rails_keycloak_authorization 0.0.2 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3a5679ea27b8534269d023d54c80e29d622605845cdf0d078fdc5a79acbe817
-  data.tar.gz: 0f14c1867168d7f139fa574642ce54058e9cb438f18d0c35eab9f77ed328399b
+  metadata.gz: 122890dbd82fc49d04abde438a1fb4b30861a5c87160b799516ebd6400ad6707
+  data.tar.gz: 2cf108a6f02b11e030e68ee800c8b9f8917d436703d8719a1732f4968dda8dd6
 SHA512:
-  metadata.gz: 55c352bccb846e025ed0c12cd31cac15931407ca7d149884d205be532c50dfd46f4983b4e1a12bdbc1b6de8e9e1ce9c2aa4ef8248716517dccdbdd5fc40468b5
-  data.tar.gz: 305d5263ae016648cd04068ab2f5edeb125b336016ee1a2ef2482f6d4f0808347ff2eab7c897caddafe43381160c4591354c3033097da173bb4230a73675b500
+  metadata.gz: fdddaca8f60e5260114f3e10ef86d73d45d6bc38b4080626c3ea3463828048e83cd407ab5718469252b776a80ef848acbb3ba56af97dc1a5565563c0992446c4
+  data.tar.gz: 9eec75e13109fa1579c74d54b89e0117d48aba087dd0bd332eafc6c2ba10d6d207b1597c00397cb3eb8c64bd7d2000b4a1eadab195e30f51051bd84130741145

data/README.md

@@ -53,20 +53,28 @@ sequenceDiagram
 In order to use this gem, you need to configure it in an initializer file. You can create a new file in `config/initializers/rails_keycloak_authorization.rb` with the following content:
 
 ```ruby
-# The Keycloak realm 
-RailsKeycloakAuthorization.keycloak_realm = ENV.fetch("KEYCLOAK_AUTH_CLIENT_REALM_NAME", "dummy")
-# The client id in the realm
-RailsKeycloakAuthorization.client_id = ENV.fetch("KEYCLOAK_AUTH_CLIENT_ID", "dummy-client")
-# Keycloak server url
-RailsKeycloakAuthorization.keycloak_server_url = ENV.fetch("KEYCLOAK_SERVER_URL", "http://localhost:8080")
-# Patterns that are protected by the middleware, Array of regular-expressions.
-RailsKeycloakAuthorization.match_patterns = [
+RailsKeycloakAuthorization.keycloak_auth_client_realm_name = ENV.fetch("KEYCLOAK_AUTH_CLIENT_REALM_NAME", "dummy")
+RailsKeycloakAuthorization.keycloak_auth_client_id         = ENV.fetch("KEYCLOAK_AUTH_CLIENT_ID", "dummy-client")
+RailsKeycloakAuthorization.keycloak_server_url             = ENV.fetch("KEYCLOAK_SERVER_URL", "http://localhost:8080")
+RailsKeycloakAuthorization.keycloak_server_domain          = ENV.fetch("KEYCLOAK_ADMIN_SERVER_DOMAIN", "localhost")
+RailsKeycloakAuthorization.keycloak_admin_realm_name       = ENV.fetch("KEYCLOAK_ADMIN_REALM_NAME", "master")
+RailsKeycloakAuthorization.keycloak_admin_client_id        = ENV.fetch("KEYCLOAK_ADMIN_CLIENT_ID", "keycloak-admin")
+RailsKeycloakAuthorization.keycloak_admin_client_secret    = ENV.fetch("KEYCLOAK_ADMIN_CLIENT_SECRET", "keycloak-admin-client-secret-xxx")
+RailsKeycloakAuthorization.match_patterns                  = [
   /^\/organizations(\.json)?/,
   /^\/api/,
   /internal/
 ]
 ```
 
+Add the route to the UI helper `config/routes.rb`:
+
+```
+# make sure to change the constraint to suite your security
+mount RailsKeycloakAuthorization::Engine, at: "/rka", constraints: lambda { |request| request.remote_ip == "127.0.0.1" }
+```
+
+
 ## How to easily test it?
 
