@backstage-community/plugin-catalog-backend-module-keycloak 3.1.1

package/README.md

@@ -0,0 +1,171 @@
+# Keycloak backend plugin for Backstage
+
+The Keycloak backend plugin integrates Keycloak into Backstage.
+
+## Capabilities
+
+The Keycloak backend plugin has the following capabilities:
+
+- Synchronization of Keycloak users in a realm
+- Synchronization of Keycloak groups and their users in a realm
+
+## For administrators
+
+### Installation
+
+Install the Backstage package into the backend. When not integrating with a published package, clone the repository locally and add the Backstage as follows:
+
+```console
+yarn workspace backend add @backstage-community/plugin-catalog-backend-module-keycloak
+```
+
+### Configuration
+
+#### New Backend Configuration
+
+1. Add the following configuration to the `app-config.yaml` file. The default schedule is a frequency of 30 minutes and a timeout of 3 minutes, please configure the schedule in the `app-config.yaml` as per your requirement.
+
+   ```yaml title="app-config.yaml"
+   catalog:
+     providers:
+       keycloakOrg:
+         default:
+           baseUrl: https://<keycloak_host>
+           loginRealm: ${KEYCLOAK_REALM}
+           realm: ${KEYCLOAK_REALM}
+           clientId: ${KEYCLOAK_CLIENTID}
+           clientSecret: ${KEYCLOAK_CLIENTSECRET}
+           schedule: # Optional (defaults to the configurations below if not provided); same options as in TaskScheduleDefinition
+             # supports cron, ISO duration, "human duration" as used in code
+             frequency: { minutes: 30 } # Customize this to fit your needs
+             # supports ISO duration, "human duration" as used in code
+             timeout: { minutes: 3 } # Customize this to fit your needs
+   ```
+
+1. Register the plugin in the `packages/backend/src/index.ts` file:
+
+   ```ts title="packages/backend/src/index.ts"
+   const backend = createBackend();
+
+   /* highlight-add-next-line */
+   backend.add(
+     import('@backstage-community/plugin-catalog-backend-module-keycloak'),
+   );
+
+   backend.start();
+   ```
+
+1. Optional: To configure custom transformer function for user/group to mutate the entity generated by the catalog-backend-module-keycloak. Create a new backend module with the `yarn new` command and add your custom user and group transformers to the `keycloakTransformerExtensionPoint`. Then install this new backend module into your backstage backend. Below is an example of how the backend module can be defined:
+
+   ```ts title="plugins/<module-name>/src/module.ts"
+   /* highlight-add-start */
+   import {
+     GroupTransformer,
+     keycloakTransformerExtensionPoint,
+     UserTransformer,
+   } from '@backstage-community/plugin-catalog-backend-module-keycloak';
+
+   const customGroupTransformer: GroupTransformer = async (
+     entity,
+     realm,
+     groups,
+   ) => {
+     /* apply transformations */
+     return entity;
+   };
+   const customUserTransformer: UserTransformer = async (
+     entity,
+     user,
+     realm,
+     groups,
+   ) => {
+     /* apply transformations */
+     return entity;
+   };
+   /* highlight-add-end */
+
+   export const keycloakBackendModuleTransformer = createBackendModule({
+     pluginId: 'catalog',
+     moduleId: 'keycloak-transformer',
+     register(reg) {
+       reg.registerInit({
+         deps: {
+           /* highlight-add-start */
+           keycloak: keycloakTransformerExtensionPoint,
+           /* highlight-add-end */
+         },
+         /* highlight-add-start */
+         async init({ keycloak }) {
+           keycloak.setUserTransformer(customUserTransformer);
+           keycloak.setGroupTransformer(customGroupTransformer);
+           /* highlight-add-end */
+         },
+       });
+     },
+   });
+   ```
+
+   ***
+
+   **IMPORTANT**
+
+   The `pluginId` for the module **MUST** be set to `catalog` to match the `pluginId` of the `catalog-backend-module-keycloak` or else the module will fail to initialize.
+
+   ***
+
+Communication between Backstage and Keycloak is enabled by using the Keycloak API. Username/password or client credentials are supported authentication methods.
+
+The following table describes the parameters that you can configure to enable the plugin under `catalog.providers.keycloakOrg.<ENVIRONMENT_NAME>` object in the `app-config.yaml` file:
+
+| Name             | Description                                                        | Default Value | Required                                             |
+| ---------------- | ------------------------------------------------------------------ | ------------- | ---------------------------------------------------- |
+| `baseUrl`        | Location of the Keycloak server, such as `https://localhost:8443`. | ""            | Yes                                                  |
+| `realm`          | Realm to synchronize                                               | `master`      | No                                                   |
+| `loginRealm`     | Realm used to authenticate                                         | `master`      | No                                                   |
+| `username`       | Username to authenticate                                           | ""            | Yes if using password based authentication           |
+| `password`       | Password to authenticate                                           | ""            | Yes if using password based authentication           |
+| `clientId`       | Client ID to authenticate                                          | ""            | Yes if using client credentials based authentication |
+| `clientSecret`   | Client Secret to authenticate                                      | ""            | Yes if using client credentials based authentication |
+| `userQuerySize`  | Number of users to query at a time                                 | `100`         | No                                                   |
+| `groupQuerySize` | Number of groups to query at a time                                | `100`         | No                                                   |
+
+When using client credentials, the access type must be set to `confidential` and service accounts must be enabled. You must also add the following roles from the `realm-management` client role:
+
+- `query-groups`
+- `query-users`
+- `view-users`
+
+### Limitations
+
+If you have self-signed or corporate certificate issues, you can set the following environment variable before starting Backstage:
+
+`NODE_TLS_REJECT_UNAUTHORIZED=0`
+
+---
+
+**NOTE**
+The solution of setting the `NODE_TLS_REJECT_UNAUTHORIZED` environment variable is not recommended.
+
+---
+
+## For users
+
+### Imported users and groups in Backstage using Keycloak plugin
+
+After configuring the plugin successfully, the plugin imports the users and groups each time when started.
+
+After the first import is complete, you can select **User** to list the users from the catalog page:
+
+![catalog-list](./images/users.jpg)
+
+You can see the list of users on the page:
+
+![user-list](./images/user-list.jpg)
+
+When you select a user, you can see the information imported from Keycloak:
+
+![user-profile](./images/user2.jpg)
+
+You can also select a group, view the list, and select or view the information imported from Keycloak for a group:
+
+![group-profile](./images/group1.jpg)

