201",
+ "clientId": "app-client",
+ "rootUrl": "",
+ "adminUrl": "",
+ "baseUrl": "http://localhost:3000/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "secret": "**********",
+ "redirectUris": ["http://localhost:3000/*"],
+ "webOrigins": [""],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": true,
+ "serviceAccountsEnabled": true,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "saml.force.post.binding": "false",
+ "saml.multivalued.roles": "false",
+ "frontchannel.logout.session.required": "false",
+ "oauth2.device.authorization.grant.enabled": "true",
+ "backchannel.logout.revoke.offline.tokens": "false",
+ "saml.server.signature.keyinfo.ext": "false",
+ "use.refresh.tokens": "true",
+ "oidc.ciba.grant.enabled": "false",
+ "backchannel.logout.session.required": "false",
+ "client_credentials.use_refresh_token": "false",
+ "require.pushed.authorization.requests": "false",
+ "saml.client.signature": "false",
+ "saml.allow.ecp.flow": "false",
+ "id.token.as.detached.signature": "false",
+ "saml.assertion.signature": "false",
+ "client.secret.creation.time": "1652084534",
+ "saml.encrypt": "false",
+ "login_theme": "keycloak-dsfr",
+ "saml.server.signature": "false",
+ "exclude.session.state.from.auth.response": "false",
+ "saml.artifact.binding": "false",
+ "saml_force_name_id_format": "false",
+ "acr.loa.map": "{}",
+ "tls.client.certificate.bound.access.tokens": "false",
+ "saml.authnstatement": "false",
+ "display.on.consent.screen": "false",
+ "token.response.type.bearer.lower-case": "false",
+ "saml.onetimeuse.condition": "false"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": true,
+ "nodeReRegistrationTimeout": -1,
+ "protocolMappers": [
+ {
+ "id": "14861571-230e-45e8-809c-a214e48b8e2b",
+ "name": "Client ID",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientId",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientId",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "e28c58af-dc28-41e2-80e0-2bd63d3ba12d",
+ "name": "Client IP Address",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientAddress",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientAddress",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "fc9923bd-c3b7-49b1-98c7-9605b3bd2951",
+ "name": "Client Host",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usersessionmodel-note-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.session.note": "clientHost",
+ "userinfo.token.claim": "true",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "clientHost",
+ "jsonType.label": "String"
+ }
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "ed799cda-87f5-4036-b03b-b58fd7162c61",
+ "clientId": "broker",
+ "name": "${client_broker}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": true,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "03866454-846d-4126-ab8b-4685b49f9c5a",
+ "clientId": "realm-management",
+ "name": "${client_realm-management}",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": [],
+ "webOrigins": [],
+ "notBefore": 0,
+ "bearerOnly": true,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": false,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {},
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ },
+ {
+ "id": "aadfca8d-04df-42e8-91be-4f2fe3b2a08e",
+ "clientId": "security-admin-console",
+ "name": "${client_security-admin-console}",
+ "rootUrl": "${authAdminUrl}",
+ "baseUrl": "/admin/app-realm/console/",
+ "surrogateAuthRequired": false,
+ "enabled": true,
+ "alwaysDisplayInConsole": false,
+ "clientAuthenticatorType": "client-secret",
+ "redirectUris": ["/admin/app-realm/console/*"],
+ "webOrigins": ["+"],
+ "notBefore": 0,
+ "bearerOnly": false,
+ "consentRequired": false,
+ "standardFlowEnabled": true,
+ "implicitFlowEnabled": false,
+ "directAccessGrantsEnabled": false,
+ "serviceAccountsEnabled": false,
+ "publicClient": true,
+ "frontchannelLogout": false,
+ "protocol": "openid-connect",
+ "attributes": {
+ "pkce.code.challenge.method": "S256"
+ },
+ "authenticationFlowBindingOverrides": {},
+ "fullScopeAllowed": false,
+ "nodeReRegistrationTimeout": 0,
+ "protocolMappers": [
+ {
+ "id": "02457ef6-5741-4c46-bfee-c2f0eed6b52a",
+ "name": "locale",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "locale",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "locale",
+ "jsonType.label": "String"
+ }
+ }
+ ],
+ "defaultClientScopes": [
+ "web-origins",
+ "acr",
+ "profile",
+ "roles",
+ "email"
+ ],
+ "optionalClientScopes": [
+ "address",
+ "phone",
+ "offline_access",
+ "microprofile-jwt"
+ ]
+ }
+ ],
+ "clientScopes": [
+ {
+ "id": "993e7b62-6229-46fa-8122-882d6574148c",
+ "name": "email",
+ "description": "OpenID Connect built-in scope: email",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${emailScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "a5d4046a-f3b2-4453-9d09-4093f32b3a61",
+ "name": "email verified",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "emailVerified",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "email_verified",