 Create development environment with Keycloak and Tofu:

data/app/controllers/concerns/rails_keycloak_authorization/with_keycloak_admin.rb

@@ -5,28 +5,25 @@ module RailsKeycloakAuthorization
       before_action :keycloak_admin_configure
     end
 
-    private
-
-
-
-
-
+ 
     def realm_name
-      ENV.fetch('KEYCLOAK_AUTH_CLIENT_REALM_NAME')
+      RailsKeycloakAuthorization.keycloak_auth_client_realm_name
     end
+    private
+
 
     def openid_client
-      KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV["KEYCLOAK_AUTH_CLIENT_ID"])
+      KeycloakAdmin.realm(realm_name).clients.find_by_client_id(RailsKeycloakAuthorization.keycloak_auth_client_id)
     end
 
     def keycloak_admin_configure
       KeycloakAdmin.configure do |config|
         config.use_service_account = true
-        config.server_url          = ENV["KEYCLOAK_SERVER_URL"]
-        config.server_domain       = ENV["KEYCLOAK_SERVER_DOMAIN"]
-        config.client_id           = ENV["KEYCLOAK_ADMIN_CLIENT_ID"]
-        config.client_realm_name   = ENV["KEYCLOAK_ADMIN_REALM_NAME"]
-        config.client_secret       = ENV["KEYCLOAK_ADMIN_CLIENT_SECRET"]
+        config.server_url          = RailsKeycloakAuthorization.keycloak_server_url
+        config.server_domain       = RailsKeycloakAuthorization.keycloak_server_domain
+        config.client_realm_name   = RailsKeycloakAuthorization.keycloak_admin_realm_name
+        config.client_id           = RailsKeycloakAuthorization.keycloak_admin_client_id
+        config.client_secret       = RailsKeycloakAuthorization.keycloak_admin_client_secret
         config.logger              = Rails.logger
         config.rest_client_options = { timeout: 3, verify_ssl: Rails.env.production? }
       end

data/app/controllers/rails_keycloak_authorization/policies_controller.rb

@@ -12,7 +12,7 @@ module RailsKeycloakAuthorization
     end
 
     def create
-      KeycloakAdminRubyAgent.create_keycloak_policy(params[:keycloak_realm_role_id])
+      KeycloakAdminRubyAgent.create_keycloak_policy(params[:keycloak_realm_role_id], params[:keycloak_policy_name])
       redirect_to policies_path
     end
   end

data/app/services/rails_keycloak_authorization/keycloak_admin_ruby_agent.rb

@@ -35,11 +35,11 @@ module RailsKeycloakAuthorization
                      .find_by(POLICY_NAME, "role")
       end
 
-      def create_keycloak_policy(keycloak_realm_role_id)
+      def create_keycloak_policy(keycloak_realm_role_id, policy_name)
         KeycloakAdmin
           .realm(realm_name)
           .authz_policies(openid_client.id, 'role')
-          .create!("#{POLICY_NAME}",
+          .create!(policy_name,
                    "#{POLICY_NAME} default policy",
                    "role",
                    "POSITIVE",
@@ -100,14 +100,14 @@ module RailsKeycloakAuthorization
       end
 
       def realm_name
-        ENV.fetch("KEYCLOAK_AUTH_CLIENT_REALM_NAME")
+        RailsKeycloakAuthorization.keycloak_auth_client_realm_name
       end
 
       def openid_client
         KeycloakAdmin
           .realm(realm_name)
           .clients
-          .find_by_client_id(ENV.fetch("KEYCLOAK_AUTH_CLIENT_ID"))
+          .find_by_client_id(RailsKeycloakAuthorization.keycloak_auth_client_id)
       end
 
       def resource_type_for_controller
@@ -124,13 +124,13 @@ module RailsKeycloakAuthorization
       def keycloak_admin_configure
         KeycloakAdmin.configure do |config|
           config.use_service_account = true
-          config.server_url = ENV.fetch("KEYCLOAK_SERVER_URL")
-          config.server_domain = ENV.fetch("KEYCLOAK_SERVER_DOMAIN")
-          config.client_id = ENV.fetch("KEYCLOAK_ADMIN_CLIENT_ID")
-          config.client_realm_name = ENV.fetch("KEYCLOAK_ADMIN_REALM_NAME")
-          config.client_secret = ENV.fetch("KEYCLOAK_ADMIN_CLIENT_SECRET")
-          config.logger = Rails.logger
-          config.rest_client_options = { timeout: 5, verify_ssl: Rails.env.production? }
+          config.server_url          = RailsKeycloakAuthorization.keycloak_server_url
+          config.server_domain       = RailsKeycloakAuthorization.keycloak_server_domain
+          config.client_realm_name   = RailsKeycloakAuthorization.keycloak_admin_realm_name
+          config.client_id           = RailsKeycloakAuthorization.keycloak_admin_client_id
+          config.client_secret       = RailsKeycloakAuthorization.keycloak_admin_client_secret
+          config.logger              = Rails.logger
+          config.rest_client_options = { timeout: 3, verify_ssl: Rails.env.production? }
         end
       end
     end