package/app-config.yaml

@@ -0,0 +1,11 @@
+enabled:
+  keycloak: true
+catalog:
+  providers:
+    keycloakOrg:
+      default:
+        baseUrl: '${KEYCLOAK_BASE_URL}'
+        loginRealm: '${KEYCLOAK_LOGIN_REALM}'
+        realm: '${KEYCLOAK_REALM}'
+        clientId: '${KEYCLOAK_CLIENT_ID}'
+        clientSecret: '${KEYCLOAK_CLIENT_SECRET}'

package/config.d.ts

@@ -0,0 +1,88 @@
+/*
+ * Copyright 2024 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { SchedulerServiceTaskScheduleDefinitionConfig } from '@backstage/backend-plugin-api';
+
+export interface Config {
+  catalog?: {
+    providers?: {
+      keycloakOrg?: {
+        [key: string]: {
+          /**
+           * KeycloakOrgConfig
+           */
+          /**
+           * Location of the Keycloak instance
+           */
+          baseUrl: string;
+          /**
+           * Keycloak realm name. This realm is scraped and entities are
+           */
+          realm?: string;
+          /**
+           * Keycloak realm name. This realm is used for authentication using the credentials below.
+           */
+          loginRealm?: string;
+          /**
+           * The number of users to query at a time.
+           * @defaultValue 100
+           * @remarks
+           * This is a performance optimization to avoid querying too many users at once.
+           * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_users_resource
+           */
+          userQuerySize?: number;
+          /**
+           * The number of groups to query at a time.
+           * @defaultValue 100
+           * @remarks
+           * This is a performance optimization to avoid querying too many groups at once.
+           * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_groups_resource
+           */
+          groupQuerySize?: number;
+          schedule?: SchedulerServiceTaskScheduleDefinitionConfig;
+        } & (
+          | {
+              /**
+               * KeycloakClientCredentials
+               */
+              /**
+               * Keycloak credentials. Use together with "password".
+               */
+              username: string;
+              /**
+               * Keycloak credentials. Use together with "username".
+               * @visibility secret
+               */
+              password: string;
+            }
+          | {
+              /**
+               * KeycloakClientCredentials
+               */
+              /**
+               * Keycloak credentials. Use together with "clientSecret".
+               */
+              clientId: string;
+              /**
+               * Keycloak credentials. Use together with "clientId".
+               * @visibility secret
+               */
+              clientSecret: string;
+            }
+        );
+      };
+    };
+  };
+}

package/dist/extensions.cjs.js

@@ -0,0 +1,10 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+
+const keycloakTransformerExtensionPoint = backendPluginApi.createExtensionPoint({
+  id: "keycloak.transformer"
+});
+
+exports.keycloakTransformerExtensionPoint = keycloakTransformerExtensionPoint;
+//# sourceMappingURL=extensions.cjs.js.map

package/dist/extensions.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.cjs.js","sources":["../src/extensions.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createExtensionPoint } from '@backstage/backend-plugin-api';\n\nimport type { GroupTransformer, UserTransformer } from './lib/types';\n\n/**\n * An extension point that exposes the ability to implement user and group transformer functions for keycloak.\n *\n * @public\n */\nexport const keycloakTransformerExtensionPoint =\n  createExtensionPoint<KeycloakTransformerExtensionPoint>({\n    id: 'keycloak.transformer',\n  });\n\n/**\n * The interface for {@link keycloakTransformerExtensionPoint}.\n *\n * @public\n */\nexport type KeycloakTransformerExtensionPoint = {\n  setUserTransformer(userTransformer: UserTransformer): void;\n  setGroupTransformer(groupTransformer: GroupTransformer): void;\n};\n"],"names":["createExtensionPoint"],"mappings":";;;;AAwBO,MAAM,oCACXA,qCAAwD,CAAA;AAAA,EACtD,EAAI,EAAA,sBAAA;AACN,CAAC;;;;"}