+ "jsonType.label": "boolean"
+ }
+ },
+ {
+ "id": "d350ed11-9689-4edf-addc-2b3101ed3dc8",
+ "name": "email",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "email",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "email",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "829e0988-a78b-44c6-9841-e20464458eff",
+ "name": "phone",
+ "description": "OpenID Connect built-in scope: phone",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${phoneScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "72a53970-9a6b-45fa-ab4a-e822b3c51494",
+ "name": "phone number",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "phoneNumber",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "phone_number",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "422559f3-a8de-4a8e-a12c-c06578f383c6",
+ "name": "phone number verified",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "phoneNumberVerified",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "phone_number_verified",
+ "jsonType.label": "boolean"
+ }
+ }
+ ]
+ },
+ {
+ "id": "16388bbf-e020-47f8-9dda-55c80182e076",
+ "name": "offline_access",
+ "description": "OpenID Connect built-in scope: offline_access",
+ "protocol": "openid-connect",
+ "attributes": {
+ "consent.screen.text": "${offlineAccessScopeConsentText}",
+ "display.on.consent.screen": "true"
+ }
+ },
+ {
+ "id": "29671011-4905-47ac-b908-4a2a4330311b",
+ "name": "web-origins",
+ "description": "OpenID Connect scope for add allowed web origins to the access token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "false",
+ "consent.screen.text": ""
+ },
+ "protocolMappers": [
+ {
+ "id": "12e40775-549e-4b3b-8134-50962b44ef04",
+ "name": "allowed web origins",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-allowed-origins-mapper",
+ "consentRequired": false,
+ "config": {}
+ }
+ ]
+ },
+ {
+ "id": "844bdd5c-a473-41f1-9215-16f93cd506af",
+ "name": "profile",
+ "description": "OpenID Connect built-in scope: profile",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${profileScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "be3256f9-16c8-4748-968c-759139e6c498",
+ "name": "website",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "website",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "website",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "af100d54-da24-4873-9014-241d5016c94e",
+ "name": "updated at",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "updatedAt",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "updated_at",
+ "jsonType.label": "long"
+ }
+ },
+ {
+ "id": "7be2ce3d-ae12-4f9c-bb57-02354a67fee9",
+ "name": "gender",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "gender",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "gender",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "edc57e15-1453-4f76-bc37-6e9529b124f7",
+ "name": "zoneinfo",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "zoneinfo",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "zoneinfo",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "f51f380a-e0ed-41c5-b0f0-6f7097c68c0b",
+ "name": "full name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-full-name-mapper",
+ "consentRequired": false,
+ "config": {
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "userinfo.token.claim": "true"
+ }
+ },
+ {
+ "id": "8a598a3d-5782-4b92-9c48-8c9444b8fa16",
+ "name": "profile",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "profile",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "profile",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "89b14094-e5c8-4737-9b3c-46dd5dbbb2f2",
+ "name": "nickname",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "nickname",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "nickname",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "2a11c304-241f-40d4-a8da-59d735d01e0c",
+ "name": "locale",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "locale",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "locale",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "8bf7c54d-d864-4e38-b8e3-18343adae67a",
+ "name": "username",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "username",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "preferred_username",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "c2a1884c-53b2-4306-99c9-afa4f89f47fc",
+ "name": "given name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "firstName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "given_name",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "cb929373-6174-4f20-b57e-c53019f66c0e",
+ "name": "picture",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "picture",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "picture",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "636c69ed-84ac-45a2-b9d7-147d4299bc47",
