conjur-api 5.3.7.pre.168 → 5.3.8.pre.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop_settings.yml +1 -1
- data/CHANGELOG.md +16 -1
- data/CONTRIBUTING.md +1 -4
- data/Jenkinsfile +8 -38
- data/VERSION +1 -1
- data/bin/parse-changelog.sh +1 -1
- data/ci/configure_v5.sh +5 -0
- data/ci/oauth/keycloak/create_client +18 -0
- data/ci/oauth/keycloak/create_user +21 -0
- data/ci/oauth/keycloak/fetch_certificate +18 -0
- data/ci/oauth/keycloak/keycloak_functions.sh +71 -0
- data/ci/oauth/keycloak/standalone.xml +578 -0
- data/ci/oauth/keycloak/wait_for_server +56 -0
- data/conjur-api.gemspec +1 -0
- data/dev/Dockerfile.dev +1 -1
- data/dev/start +5 -0
- data/docker-compose.yml +23 -1
- data/features/authenticators.feature +8 -0
- data/features/authn.feature +14 -0
- data/features/step_definitions/api_steps.rb +34 -0
- data/features/step_definitions/policy_steps.rb +59 -0
- data/features/step_definitions/result_steps.rb +4 -0
- data/features/support/env.rb +1 -0
- data/lib/conjur/api/authenticators.rb +8 -0
- data/lib/conjur/api/authn.rb +19 -0
- data/lib/conjur/api/router/v5.rb +21 -0
- data/publish.sh +3 -5
- data/test.sh +8 -1
- metadata +28 -6
|
@@ -0,0 +1,578 @@
|
|
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
|
2
|
+
|
|
3
|
+
<server xmlns="urn:jboss:domain:5.0">
|
|
4
|
+
<extensions>
|
|
5
|
+
<extension module="org.jboss.as.clustering.infinispan"/>
|
|
6
|
+
<extension module="org.jboss.as.connector"/>
|
|
7
|
+
<extension module="org.jboss.as.deployment-scanner"/>
|
|
8
|
+
<extension module="org.jboss.as.ee"/>
|
|
9
|
+
<extension module="org.jboss.as.ejb3"/>
|
|
10
|
+
<extension module="org.jboss.as.jaxrs"/>
|
|
11
|
+
<extension module="org.jboss.as.jmx"/>
|
|
12
|
+
<extension module="org.jboss.as.jpa"/>
|
|
13
|
+
<extension module="org.jboss.as.logging"/>
|
|
14
|
+
<extension module="org.jboss.as.mail"/>
|
|
15
|
+
<extension module="org.jboss.as.naming"/>
|
|
16
|
+
<extension module="org.jboss.as.remoting"/>
|
|
17
|
+
<extension module="org.jboss.as.security"/>
|
|
18
|
+
<extension module="org.jboss.as.transactions"/>
|
|
19
|
+
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
|
20
|
+
<extension module="org.wildfly.extension.bean-validation"/>
|
|
21
|
+
<extension module="org.wildfly.extension.elytron"/>
|
|
22
|
+
<extension module="org.wildfly.extension.io"/>
|
|
23
|
+
<extension module="org.wildfly.extension.request-controller"/>
|
|
24
|
+
<extension module="org.wildfly.extension.security.manager"/>
|
|
25
|
+
<extension module="org.wildfly.extension.undertow"/>
|
|
26
|
+
</extensions>
|
|
27
|
+
<management>
|
|
28
|
+
<security-realms>
|
|
29
|
+
<security-realm name="ManagementRealm">
|
|
30
|
+
<authentication>
|
|
31
|
+
<local default-user="$local" skip-group-loading="true"/>
|
|
32
|
+
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
|
|
33
|
+
</authentication>
|
|
34
|
+
<authorization map-groups-to-roles="false">
|
|
35
|
+
<properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
|
36
|
+
</authorization>
|
|
37
|
+
</security-realm>
|
|
38
|
+
<security-realm name="ApplicationRealm">
|
|
39
|
+
<server-identities>
|
|
40
|
+
<ssl>
|
|
41
|
+
<keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="keycloak"/>
|
|
42
|
+
</ssl>
|
|
43
|
+
</server-identities>
|
|
44
|
+
<authentication>
|
|
45
|
+
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
|
|
46
|
+
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
|
|
47
|
+
</authentication>
|
|
48
|
+
<authorization>
|
|
49
|
+
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
|
50
|
+
</authorization>
|
|
51
|
+