package/dist/index.cjs.js

@@ -0,0 +1,18 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var KeycloakOrgEntityProvider = require('./providers/KeycloakOrgEntityProvider.cjs.js');
+var transformers = require('./lib/transformers.cjs.js');
+var extensions = require('./extensions.cjs.js');
+var catalogModuleKeycloakEntityProvider = require('./module/catalogModuleKeycloakEntityProvider.cjs.js');
+
+
+
+exports.KeycloakOrgEntityProvider = KeycloakOrgEntityProvider.KeycloakOrgEntityProvider;
+exports.noopGroupTransformer = transformers.noopGroupTransformer;
+exports.noopUserTransformer = transformers.noopUserTransformer;
+exports.sanitizeEmailTransformer = transformers.sanitizeEmailTransformer;
+exports.keycloakTransformerExtensionPoint = extensions.keycloakTransformerExtensionPoint;
+exports.default = catalogModuleKeycloakEntityProvider.catalogModuleKeycloakEntityProvider;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,219 @@
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+import { SchedulerServiceTaskScheduleDefinition, SchedulerServiceTaskRunner, SchedulerService, LoggerService } from '@backstage/backend-plugin-api';
+import { Config } from '@backstage/config';
+import { EntityProvider, EntityProviderConnection } from '@backstage/plugin-catalog-node';
+import { GroupEntity, UserEntity } from '@backstage/catalog-model';
+import GroupRepresentation from '@keycloak/keycloak-admin-client/lib/defs/groupRepresentation';
+import UserRepresentation from '@keycloak/keycloak-admin-client/lib/defs/userRepresentation';
+
+interface GroupRepresentationWithParent extends GroupRepresentation {
+    parentId?: string;
+    parent?: string;
+    members?: string[];
+}
+interface GroupRepresentationWithParentAndEntity extends GroupRepresentationWithParent {
+    entity: GroupEntity;
+}
+interface UserRepresentationWithEntity extends UserRepresentation {
+    entity: UserEntity;
+}
+/**
+ * Customize the ingested User entity
+ *
+ * @public
+ *
+ * @param {UserEntity} entity The output of the default parser
+ * @param {UserRepresentation} user Keycloak user representation
+ * @param {string} realm Realm name
+ * @param {GroupRepresentationWithParentAndEntity[]} groups Data about available groups (can be used to create additional relationships)
+ *
+ * @returns {Promise<UserEntity | undefined>} Resolve to a modified `UserEntity` object that will be ingested into the catalog or resolve to `undefined` to reject the entity
+ */
+type UserTransformer = (entity: UserEntity, user: UserRepresentation, realm: string, groups: GroupRepresentationWithParentAndEntity[]) => Promise<UserEntity | undefined>;
+/**
+ * Customize the ingested Group entity
+ *
+ * @public
+ *
+ * @param {GroupEntity} entity The output of the default parser
+ * @param {GroupRepresentation} group Keycloak group representation
+ * @param {string} realm Realm name
+ *
+ * @returns {Promise<GroupEntity | undefined>} Resolve to a modified `GroupEntity` object that will be ingested into the catalog or resolve to `undefined` to reject the entity
+ */
+type GroupTransformer = (entity: GroupEntity, group: GroupRepresentation, realm: string) => Promise<GroupEntity | undefined>;
+
+/**
+ * The configuration parameters for a single Keycloak provider.
+ *
+ * @public
+ */
+type KeycloakProviderConfig = {
+    /**
+     * Identifier of the provider which will be used i.e. at the location key for ingested entities.
+     */
+    id: string;
+    /**
+     * The Keycloak base URL
+     */
+    baseUrl: string;
+    /**
+     * The username to use for authenticating requests
+     * If specified, password must also be specified
+     */
+    username?: string;
+    /**
+     * The password to use for authenticating requests
+     * If specified, username must also be specified
+     */
+    password?: string;
+    /**
+     * The clientId to use for authenticating requests
+     * If specified, clientSecret must also be specified
+     */
+    clientId?: string;
+    /**
+     * The clientSecret to use for authenticating requests
+     * If specified, clientId must also be specified
+     */
+    clientSecret?: string;
+    /**
+     * name of the Keycloak realm
+     */
+    realm: string;
+    /**
+     * name of the Keycloak login realm
+     */
+    loginRealm?: string;
+    /**
+     * Schedule configuration for refresh tasks.