+ "name": "birthdate",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "birthdate",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "birthdate",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "2163b9d8-0ba8-4a85-8b40-76159dae4d75",
+ "name": "family name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "lastName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "family_name",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "30e328ac-9e81-44bf-8087-7a3ae46b86bd",
+ "name": "middle name",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-attribute-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "middleName",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "middle_name",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "b6ff78fa-487b-4a6a-a033-ac8cb8e547cf",
+ "name": "roles",
+ "description": "OpenID Connect scope for add user roles to the access token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${rolesScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "dab2a7dc-e619-4896-a3f0-1bec742f23ef",
+ "name": "client roles",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-client-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute": "foo",
+ "access.token.claim": "true",
+ "claim.name": "resource_access.${client_id}.roles",
+ "jsonType.label": "String",
+ "multivalued": "true"
+ }
+ },
+ {
+ "id": "81c310ca-755c-4120-8893-71aa214c1ace",
+ "name": "audience resolve",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-audience-resolve-mapper",
+ "consentRequired": false,
+ "config": {}
+ },
+ {
+ "id": "10226444-2ac1-4233-8d86-b351f639d0c5",
+ "name": "realm roles",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute": "foo",
+ "access.token.claim": "true",
+ "claim.name": "realm_access.roles",
+ "jsonType.label": "String",
+ "multivalued": "true"
+ }
+ }
+ ]
+ },
+ {
+ "id": "7bb640c4-7db0-4a3e-8ca2-a07b530758bb",
+ "name": "microprofile-jwt",
+ "description": "Microprofile - JWT built-in scope",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "false"
+ },
+ "protocolMappers": [
+ {
+ "id": "7bcb9077-5cd1-4157-98fc-ba59f645f063",
+ "name": "upn",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-property-mapper",
+ "consentRequired": false,
+ "config": {
+ "userinfo.token.claim": "true",
+ "user.attribute": "username",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "upn",
+ "jsonType.label": "String"
+ }
+ },
+ {
+ "id": "85c170a3-1066-4534-b189-663b40b23057",
+ "name": "groups",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
+ "consentRequired": false,
+ "config": {
+ "multivalued": "true",
+ "userinfo.token.claim": "true",
+ "user.attribute": "foo",
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "claim.name": "groups",
+ "jsonType.label": "String"
+ }
+ }
+ ]
+ },
+ {
+ "id": "f1c3966a-4910-489e-963b-b69738a6d984",
+ "name": "acr",
+ "description": "OpenID Connect scope for add acr (authentication context class reference) to the token",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "false",
+ "display.on.consent.screen": "false"
+ },
+ "protocolMappers": [
+ {
+ "id": "1066caeb-f587-4b70-a865-9a7775f5cc26",
+ "name": "acr loa level",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-acr-mapper",
+ "consentRequired": false,
+ "config": {
+ "id.token.claim": "true",
+ "access.token.claim": "true",
+ "userinfo.token.claim": "true"
+ }
+ }
+ ]
+ },
+ {
+ "id": "ea57d137-081a-4dec-9b85-c946d85c7b8c",
+ "name": "role_list",
+ "description": "SAML role list",
+ "protocol": "saml",
+ "attributes": {
+ "consent.screen.text": "${samlRoleListScopeConsentText}",
+ "display.on.consent.screen": "true"
+ },
+ "protocolMappers": [
+ {
+ "id": "e91ecc51-0518-412c-aacd-14f74a037279",
+ "name": "role list",
+ "protocol": "saml",
+ "protocolMapper": "saml-role-list-mapper",
+ "consentRequired": false,
+ "config": {
+ "single": "false",
+ "attribute.nameformat": "Basic",
+ "attribute.name": "Role"
+ }
+ }
+ ]
+ },
+ {
+ "id": "49c1a546-bed5-4c48-a826-a3e942629d32",
+ "name": "address",
+ "description": "OpenID Connect built-in scope: address",
+ "protocol": "openid-connect",
+ "attributes": {
+ "include.in.token.scope": "true",
+ "display.on.consent.screen": "true",
+ "consent.screen.text": "${addressScopeConsentText}"
+ },
+ "protocolMappers": [
+ {
+ "id": "1aa230cb-9fdf-40ba-a1f9-52cdb0e0bd62",
+ "name": "address",
+ "protocol": "openid-connect",
+ "protocolMapper": "oidc-address-mapper",
+ "consentRequired": false,
+ "config": {
+ "user.attribute.formatted": "formatted",
+ "user.attribute.country": "country",
+ "user.attribute.postal_code": "postal_code",
+ "userinfo.token.claim": "true",
+ "user.attribute.street": "street",
+ "id.token.claim": "true",
+ "user.attribute.region": "region",
+ "access.token.claim": "true",
+ "user.attribute.locality": "locality"
+ }
+ }
+ ]
+ }
+ ],
+ "defaultDefaultClientScopes": [
+ "role_list",
+ "profile",
+ "email",
+ "roles",
+ "web-origins",
+ "acr"
+ ],
+ "defaultOptionalClientScopes": [
+ "offline_access",
+ "address",
+ "phone",
+ "microprofile-jwt"
+ ],
+ "browserSecurityHeaders": {