</security-realm>
|
|
52
|
+
</security-realms>
|
|
53
|
+
<audit-log>
|
|
54
|
+
<formatters>
|
|
55
|
+
<json-formatter name="json-formatter"/>
|
|
56
|
+
</formatters>
|
|
57
|
+
<handlers>
|
|
58
|
+
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
|
59
|
+
</handlers>
|
|
60
|
+
<logger log-boot="true" log-read-only="false" enabled="false">
|
|
61
|
+
<handlers>
|
|
62
|
+
<handler name="file"/>
|
|
63
|
+
</handlers>
|
|
64
|
+
</logger>
|
|
65
|
+
</audit-log>
|
|
66
|
+
<management-interfaces>
|
|
67
|
+
<http-interface security-realm="ManagementRealm">
|
|
68
|
+
<http-upgrade enabled="true"/>
|
|
69
|
+
<socket-binding http="management-http"/>
|
|
70
|
+
</http-interface>
|
|
71
|
+
</management-interfaces>
|
|
72
|
+
<access-control provider="simple">
|
|
73
|
+
<role-mapping>
|
|
74
|
+
<role name="SuperUser">
|
|
75
|
+
<include>
|
|
76
|
+
<user name="$local"/>
|
|
77
|
+
</include>
|
|
78
|
+
</role>
|
|
79
|
+
</role-mapping>
|
|
80
|
+
</access-control>
|
|
81
|
+
</management>
|
|
82
|
+
<profile>
|
|
83
|
+
<subsystem xmlns="urn:jboss:domain:logging:3.0">
|
|
84
|
+
<console-handler name="CONSOLE">
|
|
85
|
+
<formatter>
|
|
86
|
+
<named-formatter name="COLOR-PATTERN"/>
|
|
87
|
+
</formatter>
|
|
88
|
+
</console-handler>
|
|
89
|
+
<logger category="com.arjuna">
|
|
90
|
+
<level name="WARN"/>
|
|
91
|
+
</logger>
|
|
92
|
+
<logger category="org.jboss.as.config">
|
|
93
|
+
<level name="DEBUG"/>
|
|
94
|
+
</logger>
|
|
95
|
+
<logger category="sun.rmi">
|
|
96
|
+
<level name="WARN"/>
|
|
97
|
+
</logger>
|
|
98
|
+
<logger category="org.keycloak">
|
|
99
|
+
<level name="${env.KEYCLOAK_LOGLEVEL:INFO}"/>
|
|
100
|
+
</logger>
|
|
101
|
+
<root-logger>
|
|
102
|
+
<level name="${env.ROOT_LOGLEVEL:INFO}"/>
|
|
103
|
+
<handlers>
|
|
104
|
+
<handler name="CONSOLE"/>
|
|
105
|
+
</handlers>
|
|
106
|
+
</root-logger>
|
|
107
|
+
<formatter name="PATTERN">
|
|
108
|
+
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
|
109
|
+
</formatter>
|
|
110
|
+
<formatter name="COLOR-PATTERN">
|
|
111
|
+
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
|
112
|
+
</formatter>
|
|
113
|
+
</subsystem>
|
|
114
|
+
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
|
115
|
+
<subsystem xmlns="urn:jboss:domain:datasources:5.0">
|
|
116
|
+
<datasources>
|
|
117
|
+
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true">
|
|
118
|
+
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
|
119
|
+
<driver>h2</driver>
|
|
120
|
+
<security>
|
|
121
|
+
<user-name>sa</user-name>
|
|
122
|
+
<password>sa</password>
|
|
123
|
+
</security>
|
|
124
|
+
</datasource>
|
|
125
|
+
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">
|
|
126
|
+
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
|
127
|
+
<driver>h2</driver>
|
|
128
|
+
<security>
|
|
129
|
+
<user-name>sa</user-name>
|
|
130
|
+
<password>sa</password>
|
|
131
|
+
</security>
|
|
132
|
+
</datasource>
|
|
133
|
+
<drivers>
|
|
134
|
+
<driver name="h2" module="com.h2database.h2">
|
|
135
|
+
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
|
136
|
+
</driver>
|
|
137
|
+
</drivers>
|
|
138
|
+
</datasources>
|
|
139
|
+
</subsystem>
|
|
140
|
+
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
|
141
|
+
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
|
142
|
+
</subsystem>
|
|
143
|
+
<subsystem xmlns="urn:jboss:domain:ee:4.0">
|
|
144
|
+
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
|
145
|
+
<concurrent>
|
|
146
|
+
<context-services>
|
|
147
|
+
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
|
148
|
+
</context-services>