+     */
+    schedule?: SchedulerServiceTaskScheduleDefinition;
+    /**
+     * The number of users to query at a time.
+     * @defaultValue 100
+     * @remarks
+     * This is a performance optimization to avoid querying too many users at once.
+     * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_users_resource
+     */
+    userQuerySize?: number;
+    /**
+     * The number of groups to query at a time.
+     * @defaultValue 100
+     * @remarks
+     * This is a performance optimization to avoid querying too many groups at once.
+     * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_groups_resource
+     */
+    groupQuerySize?: number;
+};
+
+/**
+ * Options for {@link KeycloakOrgEntityProvider}.
+ *
+ * @public
+ */
+interface KeycloakOrgEntityProviderOptions {
+    /**
+     * A unique, stable identifier for this provider.
+     *
+     * @example "production"
+     */
+    id: string;
+    /**
+     * The refresh schedule to use.
+     * @remarks
+     *
+     * You can pass in the result of
+     * {@link @backstage/backend-plugin-api#SchedulerService.createScheduledTaskRunner}
+     * to enable automatic scheduling of tasks.
+     */
+    schedule?: SchedulerServiceTaskRunner;
+    /**
+     * Scheduler used to schedule refreshes based on
+     * the schedule config.
+     */
+    scheduler?: SchedulerService;
+    /**
+     * The logger to use.
+     */
+    logger: LoggerService;
+    /**
+     * The function that transforms a user entry in LDAP to an entity.
+     */
+    userTransformer?: UserTransformer;
+    /**
+     * The function that transforms a group entry in LDAP to an entity.
+     */
+    groupTransformer?: GroupTransformer;
+}
+/**
+ * Ingests org data (users and groups) from GitHub.
+ *
+ * @public
+ */
+declare class KeycloakOrgEntityProvider implements EntityProvider {
+    private options;
+    private connection?;
+    private scheduleFn?;
+    static fromConfig(deps: {
+        config: Config;
+        logger: LoggerService;
+    }, options: ({
+        schedule: SchedulerServiceTaskRunner;
+    } | {
+        scheduler: SchedulerService;
+    }) & {
+        userTransformer?: UserTransformer;
+        groupTransformer?: GroupTransformer;
+    }): KeycloakOrgEntityProvider[];
+    constructor(options: {
+        id: string;
+        provider: KeycloakProviderConfig;
+        logger: LoggerService;
+        taskRunner: SchedulerServiceTaskRunner;
+        userTransformer?: UserTransformer;
+        groupTransformer?: GroupTransformer;
+    });
+    getProviderName(): string;
+    connect(connection: EntityProviderConnection): Promise<void>;
+    /**
+     * Runs one complete ingestion loop. Call this method regularly at some
+     * appropriate cadence.
+     */
+    read(options?: {
+        logger?: LoggerService;
+    }): Promise<void>;
+    schedule(taskRunner: SchedulerServiceTaskRunner): void;
+}
+
+declare const noopGroupTransformer: GroupTransformer;
+declare const noopUserTransformer: UserTransformer;
+/**
+ * User transformer that sanitizes .metadata.name from email address to a valid name
+ */
+declare const sanitizeEmailTransformer: UserTransformer;
+
+/**
+ * An extension point that exposes the ability to implement user and group transformer functions for keycloak.
+ *
+ * @public
+ */
+declare const keycloakTransformerExtensionPoint: _backstage_backend_plugin_api.ExtensionPoint<KeycloakTransformerExtensionPoint>;
+/**
+ * The interface for {@link keycloakTransformerExtensionPoint}.
+ *
+ * @public
+ */
+type KeycloakTransformerExtensionPoint = {
+    setUserTransformer(userTransformer: UserTransformer): void;
+    setGroupTransformer(groupTransformer: GroupTransformer): void;
+};
+
+/**
+ * Registers the `KeycloakEntityProvider` with the catalog processing extension point.
+ *
+ * @alpha
+ */
+declare const catalogModuleKeycloakEntityProvider: _backstage_backend_plugin_api.BackendFeature;
+
+export { type GroupRepresentationWithParent, type GroupRepresentationWithParentAndEntity, type GroupTransformer, KeycloakOrgEntityProvider, type KeycloakOrgEntityProviderOptions, type KeycloakTransformerExtensionPoint, type UserRepresentationWithEntity, type UserTransformer, catalogModuleKeycloakEntityProvider as default, keycloakTransformerExtensionPoint, noopGroupTransformer, noopUserTransformer, sanitizeEmailTransformer };