+ "contentSecurityPolicyReportOnly": "",
+ "xContentTypeOptions": "nosniff",
+ "xRobotsTag": "none",
+ "xFrameOptions": "SAMEORIGIN",
+ "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+ "xXSSProtection": "1; mode=block",
+ "strictTransportSecurity": "max-age=31536000; includeSubDomains"
+ },
+ "smtpServer": {},
+ "loginTheme": "keycloak-dsfr",
+ "eventsEnabled": true,
+ "eventsExpiration": 86400,
+ "eventsListeners": ["jboss-logging"],
+ "enabledEventTypes": [],
+ "adminEventsEnabled": true,
+ "adminEventsDetailsEnabled": false,
+ "identityProviders": [
+ {
+ "alias": "franceconnect-particulier",
+ "internalId": "811dc141-3dbc-4f36-b434-e916b63cce84",
+ "providerId": "franceconnect-particulier",
+ "enabled": true,
+ "updateProfileFirstLoginMode": "on",
+ "trustEmail": false,
+ "storeToken": false,
+ "addReadTokenRoleOnCreate": false,
+ "authenticateByDefault": false,
+ "linkOnly": false,
+ "firstBrokerLoginFlowAlias": "first broker login",
+ "config": {
+ "eidas_values": "eidas1",
+ "isCreated": "true",
+ "clientId": "123",
+ "fc_environment": "integration_v1",
+ "syncMode": "IMPORT",
+ "clientSecret": "123",
+ "defaultScope": "openid email",
+ "useJwksUrl": "true"
+ }
+ }
+ ],
+ "identityProviderMappers": [
+ {
+ "id": "f3aae5e1-89ca-40b1-9ee6-6b988bd857ff",
+ "name": "firstName",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "given_name",
+ "user.attribute": "firstName"
+ }
+ },
+ {
+ "id": "213673a8-0d44-43ea-89b3-abf9f3ea0769",
+ "name": "provider",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "hardcoded-attribute-idp-mapper",
+ "config": {
+ "attribute.value": "FC",
+ "syncMode": "INHERIT",
+ "attribute": "provider"
+ }
+ },
+ {
+ "id": "fb1a4128-0e26-4ec2-9ee4-827d04d31327",
+ "name": "lastName",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "family_name",
+ "user.attribute": "lastName"
+ }
+ },
+ {
+ "id": "d62e0104-20d5-4fb8-b8b3-f351c570aaf1",
+ "name": "email",
+ "identityProviderAlias": "franceconnect-particulier",
+ "identityProviderMapper": "franceconnect-user-attribute-mapper",
+ "config": {
+ "syncMode": "INHERIT",
+ "claim": "email",
+ "user.attribute": "email"
+ }
+ }
+ ],
+ "components": {
+ "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
+ {
+ "id": "d9fa6d0d-ca14-4ff5-a604-4224c0e6b5c3",
+ "name": "Full Scope Disabled",
+ "providerId": "scope",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {}
+ },
+ {
+ "id": "d155a354-0713-413e-9b6d-2cab023dda09",
+ "name": "Trusted Hosts",
+ "providerId": "trusted-hosts",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "host-sending-registration-request-must-match": ["true"],
+ "client-uris-must-match": ["true"]
+ }
+ },
+ {
+ "id": "7e0fdbb8-cd10-42f2-a9cd-b0749c4d8f07",
+ "name": "Allowed Client Scopes",
+ "providerId": "allowed-client-templates",
+ "subType": "authenticated",
+ "subComponents": {},
+ "config": {
+ "allow-default-scopes": ["true"]
+ }
+ },
+ {
+ "id": "5b8508c1-1077-4a67-83d5-1931d7028ae1",
+ "name": "Allowed Protocol Mapper Types",
+ "providerId": "allowed-protocol-mappers",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "allowed-protocol-mapper-types": [
+ "saml-user-property-mapper",
+ "oidc-usermodel-attribute-mapper",
+ "saml-user-attribute-mapper",
+ "saml-role-list-mapper",
+ "oidc-usermodel-property-mapper",
+ "oidc-full-name-mapper",
+ "oidc-sha256-pairwise-sub-mapper",
+ "oidc-address-mapper"
+ ]
+ }
+ },
+ {
+ "id": "661574d5-9c7e-472d-b2e8-500358fd4202",
+ "name": "Consent Required",
+ "providerId": "consent-required",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {}
+ },
+ {
+ "id": "435264a5-7be1-4476-ac55-8c4e8cf2e2c2",
+ "name": "Max Clients Limit",
+ "providerId": "max-clients",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "max-clients": ["200"]
+ }
+ },
+ {
+ "id": "4e672291-b498-4bc6-841e-221ef10716b1",
+ "name": "Allowed Protocol Mapper Types",
+ "providerId": "allowed-protocol-mappers",
+ "subType": "authenticated",
+ "subComponents": {},
+ "config": {
+ "allowed-protocol-mapper-types": [
+ "oidc-usermodel-property-mapper",
+ "saml-role-list-mapper",
+ "oidc-usermodel-attribute-mapper",
+ "oidc-full-name-mapper",
+ "saml-user-property-mapper",
+ "saml-user-attribute-mapper",
+ "oidc-address-mapper",
+ "oidc-sha256-pairwise-sub-mapper"
+ ]
+ }
+ },
+ {
+ "id": "01706ca3-d0a4-4e33-addc-77b47ef45ff6",
+ "name": "Allowed Client Scopes",
+ "providerId": "allowed-client-templates",
+ "subType": "anonymous",
+ "subComponents": {},
+ "config": {
+ "allow-default-scopes": ["true"]
+ }
+ }
+ ],
+ "org.keycloak.userprofile.UserProfileProvider": [
+ {
+ "id": "3a66433c-1fb9-480a-9266-f89370f9163b",
+ "providerId": "declarative-user-profile",
+ "subComponents": {},
+ "config": {}
+ }
+ ],
+ "org.keycloak.keys.KeyProvider": [
+ {
+ "id": "874258e0-a7b7-4f4d-bbc8-bff008034771",
+ "name": "hmac-generated",
+ "providerId": "hmac-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"],
+ "algorithm": ["HS256"]
+ }
+ },
+ {
+ "id": "194a1f68-7c81-4430-bda3-4df117acff81",
+ "name": "aes-generated",
+ "providerId": "aes-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"]
+ }
+ },
+ {
+ "id": "32cf572a-a632-44f4-bd78-e7e74d5c6dff",
+ "name": "rsa-enc-generated",
+ "providerId": "rsa-enc-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"],
+ "algorithm": ["RSA-OAEP"]
+ }
+ },
+ {
+ "id": "e6793a0b-37b5-4ba7-afd6-b5efb592b281",
+ "name": "rsa-generated",
+ "providerId": "rsa-generated",
+ "subComponents": {},
+ "config": {
+ "priority": ["100"]
+ }
+ }
+ ]
+ },
+ "internationalizationEnabled": true,
+ "supportedLocales": [
+ "de",
+ "no",
+ "ru",
+ "sv",
+ "pt-BR",
+ "lt",
+ "en",
+ "it",
+ "fr",
+ "hu",
+ "zh-CN",
+ "es",
+ "cs",
+ "ja",
+ "sk",
+ "pl",
+ "da",
+ "ca",
+ "nl",
+ "tr"
+ ],
+ "defaultLocale": "fr",
+ "authenticationFlows": [
+ {
+ "id": "9fecefb4-86da-46b6-a942-12ae1bb972c7",
+ "alias": "Account verification options",
+ "description": "Method with which to verity the existing account",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-email-verification",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Verify Existing Account by Re-authentication",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "038ef19f-7553-487c-a3e2-62b6ddffa5bb",
+ "alias": "Authentication Options",
+ "description": "Authentication options.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "basic-auth",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "basic-auth-otp",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-spnego",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "de1da099-2cf0-463c-992b-34152215c884",
+ "alias": "Browser - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-otp-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "6c151ab1-bae0-4af3-9aaf-ceae80230f6a",
+ "alias": "Direct Grant - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "direct-grant-validate-otp",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "b31cb115-ac43-42c3-aea2-03437f4debe6",
+ "alias": "First broker login - Conditional OTP",
+ "description": "Flow to determine if the OTP is required for the authentication",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-otp-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "f6c89b0d-92f7-4452-b0b2-4328ff03ed4e",
+ "alias": "Handle Existing Account",
+ "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-confirm-link",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Account verification options",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "547ba007-bf6c-4ee8-ac37-7f5d50567f49",
+ "alias": "Reset - Conditional OTP",
+ "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "conditional-user-configured",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-otp",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7d509daf-9267-429e-9a77-6d515028df30",
+ "alias": "User creation or linking",
+ "description": "Flow for the existing/non-existing user alternatives",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticatorConfig": "create unique user config",
+ "authenticator": "idp-create-user-if-unique",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Handle Existing Account",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "4e58afd5-42f9-400a-98b0-efff7c6e45f1",
+ "alias": "Verify Existing Account by Re-authentication",
+ "description": "Reauthentication of existing account",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "idp-username-password-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "First broker login - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "bfd251da-826e-4e08-bbe6-573a47d03d60",
+ "alias": "browser",
+ "description": "browser based authentication",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "auth-cookie",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "auth-spnego",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "identity-provider-redirector",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 25,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "ALTERNATIVE",
+ "priority": 30,
+ "autheticatorFlow": true,
+ "flowAlias": "forms",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "0688e4ec-888a-4a9b-9e5f-5fe7f9f8bc3e",
+ "alias": "clients",
+ "description": "Base authentication for clients",
+ "providerId": "client-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "client-secret",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-jwt",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-secret-jwt",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "client-x509",
+ "authenticatorFlow": false,
+ "requirement": "ALTERNATIVE",
+ "priority": 40,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "9a83a302-1ef6-44b9-b8bd-2efd0b143535",
+ "alias": "direct grant",
+ "description": "OpenID Connect Resource Owner Grant",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "direct-grant-validate-username",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "direct-grant-validate-password",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 30,
+ "autheticatorFlow": true,
+ "flowAlias": "Direct Grant - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "a3686832-308e-4f00-b1f5-7fe247520fc2",
+ "alias": "docker auth",
+ "description": "Used by Docker clients to authenticate against the IDP",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "docker-http-basic-authenticator",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "ffe5edf2-d51c-4de2-b866-deb4c7c2e22f",
+ "alias": "first broker login",
+ "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticatorConfig": "review profile config",
+ "authenticator": "idp-review-profile",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "User creation or linking",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7e8e1b3e-3162-4a89-91e7-6ac30067f910",
+ "alias": "forms",
+ "description": "Username, password, otp and other auth forms.",
+ "providerId": "basic-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "auth-username-password-form",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Browser - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "33c79d8a-5000-4165-ab71-9a3bb811c0af",
+ "alias": "http challenge",
+ "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "no-cookie-redirect",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": true,
+ "flowAlias": "Authentication Options",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "49a680e1-0358-489f-b7e7-fcd32f739354",
+ "alias": "registration",
+ "description": "registration flow",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "registration-page-form",
+ "authenticatorFlow": true,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": true,
+ "flowAlias": "registration form",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "b93852b8-d7c2-4548-a4f9-5d2f44ee15a5",
+ "alias": "registration form",
+ "description": "registration form",
+ "providerId": "form-flow",
+ "topLevel": false,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "registration-user-creation",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-profile-action",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 40,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-password-action",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 50,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "registration-recaptcha-action",
+ "authenticatorFlow": false,
+ "requirement": "DISABLED",
+ "priority": 60,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "f234aee1-2af8-4c5d-a4cb-a5bb89b26e9f",
+ "alias": "reset credentials",
+ "description": "Reset credentials for a user if they forgot their password or something",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "reset-credentials-choose-user",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-credential-email",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 20,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticator": "reset-password",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 30,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ },
+ {
+ "authenticatorFlow": true,
+ "requirement": "CONDITIONAL",
+ "priority": 40,
+ "autheticatorFlow": true,
+ "flowAlias": "Reset - Conditional OTP",
+ "userSetupAllowed": false
+ }
+ ]
+ },
+ {
+ "id": "7cd9b926-259b-4665-bb6e-bd97ab17ea92",
+ "alias": "saml ecp",
+ "description": "SAML ECP Profile Authentication Flow",
+ "providerId": "basic-flow",
+ "topLevel": true,
+ "builtIn": true,
+ "authenticationExecutions": [
+ {
+ "authenticator": "http-basic-authenticator",
+ "authenticatorFlow": false,
+ "requirement": "REQUIRED",
+ "priority": 10,
+ "autheticatorFlow": false,
+ "userSetupAllowed": false
+ }
+ ]
+ }
+ ],
+ "authenticatorConfig": [
+ {
+ "id": "231d66cc-34c0-4354-9018-f48434b6b3cc",
+ "alias": "create unique user config",
+ "config": {
+ "require.password.update.after.registration": "false"
+ }
+ },
+ {
+ "id": "3e3c05d1-f0af-43bb-952d-73b1e1627a43",
+ "alias": "review profile config",
+ "config": {
+ "update.profile.on.first.login": "missing"
+ }
+ }
+ ],
+ "requiredActions": [
+ {
+ "alias": "CONFIGURE_TOTP",
+ "name": "Configure OTP",
+ "providerId": "CONFIGURE_TOTP",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 10,
+ "config": {}
+ },
+ {
+ "alias": "terms_and_conditions",
+ "name": "Terms and Conditions",
+ "providerId": "terms_and_conditions",
+ "enabled": false,
+ "defaultAction": false,
+ "priority": 20,
+ "config": {}
+ },
+ {
+ "alias": "UPDATE_PASSWORD",
+ "name": "Update Password",
+ "providerId": "UPDATE_PASSWORD",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 30,
+ "config": {}
+ },
+ {
+ "alias": "UPDATE_PROFILE",
+ "name": "Update Profile",
+ "providerId": "UPDATE_PROFILE",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 40,
+ "config": {}
+ },
+ {
+ "alias": "VERIFY_EMAIL",
+ "name": "Verify Email",
+ "providerId": "VERIFY_EMAIL",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 50,
+ "config": {}
+ },
+ {
+ "alias": "delete_account",