|
|
149
|
+
<managed-thread-factories>
|
|
150
|
+
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
|
151
|
+
</managed-thread-factories>
|
|
152
|
+
<managed-executor-services>
|
|
153
|
+
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-threshold="60000" keepalive-time="5000"/>
|
|
154
|
+
</managed-executor-services>
|
|
155
|
+
<managed-scheduled-executor-services>
|
|
156
|
+
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-threshold="60000" keepalive-time="3000"/>
|
|
157
|
+
</managed-scheduled-executor-services>
|
|
158
|
+
</concurrent>
|
|
159
|
+
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
|
160
|
+
</subsystem>
|
|
161
|
+
<subsystem xmlns="urn:jboss:domain:ejb3:5.0">
|
|
162
|
+
<session-bean>
|
|
163
|
+
<stateless>
|
|
164
|
+
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
|
165
|
+
</stateless>
|
|
166
|
+
<stateful default-access-timeout="5000" cache-ref="simple" passivation-disabled-cache-ref="simple"/>
|
|
167
|
+
<singleton default-access-timeout="5000"/>
|
|
168
|
+
</session-bean>
|
|
169
|
+
<pools>
|
|
170
|
+
<bean-instance-pools>
|
|
171
|
+
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
|
172
|
+
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
|
173
|
+
</bean-instance-pools>
|
|
174
|
+
</pools>
|
|
175
|
+
<caches>
|
|
176
|
+
<cache name="simple"/>
|
|
177
|
+
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
|
178
|
+
</caches>
|
|
179
|
+
<passivation-stores>
|
|
180
|
+
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
|
181
|
+
</passivation-stores>
|
|
182
|
+
<async thread-pool-name="default"/>
|
|
183
|
+
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
|
184
|
+
<data-stores>
|
|
185
|
+
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
|
186
|
+
</data-stores>
|
|
187
|
+
</timer-service>
|
|
188
|
+
<remote connector-ref="http-remoting-connector" thread-pool-name="default">
|
|
189
|
+
<channel-creation-options>
|
|
190
|
+
<option name="READ_TIMEOUT" value="${prop.remoting-connector.read.timeout:20}" type="xnio"/>
|
|
191
|
+
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
|
192
|
+
</channel-creation-options>
|
|
193
|
+
</remote>
|
|
194
|
+
<thread-pools>
|
|
195
|
+
<thread-pool name="default">
|
|
196
|
+
<max-threads count="10"/>
|
|
197
|
+
<keepalive-time time="100" unit="milliseconds"/>
|
|
198
|
+
</thread-pool>
|
|
199
|
+
</thread-pools>
|
|
200
|
+
<default-security-domain value="other"/>
|
|
201
|
+
<default-missing-method-permissions-deny-access value="true"/>
|
|
202
|
+
<log-system-exceptions value="true"/>
|
|
203
|
+
</subsystem>
|
|
204
|
+
<subsystem xmlns="urn:jboss:domain:io:2.0">
|
|
205
|
+
<worker name="default"/>
|
|
206
|
+
<buffer-pool name="default"/>
|
|
207
|
+
</subsystem>
|
|
208
|
+
<subsystem xmlns="urn:jboss:domain:infinispan:4.0">
|
|
209
|
+
<cache-container name="keycloak" jndi-name="infinispan/Keycloak">
|
|
210
|
+
<local-cache name="realms">
|
|
211
|
+
<eviction strategy="LRU" max-entries="10000"/>
|
|
212
|
+
</local-cache>
|
|
213
|
+
<local-cache name="users">
|
|
214
|
+
<eviction strategy="LRU" max-entries="10000"/>
|
|
215
|
+
</local-cache>
|
|
216
|
+
<local-cache name="sessions"/>
|
|
217
|
+
<local-cache name="authenticationSessions"/>
|
|
218
|
+
<local-cache name="offlineSessions"/>
|
|
219
|
+
<local-cache name="clientSessions"/>
|
|
220
|
+
<local-cache name="offlineClientSessions"/>
|
|
221
|
+
<local-cache name="loginFailures"/>
|
|
222
|
+
<local-cache name="work"/>
|
|
223
|
+
<local-cache name="authorization">
|
|
224
|
+
<eviction strategy="LRU" max-entries="10000"/>
|
|
225
|
+
</local-cache>
|
|
226
|
+
<local-cache name="keys">
|
|
227
|
+
<eviction strategy="LRU" max-entries="1000"/>
|
|
228
|
+
<expiration max-idle="3600000"/>
|
|
229
|
+
</local-cache>
|
|
230
|
+
<local-cache name="actionTokens">
|
|
231
|
+
<eviction strategy="NONE" max-entries="-1"/>
|
|
232
|
+
<expiration interval="300000" max-idle="-1"/>
|
|
233
|
+
</local-cache>
|
|
234
|
+
</cache-container>
|
|
235
|
+
<cache-container name="server" default-cache="default" module="org.wildfly.clustering.server">
|
|
236
|
+
<local-cache name="default">
|
|
237
|
+
<transaction mode="BATCH"/>
|
|
238
|
+
</local-cache>
|
|
239
|
+
</cache-container>
|
|
240
|
+
<cache-container name="web" default-cache="passivation" module="org.wildfly.clustering.web.infinispan">
|
|
241
|
+
<local-cache name="passivation">
|
|
242
|
+
<locking isolation="REPEATABLE_READ"/>
|
|
243
|
+
<transaction mode="BATCH"/>
|
|
244
|
+
<file-store passivation="true" purge="false"/>
|
|
245
|
+
</local-cache>
|
|
246
|
+
</cache-container>
|
|
247
|
+
<cache-container name="ejb" aliases="sfsb" default-cache="passivation" module="org.wildfly.clustering.ejb.infinispan">
|
|
248
|
+
<local-cache name="passivation">
|
|
249
|
+
<locking isolation="REPEATABLE_READ"/>
|
|
250
|
+
<transaction mode="BATCH"/>
|
|
251
|
+
<file-store passivation="true" purge="false"/>
|
|
252
|
+
</local-cache>
|
|
253
|
+
</cache-container>
|
|
254
|
+
<cache-container name="hibernate" module="org.hibernate.infinispan">
|
|
255
|
+
<local-cache name="entity">
|
|
256
|
+
<transaction mode="NON_XA"/>
|
|
257
|
+
<eviction strategy="LRU" max-entries="10000"/>
|
|
258
|
+
<expiration max-idle="100000"/>
|
|
259
|
+
</local-cache>
|
|
260
|
+
<local-cache name="local-query">
|
|
261
|
+
<eviction strategy="LRU" max-entries="10000"/>
|
|
262
|
+
<expiration max-idle="100000"/>
|
|
263
|
+
</local-cache>
|
|
264
|
+
<local-cache name="timestamps"/>
|
|
265
|
+
</cache-container>
|
|
266
|
+
</subsystem>
|
|
267
|
+
<subsystem xmlns="urn:jboss:domain:jaxrs:1.0"/>
|
|
268
|
+
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
|
269
|
+
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
|
270
|
+
<bean-validation enabled="true"/>
|
|
271
|
+
<default-workmanager>
|
|
272
|
+
<short-running-threads>
|
|
273
|
+
<core-threads count="50"/>
|
|
274
|
+
<queue-length count="50"/>
|
|
275
|
+
<max-threads count="50"/>
|
|
276
|
+
<keepalive-time time="10" unit="seconds"/>
|
|
277
|
+
</short-running-threads>
|
|
278
|
+
<long-running-threads>
|
|
279
|
+
<core-threads count="50"/>
|
|
280
|
+
<queue-length count="50"/>
|
|
281
|
+
<max-threads count="50"/>
|
|
282
|
+
<keepalive-time time="10" unit="seconds"/>
|
|
283
|
+
</long-running-threads>
|
|
284
|
+
</default-workmanager>
|
|
285
|
+
<cached-connection-manager/>
|
|
286
|
+
</subsystem>
|
|
287
|
+
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
|
288
|
+
<expose-resolved-model/>
|
|
289
|
+
<expose-expression-model/>
|
|
290
|
+
<remoting-connector/>
|
|
291
|
+
</subsystem>
|
|
292
|
+
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
|
293
|
+
<jpa default-datasource="" default-extended-persistence-inheritance="DEEP"/>
|
|
294
|
+
</subsystem>
|
|
295
|
+
<subsystem xmlns="urn:jboss:domain:mail:3.0">
|
|
296
|
+
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
|
297
|
+
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
|
298
|
+
</mail-session>
|
|
299
|
+
</subsystem>
|
|
300
|
+
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
|
301
|
+
<remote-naming/>
|
|
302
|
+
</subsystem>
|
|
303
|
+