package/dist/lib/config.cjs.js

@@ -0,0 +1,63 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var errors = require('@backstage/errors');
+
+const readProviderConfig = (id, providerConfigInstance) => {
+  const baseUrl = providerConfigInstance.getString("baseUrl");
+  const realm = providerConfigInstance.getOptionalString("realm") ?? "master";
+  const loginRealm = providerConfigInstance.getOptionalString("loginRealm") ?? "master";
+  const username = providerConfigInstance.getOptionalString("username");
+  const password = providerConfigInstance.getOptionalString("password");
+  const clientId = providerConfigInstance.getOptionalString("clientId");
+  const clientSecret = providerConfigInstance.getOptionalString("clientSecret");
+  const userQuerySize = providerConfigInstance.getOptionalNumber("userQuerySize");
+  const groupQuerySize = providerConfigInstance.getOptionalNumber("groupQuerySize");
+  if (clientId && !clientSecret) {
+    throw new errors.InputError(
+      `clientSecret must be provided when clientId is defined.`
+    );
+  }
+  if (clientSecret && !clientId) {
+    throw new errors.InputError(
+      `clientId must be provided when clientSecret is defined.`
+    );
+  }
+  if (username && !password) {
+    throw new errors.InputError(`password must be provided when username is defined.`);
+  }
+  if (password && !username) {
+    throw new errors.InputError(`username must be provided when password is defined.`);
+  }
+  const schedule = providerConfigInstance.has("schedule") ? backendPluginApi.readSchedulerServiceTaskScheduleDefinitionFromConfig(
+    providerConfigInstance.getConfig("schedule")
+  ) : void 0;
+  return {
+    id,
+    baseUrl,
+    loginRealm,
+    realm,
+    username,
+    password,
+    clientId,
+    clientSecret,
+    schedule,
+    userQuerySize,
+    groupQuerySize
+  };
+};
+const readProviderConfigs = (config) => {
+  const providersConfig = config.getOptionalConfig(
+    "catalog.providers.keycloakOrg"
+  );
+  if (!providersConfig) {
+    return [];
+  }
+  return providersConfig.keys().map((id) => {
+    const providerConfigInstance = providersConfig.getConfig(id);
+    return readProviderConfig(id, providerConfigInstance);
+  });
+};
+
+exports.readProviderConfigs = readProviderConfigs;
+//# sourceMappingURL=config.cjs.js.map

package/dist/lib/config.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.cjs.js","sources":["../../src/lib/config.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { readSchedulerServiceTaskScheduleDefinitionFromConfig } from '@backstage/backend-plugin-api';\nimport type { SchedulerServiceTaskScheduleDefinition } from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\n\n/**\n * The configuration parameters for a single Keycloak provider.\n *\n * @public\n */\nexport type KeycloakProviderConfig = {\n  /**\n   * Identifier of the provider which will be used i.e. at the location key for ingested entities.\n   */\n  id: string;\n\n  /**\n   * The Keycloak base URL\n   */\n  baseUrl: string;\n\n  /**\n   * The username to use for authenticating requests\n   * If specified, password must also be specified\n   */\n  username?: string;\n\n  /**\n   * The password to use for authenticating requests\n   * If specified, username must also be specified\n   */\n  password?: string;\n\n  /**\n   * The clientId to use for authenticating requests\n   * If specified, clientSecret must also be specified\n   */\n  clientId?: string;\n\n  /**\n   * The clientSecret to use for authenticating requests\n   * If specified, clientId must also be specified\n   */\n  clientSecret?: string;\n\n  /**\n   * name of the Keycloak realm\n   */\n  realm: string;\n\n  /**\n   * name of the Keycloak login realm\n   */\n  loginRealm?: string;\n\n  /**\n   * Schedule configuration for refresh tasks.\n   */\n  schedule?: SchedulerServiceTaskScheduleDefinition;\n\n  /**\n   * The number of users to query at a time.\n   * @defaultValue 100\n   * @remarks\n   * This is a performance optimization to avoid querying too many users at once.\n   * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_users_resource\n   */\n  userQuerySize?: number;\n\n  /**\n   * The number of groups to query at a time.\n   * @defaultValue 100\n   * @remarks\n   * This is a performance optimization to avoid querying too many groups at once.\n   * @see https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_groups_resource\n   */\n  groupQuerySize?: number;\n};\n\nconst readProviderConfig = (\n  id: string,\n  providerConfigInstance: Config,\n): KeycloakProviderConfig => {\n  const baseUrl = providerConfigInstance.getString('baseUrl');\n  const realm = providerConfigInstance.getOptionalString('realm') ?? 'master';\n  const loginRealm =\n    providerConfigInstance.getOptionalString('loginRealm') ?? 'master';\n  const username = providerConfigInstance.getOptionalString('username');\n  const password = providerConfigInstance.getOptionalString('password');\n  const clientId = providerConfigInstance.getOptionalString('clientId');\n  const clientSecret = providerConfigInstance.getOptionalString('clientSecret');\n  const userQuerySize =\n    providerConfigInstance.getOptionalNumber('userQuerySize');\n  const groupQuerySize =\n    providerConfigInstance.getOptionalNumber('groupQuerySize');\n\n  if (clientId && !clientSecret) {\n    throw new InputError(\n      `clientSecret must be provided when clientId is defined.`,\n    );\n  }\n\n  if (clientSecret && !clientId) {\n    throw new InputError(\n      `clientId must be provided when clientSecret is defined.`,\n    );\n  }\n\n  if (username && !password) {\n    throw new InputError(`password must be provided when username is defined.`);\n  }\n\n  if (password && !username) {\n    throw new InputError(`username must be provided when password is defined.`);\n  }\n\n  const schedule = providerConfigInstance.has('schedule')\n    ? readSchedulerServiceTaskScheduleDefinitionFromConfig(\n        providerConfigInstance.getConfig('schedule'),\n      )\n    : undefined;\n\n  return {\n    id,\n    baseUrl,\n    loginRealm,\n    realm,\n    username,\n    password,\n    clientId,\n    clientSecret,\n    schedule,\n    userQuerySize,\n    groupQuerySize,\n  };\n};\n\nexport const readProviderConfigs = (\n  config: Config,\n): KeycloakProviderConfig[] => {\n  const providersConfig = config.getOptionalConfig(\n    'catalog.providers.keycloakOrg',\n  );\n  if (!providersConfig) {\n    return [];\n  }\n  return providersConfig.keys().map(id => {\n    const providerConfigInstance = providersConfig.getConfig(id);\n    return readProviderConfig(id, providerConfigInstance);\n  });\n};\n"],"names":["InputError","readSchedulerServiceTaskScheduleDefinitionFromConfig"],"mappings":";;;;;AA+FA,MAAM,kBAAA,GAAqB,CACzB,EAAA,EACA,sBAC2B,KAAA;AAC3B,EAAM,MAAA,OAAA,GAAU,sBAAuB,CAAA,SAAA,CAAU,SAAS,CAAA,CAAA;AAC1D,EAAA,MAAM,KAAQ,GAAA,sBAAA,CAAuB,iBAAkB,CAAA,OAAO,CAAK,IAAA,QAAA,CAAA;AACnE,EAAA,MAAM,UACJ,GAAA,sBAAA,CAAuB,iBAAkB,CAAA,YAAY,CAAK,IAAA,QAAA,CAAA;AAC5D,EAAM,MAAA,QAAA,GAAW,sBAAuB,CAAA,iBAAA,CAAkB,UAAU,CAAA,CAAA;AACpE,EAAM,MAAA,QAAA,GAAW,sBAAuB,CAAA,iBAAA,CAAkB,UAAU,CAAA,CAAA;AACpE,EAAM,MAAA,QAAA,GAAW,sBAAuB,CAAA,iBAAA,CAAkB,UAAU,CAAA,CAAA;AACpE,EAAM,MAAA,YAAA,GAAe,sBAAuB,CAAA,iBAAA,CAAkB,cAAc,CAAA,CAAA;AAC5E,EAAM,MAAA,aAAA,GACJ,sBAAuB,CAAA,iBAAA,CAAkB,eAAe,CAAA,CAAA;AAC1D,EAAM,MAAA,cAAA,GACJ,sBAAuB,CAAA,iBAAA,CAAkB,gBAAgB,CAAA,CAAA;AAE3D,EAAI,IAAA,QAAA,IAAY,CAAC,YAAc,EAAA;AAC7B,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR,CAAA,uDAAA,CAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAI,IAAA,YAAA,IAAgB,CAAC,QAAU,EAAA;AAC7B,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR,CAAA,uDAAA,CAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAI,IAAA,QAAA,IAAY,CAAC,QAAU,EAAA;AACzB,IAAM,MAAA,IAAIA,kBAAW,CAAqD,mDAAA,CAAA,CAAA,CAAA;AAAA,GAC5E;AAEA,EAAI,IAAA,QAAA,IAAY,CAAC,QAAU,EAAA;AACzB,IAAM,MAAA,IAAIA,kBAAW,CAAqD,mDAAA,CAAA,CAAA,CAAA;AAAA,GAC5E;AAEA,EAAA,MAAM,QAAW,GAAA,sBAAA,CAAuB,GAAI,CAAA,UAAU,CAClD,GAAAC,qEAAA;AAAA,IACE,sBAAA,CAAuB,UAAU,UAAU,CAAA;AAAA,GAE7C,GAAA,KAAA,CAAA,CAAA;AAEJ,EAAO,OAAA;AAAA,IACL,EAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,GACF,CAAA;AACF,CAAA,CAAA;AAEa,MAAA,mBAAA,GAAsB,CACjC,MAC6B,KAAA;AAC7B,EAAA,MAAM,kBAAkB,MAAO,CAAA,iBAAA;AAAA,IAC7B,+BAAA;AAAA,GACF,CAAA;AACA,EAAA,IAAI,CAAC,eAAiB,EAAA;AACpB,IAAA,OAAO,EAAC,CAAA;AAAA,GACV;AACA,EAAA,OAAO,eAAgB,CAAA,IAAA,EAAO,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA;AACtC,IAAM,MAAA,sBAAA,GAAyB,eAAgB,CAAA,SAAA,CAAU,EAAE,CAAA,CAAA;AAC3D,IAAO,OAAA,kBAAA,CAAmB,IAAI,sBAAsB,CAAA,CAAA;AAAA,GACrD,CAAA,CAAA;AACH;;;;"}

package/dist/lib/constants.cjs.js

@@ -0,0 +1,10 @@
+'use strict';
+
+const KEYCLOAK_ID_ANNOTATION = "keycloak.org/id";
+const KEYCLOAK_REALM_ANNOTATION = "keycloak.org/realm";
+const KEYCLOAK_ENTITY_QUERY_SIZE = 100;
+
+exports.KEYCLOAK_ENTITY_QUERY_SIZE = KEYCLOAK_ENTITY_QUERY_SIZE;
+exports.KEYCLOAK_ID_ANNOTATION = KEYCLOAK_ID_ANNOTATION;
+exports.KEYCLOAK_REALM_ANNOTATION = KEYCLOAK_REALM_ANNOTATION;
+//# sourceMappingURL=constants.cjs.js.map

package/dist/lib/constants.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.cjs.js","sources":["../../src/lib/constants.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport const KEYCLOAK_HOST_ANNOTATION = 'keycloak.org/host';\nexport const KEYCLOAK_ID_ANNOTATION = 'keycloak.org/id';\nexport const KEYCLOAK_REALM_ANNOTATION = 'keycloak.org/realm';\nexport const KEYCLOAK_ENTITY_QUERY_SIZE = 100;\n"],"names":[],"mappings":";;AAiBO,MAAM,sBAAyB,GAAA,kBAAA;AAC/B,MAAM,yBAA4B,GAAA,qBAAA;AAClC,MAAM,0BAA6B,GAAA;;;;;;"}