+ "name": "Delete Account",
+ "providerId": "delete_account",
+ "enabled": false,
+ "defaultAction": false,
+ "priority": 60,
+ "config": {}
+ },
+ {
+ "alias": "update_user_locale",
+ "name": "Update User Locale",
+ "providerId": "update_user_locale",
+ "enabled": true,
+ "defaultAction": false,
+ "priority": 1000,
+ "config": {}
+ }
+ ],
+ "browserFlow": "browser",
+ "registrationFlow": "registration",
+ "directGrantFlow": "direct grant",
+ "resetCredentialsFlow": "reset credentials",
+ "clientAuthenticationFlow": "clients",
+ "dockerAuthenticationFlow": "docker auth",
+ "attributes": {
+ "cibaBackchannelTokenDeliveryMode": "poll",
+ "cibaExpiresIn": "120",
+ "cibaAuthRequestedUserHint": "login_hint",
+ "oauth2DeviceCodeLifespan": "600",
+ "clientOfflineSessionMaxLifespan": "0",
+ "oauth2DevicePollingInterval": "5",
+ "clientSessionIdleTimeout": "0",
+ "userProfileEnabled": "false",
+ "parRequestUriLifespan": "60",
+ "clientSessionMaxLifespan": "0",
+ "clientOfflineSessionIdleTimeout": "0",
+ "cibaInterval": "5"
+ },
+ "keycloakVersion": "18.0.0",
+ "userManagedAccessAllowed": true,
+ "clientProfiles": {
+ "profiles": []
+ },
+ "clientPolicies": {
+ "policies": []
+ }
+}
diff --git a/keycloak/providers/keycloak-franceconnect-4.1.0.jar b/keycloak/providers/keycloak-franceconnect-4.1.0.jar
new file mode 100644
index 00000000..5eb2ede6
Binary files /dev/null and b/keycloak/providers/keycloak-franceconnect-4.1.0.jar differ
diff --git a/keycloak/providers/keycloak-theme.jar b/keycloak/providers/keycloak-theme.jar
new file mode 100644
index 00000000..24b710fd
Binary files /dev/null and b/keycloak/providers/keycloak-theme.jar differ
diff --git a/keycloak/scripts/keycloak.sh b/keycloak/scripts/keycloak.sh
new file mode 100755
index 00000000..9afe350c
--- /dev/null
+++ b/keycloak/scripts/keycloak.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# This script creates keycloak/config/realm-export-local.json for local docker-compose developement
+
+export NEXTAUTH_URL=http://localhost:3000
+export KEYCLOAK_CLIENT_SECRET=**********
+export FRANCE_CONNECT_CLIENT_ID=123
+export FRANCE_CONNECT_CLIENT_SECRET=123
+export SMTP_HOST=smtp.tipimail.com
+export SMTP_USER=smtp-user
+export SMTP_PASSWORD=smtp-password
+export SMTP_SSL=false
+cat .kontinuous/files/realm-export.json | gomplate > keycloak/config/realm-export-local.json
diff --git a/next.config.js b/next.config.js
index eae98495..5b8ab94f 100644
--- a/next.config.js
+++ b/next.config.js
@@ -13,8 +13,6 @@ const moduleExports = {
},
env: {
NEXT_PUBLIC_APP_VERSION: version,
- NEXT_PUBLIC_APP_VERSION_COMMIT: process.env.GITHUB_SHA,
- NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT: process.env.PRODUCTION,
},
};
diff --git a/package.json b/package.json
index 456b0f51..e9ce59a2 100644
--- a/package.json
+++ b/package.json
@@ -10,8 +10,6 @@
"lint": "next lint",
"prepare": "husky install",
"lint-staged": "lint-staged",
- "export": "next export",
- "build:export": "npm run build && npm run export",
"e2e": "cypress open",
"e2e:headless": "cypress run",
"test": "jest",
@@ -23,7 +21,8 @@
"storybook:deploy": "npm run storybook:build && gh-pages -d .out",
"storybook:deploy:action": "npm run storybook:build && gh-pages -d .out -u \"github-actions-bot \"",
"type-check": "tsc --noEmit",
- "type-check:watch": "npm run type-check -- --watch"
+ "type-check:watch": "npm run type-check -- --watch",
+ "keycloak": "chmod +x keycloak/scripts/keycloak.sh && keycloak/scripts/keycloak.sh"
},
"dependencies": {
"@dataesr/react-dsfr": "^1.0.5",
@@ -31,9 +30,10 @@
"@sentry/nextjs": "^6.17.9",
"@socialgouv/matomo-next": "^1.2.2",
"next": "12.1.6",
+ "next-auth": "4.5.0",
"next-seo": "^5.1.0",
- "react": "17.0.2",
- "react-dom": "17.0.2"
+ "react": "^18.1.0",
+ "react-dom": "^18.1.0"
},
"devDependencies": {
"@babel/core": "^7.17.5",
@@ -46,8 +46,8 @@
"@swc-node/register": "^1.4.2",
"@testing-library/jest-dom": "^5.16.2",
"@testing-library/react": "^12.1.2",
- "@types/node": "17.0.13",
- "@types/react": "17.0.44",
+ "@types/node": "^17.0.33",
+ "@types/react": "^18.0.9",
"cypress": "^9.4.1",
"eslint": "8.14.0",
"eslint-config-next": "12.1.6",
diff --git a/scripts/prebuild.ts b/scripts/prebuild.ts
index 1825e38c..c0a553f8 100644
--- a/scripts/prebuild.ts
+++ b/scripts/prebuild.ts
@@ -20,9 +20,9 @@ export const generateRobotsTxt = (isOnProduction: boolean, host: string) => {
const run = () => {
generateRobotsTxt(
process.env.NEXT_PUBLIC_IS_PRODUCTION_DEPLOYMENT ? true : false,
- process.env.NEXT_PUBLIC_SITE_URL ?? "localhost"
+ process.env.NEXT_PUBLIC_HOST ?? "template.fabrique.social.gouv.fr"
);
- console.log("Robots.txt generated.");
+ console.log("Robots.txt generated");
};
run();
diff --git a/src/components/auth/header.tsx b/src/components/auth/header.tsx
new file mode 100644
index 00000000..6348c0e6
--- /dev/null
+++ b/src/components/auth/header.tsx
@@ -0,0 +1,32 @@
+import { ToolItem, Tag } from "@dataesr/react-dsfr";
+
+import { useSession, signIn, signOut } from "next-auth/react";
+
+const Index = (): JSX.Element => {
+ const { data: session } = useSession();
+
+ return (
+ <>
+ {session ? (
+ <>
+
+ {session.user?.email}
+
+
+ signOut({
+ callbackUrl: "/api/logout",
+ })
+ }
+ >
+ Se déconnecter
+
+
+ ) : (
+ signIn("keycloak")}>Se connecter
+ )}
+
+ );
+};
+
+export default Index;
diff --git a/src/components/auth/index.ts b/src/components/auth/index.ts
new file mode 100644
index 00000000..cb649ad4
--- /dev/null
+++ b/src/components/auth/index.ts
@@ -0,0 +1 @@
+export { default as AuthHeader } from "./header";
diff --git a/src/components/header/index.tsx b/src/components/header/index.tsx
index a50f82d2..87eb97e6 100644
--- a/src/components/header/index.tsx
+++ b/src/components/header/index.tsx
@@ -38,6 +38,7 @@ const Index = (props: HeaderProps): JSX.Element => (
/>
+ {props.authHeader?.()}
{props.bodyItems?.map((item, index) => (
{item.title}
diff --git a/src/components/header/type.ts b/src/components/header/type.ts
index a36abd06..331a7957 100644
--- a/src/components/header/type.ts
+++ b/src/components/header/type.ts
@@ -45,6 +45,7 @@ export type HeaderProps = {
closeButtonLabel?: string;
navItems: Array;
skipLinksProps?: SkipLinksProps;
+ authHeader?: () => JSX.Element;
};
export type SwitchProps = {
diff --git a/src/components/index.ts b/src/components/index.ts
index 82417980..1966c454 100644
--- a/src/components/index.ts
+++ b/src/components/index.ts
@@ -7,3 +7,4 @@ export * from "./footer/type";
export * from "./landing";
export * from "./mention";
export * from "./stats";
+export * from "./auth";
diff --git a/src/config/layout.ts b/src/config/layout.ts
index 61f495a1..c7afc4de 100644
--- a/src/config/layout.ts
+++ b/src/config/layout.ts
@@ -1,4 +1,5 @@
import {
+ AuthHeader,
FooterBodySectionProps,
FooterBottomSectionProps,
FooterPartnerSectionProps,
@@ -87,6 +88,7 @@ export const headerProps: HeaderProps = {
},
],
closeButtonLabel: "Fermer",
+ authHeader: AuthHeader,
};
export const footerTopSection: FooterTopSectionProps = {
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 00000000..f1baa334
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,19 @@
+import { NextPageContext } from "next";
+import { getSession } from "next-auth/react";
+
+export function withAuth(
+ getServerSideProps: (context: NextPageContext) => any
+) {
+ return async (context: NextPageContext) => {
+ const session = await getSession({ req: context.req });
+ if (!session) {
+ return {
+ redirect: {
+ permanent: false,
+ destination: "/api/auth/signin",
+ },
+ };
+ }
+ return await getServerSideProps(context);
+ };
+}
diff --git a/src/lib/index.ts b/src/lib/index.ts
index 979bc643..29fbb201 100644
--- a/src/lib/index.ts
+++ b/src/lib/index.ts
@@ -1 +1,2 @@
export * from "./matomo";
+export * from "./auth";
diff --git a/src/pages/_app.tsx b/src/pages/_app.tsx
index 906bd2cf..31c2de93 100644
--- a/src/pages/_app.tsx
+++ b/src/pages/_app.tsx
@@ -12,6 +12,7 @@ import {
import { useEffect } from "react";
import { init } from "@socialgouv/matomo-next";
import { DefaultSeo } from "next-seo";
+import { SessionProvider } from "next-auth/react";
function MyApp({ Component, pageProps }: AppProps) {
useEffect(() => {
@@ -22,18 +23,20 @@ function MyApp({ Component, pageProps }: AppProps) {
}, []);
return (
-
-
-
-
+
+
+
+
+
+
);
}
diff --git a/src/pages/api/auth/[...nextauth].ts b/src/pages/api/auth/[...nextauth].ts
new file mode 100644
index 00000000..9c154222
--- /dev/null
+++ b/src/pages/api/auth/[...nextauth].ts
@@ -0,0 +1,12 @@
+import NextAuth from "next-auth";
+import KeycloakProvider from "next-auth/providers/keycloak";
+
+export default NextAuth({
+ providers: [
+ KeycloakProvider({
+ clientId: process.env.KEYCLOAK_CLIENT_ID ?? "",
+ clientSecret: process.env.KEYCLOAK_CLIENT_SECRET ?? "",
+ issuer: process.env.KEYCLOAK_URL ?? "",
+ }),
+ ],
+});
diff --git a/src/pages/api/logout.ts b/src/pages/api/logout.ts
new file mode 100644
index 00000000..fc0f9c2b
--- /dev/null
+++ b/src/pages/api/logout.ts
@@ -0,0 +1,19 @@
+import { NextApiRequest, NextApiResponse } from "next";
+
+const logout = (req: NextApiRequest, res: NextApiResponse) => {
+ /**
+ * TODO: https://www.keycloak.org/2022/04/keycloak-1800-released.html
+ *
+ * add `post_logout_redirect_uri` and `id_token_hint` to logout transparently with KeyCloak
+ *
+ */
+ const path = `${
+ process.env.KEYCLOAK_URL
+ }/protocol/openid-connect/logout?redirect_uri=${encodeURIComponent(
+ process.env.NEXTAUTH_URL || ""
+ )}`;
+
+ res.redirect(path);
+};
+
+export default logout;
diff --git a/src/pages/profil.tsx b/src/pages/profil.tsx
new file mode 100644
index 00000000..ab11a63f
--- /dev/null
+++ b/src/pages/profil.tsx
@@ -0,0 +1,30 @@
+import React from "react";
+import { withAuth } from "@lib";
+import { useSession } from "next-auth/react";
+
+const IndexPage = () => {
+ const { data: session } = useSession();
+ return (
+
+
Mes informations
+
+
+ -
+ Email :
+ {session?.user?.email ?? ""}
+
+ -
+ Name :
+ {session?.user?.name}
+
+
+
+