data/app/views/rails_keycloak_authorization/policies/index.html.erb

@@ -1,23 +1,34 @@
-<h1 class="text-center text-gray-500">Policies</h1>
-<% if @policies.empty? %>
-  <p class="inline">Default Policy for </p>
-  <form class="inline" hx-post="<%= policies_path %>">
+<div id="policies">
+  <h1 class="text-center text-gray-500">Policies</h1>
+
+  <% @policies.map do |policy| %>
+    <div class="mt-2">
+      <p>Policy Name: <%= policy.name %></p>
+      <p>Policy Roles:</p>
+      <% policy.roles.map do |role| %>
+        <% realm_role = @realm_roles.first{|rr| rr.id == rold.id } %>
+        <ul class="list-disc list-inside">
+          <li><%= realm_role.name %></li>
+        </ul>
+      <% end %>
+    </div>
+  <% end %>
+
+  <hr class="mb-6 mt-6"/>
+
+  <form class="inline" hx-post="<%= policies_path %>" hx-target="#policies">
+    <label for="keycloak_policy_name">Name</label>
     <input id="keycloak_policy_name" name="keycloak_policy_name" value="<%= @default_policy_name %>" type="text">
     <label for="keycloak_realm_role">Role</label>
     <select name="keycloak_realm_role_id" hx-indicator=".htmx-indicator">
       <% @realm_roles.map do |role| %>
         <option value="<%= role.id %>" <%= role.name.include?("default") ? "selected=selected" : "" %>>
-          <%= role.name %>
+        <%= role.name %>
         </option>
       <% end %>
     </select>
     <button
-      class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
-      type="submit">Create</button>
+        class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+        type="submit">Create</button>
   </form>
-<% else %>
-    <div class="text-gray-500">Current Policy</div>
-    <% @policies.map do |policy| %>
-     <p><%= policy.name %></p>
-    <% end %>
-<% end %>
+</div>

data/lib/rails_keycloak_authorization/engine.rb

@@ -1,8 +1,12 @@
 module RailsKeycloakAuthorization
   class Engine < ::Rails::Engine
+    require 'keycloak-admin'
     isolate_namespace RailsKeycloakAuthorization
     initializer "rails_keycloak_authorization.middleware" do |app|
       app.middleware.use RailsKeycloakAuthorization::Middleware
     end
+    initializer "rails_keycloak_authorization.assets.precompile" do |app|
+      app.config.assets.precompile += %w( rails_keycloak_authorization/application.css )
+    end
   end
 end

data/lib/rails_keycloak_authorization/version.rb

@@ -1,3 +1,3 @@
 module RailsKeycloakAuthorization
-  VERSION = "0.0.2"
+  VERSION = "0.0.4"
 end

data/lib/rails_keycloak_authorization.rb

@@ -2,12 +2,14 @@ require "rails_keycloak_authorization/version"
 require "rails_keycloak_authorization/engine"
 
 module RailsKeycloakAuthorization
-  mattr_accessor :keycloak_realm
   mattr_accessor :keycloak_server_url
-  mattr_accessor :keycloak_admin_username
-  mattr_accessor :keycloak_admin_password
+  mattr_accessor :keycloak_server_domain
+  mattr_accessor :keycloak_admin_realm_name
+  mattr_accessor :keycloak_admin_client_id
+  mattr_accessor :keycloak_admin_client_secret
+  mattr_accessor :keycloak_auth_client_id
+  mattr_accessor :keycloak_auth_client_realm_name
   mattr_accessor :match_patterns
-  mattr_accessor :client_id
 
   class Middleware
     def initialize(app)
@@ -36,7 +38,7 @@ module RailsKeycloakAuthorization
 
     def authorize!(request_uri, http_authorization)
       route = Rails.application.routes.recognize_path(request_uri)
-      uri = uri(RailsKeycloakAuthorization.keycloak_server_url, RailsKeycloakAuthorization.keycloak_realm)
+      uri = uri(RailsKeycloakAuthorization.keycloak_server_url, RailsKeycloakAuthorization.keycloak_auth_client_realm_name)
       request = http_request(uri, http_authorization, route)
       response = http_client(uri).request(request)
       response.is_a?(Net::HTTPSuccess)
@@ -49,7 +51,7 @@ module RailsKeycloakAuthorization
       })
       permission = "#{route[:controller]}_controller##{route[:action]}"
       request.body = URI.encode_www_form({
-                                           audience: "#{RailsKeycloakAuthorization.client_id}",
+                                           audience: "#{RailsKeycloakAuthorization.keycloak_auth_client_id}",
                                            grant_type: grant_type,
                                            permission: permission,
                                            response_mode: "permissions",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_keycloak_authorization
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.4
 platform: ruby
 authors:
 - Mohammed O. Tillawy
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-10 00:00:00.000000000 Z
+date: 2024-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails