From 221f13df332beaf0a7b526622c3bdd503ac9a680 Mon Sep 17 00:00:00 2001 From: Adam Bartosik Date: Thu, 15 Oct 2026 13:01:37 +0200 Subject: [PATCH 1/3] feat(dpav3311) iam keyclock client --- docker/keycloak/tofu/terraform.tfvars | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docker/keycloak/tofu/terraform.tfvars b/docker/keycloak/tofu/terraform.tfvars index 260fccd9..43e1e0b9 100644 --- a/docker/keycloak/tofu/terraform.tfvars +++ b/docker/keycloak/tofu/terraform.tfvars @@ -59,6 +59,16 @@ federator_clients = [ roles = ["access_producer_configurations", "access_consumer_configurations", "sign_certificate", "access_public_certificates", "create_keys", "product_discovery", "product_view", "product_subscribe"] } ] + }, + { + client = "IAM_INTEGRATION_SERVICE" + roles = [] + mapped_client_roles = [ + { + client = "realm-management" + roles = ["realm-admin"] + } + ] } ] From f792c72aa9734d38a18bb821690413f6059f7274 Mon Sep 17 00:00:00 2001 From: Adam Bartosik Date: Thu, 15 Oct 2026 17:54:44 +0200 Subject: [PATCH 2/3] feat(dpav3311) iam keycloak client --- docker/keycloak/tofu/clients.tf | 13 ++++++++----- docker/keycloak/tofu/terraform.tfvars | 2 ++ docker/keycloak/tofu/variables.tf | 3 +++ 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/docker/keycloak/tofu/clients.tf b/docker/keycloak/tofu/clients.tf index 209840ea..4fe04374 100644 --- a/docker/keycloak/tofu/clients.tf +++ b/docker/keycloak/tofu/clients.tf @@ -114,11 +114,14 @@ module "federator_client" { client_access_token_lifespan_seconds = var.client_access_token_lifespan_seconds # Reuse the same default client scopes as the other federator clients - default_client_scopes = [ - "FEDERATOR_CONSUMER", - "FEDERATOR_PRODUCER", - "MANAGEMENT_NODE_ACCESS" - ] + default_client_scopes = concat( + [ + "FEDERATOR_CONSUMER", + "FEDERATOR_PRODUCER", + "MANAGEMENT_NODE_ACCESS" + ], + lookup(each.value, "extra_default_client_scopes", []) + ) # Create roles under this client custom_roles = [ diff --git a/docker/keycloak/tofu/terraform.tfvars b/docker/keycloak/tofu/terraform.tfvars index 43e1e0b9..7c76d9b0 100644 --- a/docker/keycloak/tofu/terraform.tfvars +++ b/docker/keycloak/tofu/terraform.tfvars @@ -63,6 +63,8 @@ federator_clients = [ { client = "IAM_INTEGRATION_SERVICE" roles = [] + # Puts realm-management into the token, which the Keycloak admin API requires. + extra_default_client_scopes = ["roles"] mapped_client_roles = [ { client = "realm-management" diff --git a/docker/keycloak/tofu/variables.tf b/docker/keycloak/tofu/variables.tf index 2c0ac271..d48ca3c8 100644 --- a/docker/keycloak/tofu/variables.tf +++ b/docker/keycloak/tofu/variables.tf @@ -52,6 +52,9 @@ variable "federator_clients" { # Organisation key for the client's "organisation" claim; must match # organisation.organisation_key in the database (e.g. "ENV"). organisation = optional(string) + # Extra default client scopes on top of the three every federator client gets. The IAM service + # needs "roles", so its token carries realm-management (the Keycloak admin API reads it there). + extra_default_client_scopes = optional(list(string), []) mapped_client_roles = optional(list(object({ client = string roles = list(string) From 65fff654a1597746128282540739d012107bd037 Mon Sep 17 00:00:00 2001 From: Adam Bartosik Date: Fri, 16 Oct 2026 11:23:17 +0200 Subject: [PATCH 3/3] feat(dpav3311) iam keycloak client --- docker/keycloak/tofu/clients.tf | 15 ++++++--------- docker/keycloak/tofu/terraform.tfvars | 5 +++-- docker/keycloak/tofu/variables.tf | 6 +++--- 3 files changed, 12 insertions(+), 14 deletions(-) diff --git a/docker/keycloak/tofu/clients.tf b/docker/keycloak/tofu/clients.tf index 4fe04374..e151786d 100644 --- a/docker/keycloak/tofu/clients.tf +++ b/docker/keycloak/tofu/clients.tf @@ -113,15 +113,12 @@ module "federator_client" { # Token lifespan for this client client_access_token_lifespan_seconds = var.client_access_token_lifespan_seconds - # Reuse the same default client scopes as the other federator clients - default_client_scopes = concat( - [ - "FEDERATOR_CONSUMER", - "FEDERATOR_PRODUCER", - "MANAGEMENT_NODE_ACCESS" - ], - lookup(each.value, "extra_default_client_scopes", []) - ) + # The same default client scopes as the other federator clients, unless the client sets its own + default_client_scopes = lookup(each.value, "default_client_scopes", null) != null ? each.value.default_client_scopes : [ + "FEDERATOR_CONSUMER", + "FEDERATOR_PRODUCER", + "MANAGEMENT_NODE_ACCESS" + ] # Create roles under this client custom_roles = [ diff --git a/docker/keycloak/tofu/terraform.tfvars b/docker/keycloak/tofu/terraform.tfvars index 7c76d9b0..8d938cfe 100644 --- a/docker/keycloak/tofu/terraform.tfvars +++ b/docker/keycloak/tofu/terraform.tfvars @@ -63,8 +63,9 @@ federator_clients = [ { client = "IAM_INTEGRATION_SERVICE" roles = [] - # Puts realm-management into the token, which the Keycloak admin API requires. - extra_default_client_scopes = ["roles"] + # Not a federator, so none of the federator scopes. It only calls the Keycloak admin API, which + # reads realm-management from the token, and the roles scope puts it there. + default_client_scopes = ["roles"] mapped_client_roles = [ { client = "realm-management" diff --git a/docker/keycloak/tofu/variables.tf b/docker/keycloak/tofu/variables.tf index d48ca3c8..ea79c7ab 100644 --- a/docker/keycloak/tofu/variables.tf +++ b/docker/keycloak/tofu/variables.tf @@ -52,9 +52,9 @@ variable "federator_clients" { # Organisation key for the client's "organisation" claim; must match # organisation.organisation_key in the database (e.g. "ENV"). organisation = optional(string) - # Extra default client scopes on top of the three every federator client gets. The IAM service - # needs "roles", so its token carries realm-management (the Keycloak admin API reads it there). - extra_default_client_scopes = optional(list(string), []) + # Default client scopes for a client that is not a federator. When unset, the client gets the + # federator scopes (FEDERATOR_CONSUMER, FEDERATOR_PRODUCER, MANAGEMENT_NODE_ACCESS). + default_client_scopes = optional(list(string)) mapped_client_roles = optional(list(object({ client = string roles = list(string)