feat(dpav3311) iam keycloak client

docker/keycloak/tofu/clients.tf

@@ -113,8 +113,8 @@ module "federator_client" {
   # Token lifespan for this client
   client_access_token_lifespan_seconds = var.client_access_token_lifespan_seconds
 
-  # Reuse the same default client scopes as the other federator clients
-  default_client_scopes = [
+  # The same default client scopes as the other federator clients, unless the client sets its own
+  default_client_scopes = lookup(each.value, "default_client_scopes", null) != null ? each.value.default_client_scopes : [
     "FEDERATOR_CONSUMER",
     "FEDERATOR_PRODUCER",
     "MANAGEMENT_NODE_ACCESS"

docker/keycloak/tofu/terraform.tfvars

@@ -59,6 +59,19 @@ federator_clients = [
         roles  = ["access_producer_configurations", "access_consumer_configurations", "sign_certificate", "access_public_certificates", "create_keys", "product_discovery", "product_view", "product_subscribe"]
       }
     ]
+  },
+  {
+    client = "IAM_INTEGRATION_SERVICE"
+    roles  = []
+    # Not a federator, so none of the federator scopes. It only calls the Keycloak admin API, which
+    # reads realm-management from the token, and the roles scope puts it there.
+    default_client_scopes = ["roles"]
+    mapped_client_roles = [
+      {
+        client = "realm-management"
+        roles  = ["realm-admin"]
+      }
+    ]
   }
 ]
 

docker/keycloak/tofu/variables.tf

@@ -52,6 +52,9 @@ variable "federator_clients" {
     # Organisation key for the client's "organisation" claim; must match
     # organisation.organisation_key in the database (e.g. "ENV").
     organisation = optional(string)
+    # Default client scopes for a client that is not a federator. When unset, the client gets the
+    # federator scopes (FEDERATOR_CONSUMER, FEDERATOR_PRODUCER, MANAGEMENT_NODE_ACCESS).
+    default_client_scopes = optional(list(string))
     mapped_client_roles = optional(list(object({
       client = string
       roles  = list(string)