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
|
304
|
+
<endpoint/>
|
|
305
|
+
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
|
|
306
|
+
</subsystem>
|
|
307
|
+
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
|
308
|
+
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
|
309
|
+
<deployment-permissions>
|
|
310
|
+
<maximum-set>
|
|
311
|
+
<permission class="java.security.AllPermission"/>
|
|
312
|
+
</maximum-set>
|
|
313
|
+
</deployment-permissions>
|
|
314
|
+
</subsystem>
|
|
315
|
+
<subsystem xmlns="urn:wildfly:elytron:1.2" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
|
316
|
+
<providers>
|
|
317
|
+
<aggregate-providers name="combined-providers">
|
|
318
|
+
<providers name="elytron"/>
|
|
319
|
+
<providers name="openssl"/>
|
|
320
|
+
</aggregate-providers>
|
|
321
|
+
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
|
322
|
+
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
|
323
|
+
</providers>
|
|
324
|
+
<audit-logging>
|
|
325
|
+
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
|
326
|
+
</audit-logging>
|
|
327
|
+
<security-domains>
|
|
328
|
+
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
|
329
|
+
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
|
330
|
+
<realm name="local"/>
|
|
331
|
+
</security-domain>
|
|
332
|
+
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
|
333
|
+
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
|
334
|
+
<realm name="local" role-mapper="super-user-mapper"/>
|
|
335
|
+
</security-domain>
|
|
336
|
+
</security-domains>
|
|
337
|
+
<security-realms>
|
|
338
|
+
<identity-realm name="local" identity="$local"/>
|
|
339
|
+
<properties-realm name="ApplicationRealm">
|
|
340
|
+
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
|
341
|
+
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
|
342
|
+
</properties-realm>
|
|
343
|
+
<properties-realm name="ManagementRealm">
|
|
344
|
+
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
|
345
|
+
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
|
346
|
+
</properties-realm>
|
|
347
|
+
</security-realms>
|
|
348
|
+
<mappers>
|
|
349
|
+
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
|
350
|
+
<permission-mapping>
|
|
351
|
+
<principal name="anonymous"/>
|
|
352
|
+
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
|
353
|
+
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
|
354
|
+
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
|
355
|
+
</permission-mapping>
|
|
356
|
+
<permission-mapping match-all="true">
|
|
357
|
+
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
|
358
|
+
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
|
359
|
+
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
|
360
|
+
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
|
361
|
+
</permission-mapping>
|
|
362
|
+
</simple-permission-mapper>
|
|
363
|
+
<constant-realm-mapper name="local" realm-name="local"/>
|
|
364
|
+
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
|
365
|
+
<constant-role-mapper name="super-user-mapper">
|
|
366
|
+
<role name="SuperUser"/>
|
|
367
|
+
</constant-role-mapper>
|
|
368
|
+
</mappers>
|
|
369
|
+
<http>
|
|
370
|
+
<http-authentication-factory name="management-http-authentication" http-server-mechanism-factory="global" security-domain="ManagementDomain">
|
|
371
|
+
<mechanism-configuration>
|
|
372
|
+
<mechanism mechanism-name="DIGEST">
|
|
373
|
+
<mechanism-realm realm-name="ManagementRealm"/>
|
|
374
|
+
</mechanism>
|
|
375
|
+
</mechanism-configuration>
|
|
376
|
+
</http-authentication-factory>
|
|
377
|
+
<http-authentication-factory name="application-http-authentication" http-server-mechanism-factory="global" security-domain="ApplicationDomain">
|
|
378
|
+
<mechanism-configuration>
|
|
379
|
+
<mechanism mechanism-name="BASIC">
|
|
380
|
+
<mechanism-realm realm-name="Application Realm"/>
|
|
381
|
+
</mechanism>
|
|
382
|
+
<mechanism mechanism-name="FORM"/>
|
|
383
|
+
</mechanism-configuration>
|
|
384
|
+
</http-authentication-factory>
|
|
385
|
+
<provider-http-server-mechanism-factory name="global"/>
|
|
386
|
+
</http>
|
|
387
|
+
<sasl>
|
|
388
|
+
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
|
389
|
+
<mechanism-configuration>
|
|
390
|
+
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
|
391
|
+
<mechanism mechanism-name="DIGEST-SHA-256">
|
|
392
|
+
<mechanism-realm realm-name="ManagementRealm"/>
|
|
393
|
+
</mechanism>
|
|
394
|
+
</mechanism-configuration>
|
|
395
|
+
</sasl-authentication-factory>
|
|
396
|
+
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
|
397
|
+
<mechanism-configuration>
|
|
398
|
+
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
|
399
|
+
<mechanism mechanism-name="DIGEST-SHA-256">
|
|
400
|
+
<mechanism-realm realm-name="ApplicationRealm"/>
|
|
401
|
+
</mechanism>
|
|
402
|
+
</mechanism-configuration>
|
|
403
|
+
</sasl-authentication-factory>
|
|
404
|
+
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
|
405
|
+
<properties>
|
|
406
|
+
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
|
407
|
+
</properties>
|
|
408
|
+
</configurable-sasl-server-factory>
|
|
409
|
+
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
|
410
|
+
<filters>
|
|
411
|
+
<filter provider-name="WildFlyElytron"/>
|
|
412
|
+
</filters>
|
|
413
|
+
</mechanism-provider-filtering-sasl-server-factory>
|
|
414
|
+
<provider-sasl-server-factory name="global"/>
|
|
415
|
+
</sasl>
|
|
416
|
+
</subsystem>
|
|
417
|
+
<subsystem xmlns="urn:jboss:domain:security:2.0">
|
|
418
|
+
<security-domains>
|
|
419
|
+
<security-domain name="other" cache-type="default">
|
|
420
|
+
<authentication>
|
|
421
|
+
<login-module code="Remoting" flag="optional">
|
|
422
|
+
<module-option name="password-stacking" value="useFirstPass"/>
|
|
423
|
+
</login-module>
|
|
424
|
+
<login-module code="RealmDirect" flag="required">
|
|
425
|
+
<module-option name="password-stacking" value="useFirstPass"/>
|
|
426
|
+
</login-module>
|
|
427
|
+
</authentication>
|
|
428
|
+
</security-domain>
|
|
429
|
+
<security-domain name="jboss-web-policy" cache-type="default">
|
|
430
|
+
<authorization>
|
|
431
|
+
<policy-module code="Delegating" flag="required"/>
|
|
432
|
+
</authorization>
|
|
433
|
+
</security-domain>
|
|
434
|
+
<security-domain name="jboss-ejb-policy" cache-type="default">
|
|
435
|
+
<authorization>
|
|
436
|
+
<policy-module code="Delegating" flag="required"/>
|
|
437
|
+
</authorization>
|
|
438
|
+
</security-domain>
|
|
439
|
+
<security-domain name="jaspitest" cache-type="default">
|
|
440
|
+
<authentication-jaspi>
|
|
441
|
+
<login-module-stack name="dummy">
|
|
442
|
+
<login-module code="Dummy" flag="optional"/>
|
|
443
|
+
</login-module-stack>
|
|
444
|
+
<auth-module code="Dummy"/>
|
|
445
|
+
</authentication-jaspi>
|
|
446
|
+
</security-domain>
|
|
447
|
+
</security-domains>
|
|
448
|
+
</subsystem>
|
|
449
|
+
<subsystem xmlns="urn:jboss:domain:transactions:4.0">
|
|
450
|
+
<core-environment>
|
|
451
|
+
<process-id>
|
|
452
|
+
<uuid/>
|
|
453
|
+
</process-id>
|
|
454
|
+
</core-environment>
|
|
455
|
+
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
|
456
|
+
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
|
457
|
+
</subsystem>
|
|
458
|
+
<subsystem xmlns="urn:jboss:domain:undertow:4.0">
|
|
459
|
+
<buffer-cache name="default"/>
|
|
460
|
+
<server name="default-server">
|
|
461
|
+
<http-listener name="default" socket-binding="http" redirect-socket="https" proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING:false}" enable-http2="true"/>
|
|
462
|
+
<https-listener name="https" socket-binding="https" proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING:false}" security-realm="ApplicationRealm" enable-http2="true"/>
|
|
463
|
+
<host name="default-host" alias="localhost">
|
|
464
|
+
<location name="/" handler="welcome-content"/>
|
|
465
|
+
<http-invoker security-realm="ApplicationRealm"/>
|
|
466
|
+
</host>
|
|
467
|
+
</server>
|
|
468
|
+
<servlet-container name="default">
|
|
469
|
+
<jsp-config/>
|
|
470
|
+
<websockets/>
|
|
471
|
+
</servlet-container>
|
|
472
|
+
<handlers>
|
|
473
|
+
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
|
474
|
+
</handlers>
|
|
475
|
+
</subsystem>
|
|
476
|
+
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
|
477
|
+
<web-context>auth</web-context>
|
|
478
|
+
<providers>
|
|
479
|
+
<provider>
|
|
480
|
+
classpath:${jboss.home.dir}/providers/*
|
|
481
|
+
</provider>
|
|
482
|
+
</providers>
|
|
483
|
+
<master-realm-name>master</master-realm-name>
|
|
484
|
+
<scheduled-task-interval>900</scheduled-task-interval>
|
|
485
|
+
<theme>
|
|
486
|
+
<staticMaxAge>2592000</staticMaxAge>
|
|
487
|
+
<cacheThemes>true</cacheThemes>
|
|
488
|
+
<cacheTemplates>true</cacheTemplates>
|
|
489
|
+
<dir>${jboss.home.dir}/themes</dir>
|
|
490
|
+
</theme>
|
|
491
|
+
<spi name="eventsStore">
|
|
492
|
+
<provider name="jpa" enabled="true">
|
|
493
|
+
<properties>
|
|
494
|
+
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
|
495
|
+
</properties>
|
|
496
|
+
</provider>
|
|
497
|
+
</spi>
|
|
498
|
+
<spi name="userCache">
|
|
499
|
+
<provider name="default" enabled="true"/>
|
|
500
|
+
</spi>
|
|
501
|
+
<spi name="userSessionPersister">
|
|
502
|
+
<default-provider>jpa</default-provider>
|
|
503
|
+
</spi>
|
|
504
|
+
<spi name="timer">
|
|
505
|
+
<default-provider>basic</default-provider>
|
|
506
|
+
</spi>
|
|
507
|
+
<spi name="connectionsHttpClient">
|
|
508
|
+
<provider name="default" enabled="true"/>
|
|
509
|
+
</spi>
|
|
510
|
+
<spi name="connectionsJpa">
|
|
511
|
+
<provider name="default" enabled="true">
|
|
512
|
+
<properties>
|
|
513
|
+
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
|
514
|
+
<property name="initializeEmpty" value="true"/>
|
|
515
|
+
<property name="migrationStrategy" value="update"/>
|
|
516
|
+
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
|
517
|
+
</properties>
|
|
518
|
+
</provider>
|
|
519
|
+
</spi>
|
|
520
|
+
<spi name="realmCache">
|
|
521
|
+
<provider name="default" enabled="true"/>
|
|
522
|
+
</spi>
|
|
523
|
+
<spi name="connectionsInfinispan">
|
|
524
|
+
<default-provider>default</default-provider>
|
|
525
|
+
<provider name="default" enabled="true">
|
|
526
|
+
<properties>
|
|
527
|
+
<property name="cacheContainer" value="java:comp/env/infinispan/Keycloak"/>
|
|
528
|
+
</properties>
|
|
529
|
+
</provider>
|
|
530
|
+
</spi>
|
|
531
|
+
<spi name="jta-lookup">
|
|
532
|
+
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
|
533
|
+
<provider name="jboss" enabled="true"/>
|
|
534
|
+
</spi>
|
|
535
|
+
<spi name="publicKeyStorage">
|
|
536
|
+
<provider name="infinispan" enabled="true">
|
|
537
|
+
<properties>
|
|
538
|
+
<property name="minTimeBetweenRequests" value="10"/>
|
|
539
|
+
</properties>
|
|
540
|
+
</provider>
|
|
541
|
+
</spi>
|
|
542
|
+
<spi name="x509cert-lookup">
|
|
543
|
+
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
|
544
|
+
<provider name="default" enabled="true"/>
|
|
545
|
+
</spi>
|
|
546
|
+
<spi name="hostname">
|
|
547
|
+
<default-provider>request</default-provider>
|
|
548
|
+
<provider name="fixed" enabled="true">
|
|
549
|
+
<properties>
|
|
550
|
+
<property name="hostname" value="localhost"/>
|
|
551
|
+
<property name="httpPort" value="-1"/>
|
|
552
|
+
<property name="httpsPort" value="-1"/>
|
|
553
|
+
</properties>
|
|
554
|
+
</provider>
|
|
555
|
+
</spi>
|
|
556
|
+
</subsystem>
|
|
557
|
+
</profile>
|
|
558
|
+
<interfaces>
|
|
559
|
+
<interface name="management">
|
|
560
|
+
<inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
|
|
561
|
+
</interface>
|
|
562
|
+
<interface name="public">
|
|
563
|
+
<inet-address value="${jboss.bind.address:127.0.0.1}"/>
|
|
564
|
+
</interface>
|
|
565
|
+
</interfaces>
|
|
566
|
+
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
|
|
567
|
+
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
|
|
568
|
+
<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
|
|
569
|
+
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
|
|
570
|
+
<socket-binding name="http" port="${jboss.http.port:8080}"/>
|
|
571
|
+
<socket-binding name="https" port="${jboss.https.port:8443}"/>
|
|
572
|
+
<socket-binding name="txn-recovery-environment" port="4712"/>
|
|
573
|
+
<socket-binding name="txn-status-manager" port="4713"/>
|
|
574
|
+
<outbound-socket-binding name="mail-smtp">
|
|
575
|
+
<remote-destination host="localhost" port="25"/>
|
|
576
|
+
</outbound-socket-binding>
|
|
577
|
+
</socket-binding-group>
|
|
578
|
+
</server>
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
|
|
3
|
+
SERVER_HEALTH_CHECK_URL="http://localhost:8080/"
|
|
4
|
+
SERVER_IS_READY="N0"
|
|
5
|
+
|
|
6
|
+
function print_help() {
|
|
7
|
+
cat << EOF
|
|
8
|
+
Wait for keycloak server to start, the script should run from inside keycloak container
|
|
9
|
+
Example:
|
|
10
|
+
./wait_for_server <service-name>
|
|
11
|
+
EOF
|
|
12
|
+
}
|
|
13
|
+
|
|
14
|
+
function input_validation() {
|
|
15
|
+
local args_number="$#"
|
|
16
|
+
if [[ ${args_number} -ne 0 ]] ; then
|
|
17
|
+
echo "Error: invalid arguments"
|
|
18
|
+
print_help
|
|
19
|
+
exit 1
|
|
20
|
+
fi
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
function wait_for_keycloak() {
|
|
24
|
+
for i in {1..40}; do
|
|
25
|
+
sleep=5
|
|
26
|
+
set_server_readiness
|
|
27
|
+
|
|
28
|
+
if [[ "${SERVER_IS_READY}" == "YES" ]] ; then
|
|
29
|
+
echo "Keycloak server is up and ready"
|
|
30
|
+
return 0
|
|
31
|
+
fi
|
|
32
|
+
|
|
33
|
+
echo "Keycloak not ready yet sleep number $i for $sleep seconds"
|
|
34
|
+
sleep "$sleep"
|
|
35
|
+
done
|
|
36
|
+
|
|
37
|
+
echo "Error with keycloak server start or it is too slow"
|
|
38
|
+
exit 1
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
function set_server_readiness()
|
|
42
|
+
{
|
|
43
|
+
curl --silent --output /dev/null "${SERVER_HEALTH_CHECK_URL}"
|
|
44
|
+
local ret_code=$?
|
|
45
|
+
echo "Return code of accessing ${SERVER_HEALTH_CHECK_URL} is: ${ret_code}"
|
|
46
|
+
if [[ "${ret_code}" -eq 0 ]] ; then
|
|
47
|
+
SERVER_IS_READY="YES"
|
|
48
|
+
fi
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
function main() {
|
|
52
|
+
input_validation "$@"
|
|
53
|
+
wait_for_keycloak
|
|
54
|
+
}
|
|
55
|
+
|
|
56
|
+
main "$@"
|
data/conjur-api.gemspec
CHANGED
data/dev/Dockerfile.dev
CHANGED