backend: integrate keycloak identity and access management

platform/data/keycloak/import/teamagochi-realm.json

@@ -163,7 +163,7 @@
         "composite" : true,
         "composites" : {
           "client" : {
-            "realm-management" : [ "query-clients", "view-authorization", "manage-events", "query-realms", "view-clients", "manage-clients", "manage-identity-providers", "manage-authorization", "view-realm", "query-users", "manage-users", "view-users", "view-events", "impersonation", "query-groups", "view-identity-providers", "manage-realm", "create-client" ]
+            "realm-management" : [ "query-clients", "manage-events", "query-realms", "view-authorization", "view-clients", "manage-clients", "manage-authorization", "manage-identity-providers", "query-users", "view-realm", "manage-users", "view-users", "view-events", "impersonation", "query-groups", "manage-realm", "view-identity-providers", "create-client" ]
           }
         },
         "clientRole" : true,
@@ -260,6 +260,14 @@
         "containerId" : "170a66cb-fab5-46c2-a431-52a4e2bca0c2",
         "attributes" : { }
       } ],
+      "teamagochi-backend" : [ {
+        "id" : "ec5e0914-ed24-4c17-a935-20218b2ae0a4",
+        "name" : "uma_protection",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "572af9f9-5d8e-4bba-a3b4-b011538224a1",
+        "attributes" : { }
+      } ],
       "account" : [ {
         "id" : "9a0b1513-1734-46d4-ab19-9bda18db493e",
         "name" : "delete-account",
@@ -487,7 +495,9 @@
     "publicClient" : true,
     "frontchannelLogout" : false,
     "protocol" : "openid-connect",
-    "attributes" : { },
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
     "authenticationFlowBindingOverrides" : { },
     "fullScopeAllowed" : false,
     "nodeReRegistrationTimeout" : 0,
@@ -513,7 +523,9 @@
     "publicClient" : false,
     "frontchannelLogout" : false,
     "protocol" : "openid-connect",
-    "attributes" : { },
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
     "authenticationFlowBindingOverrides" : { },
     "fullScopeAllowed" : false,
     "nodeReRegistrationTimeout" : 0,
@@ -539,7 +551,9 @@
     "publicClient" : false,
     "frontchannelLogout" : false,
     "protocol" : "openid-connect",
-    "attributes" : { },
+    "attributes" : {
+      "post.logout.redirect.uris" : "+"
+    },
     "authenticationFlowBindingOverrides" : { },
     "fullScopeAllowed" : false,
     "nodeReRegistrationTimeout" : 0,
@@ -592,6 +606,123 @@
     } ],
     "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "email" ],
     "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ]
+  }, {
+    "id" : "572af9f9-5d8e-4bba-a3b4-b011538224a1",
+    "clientId" : "teamagochi-backend",
+    "name" : "Teamagochi Backend-Application",
+    "description" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "5DACLJH84KTWBG22UpdnS9DSjVCIu5zB",
+    "redirectUris" : [ "*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : true,
+    "authorizationServicesEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1718119262",
+      "backchannel.logout.session.required" : "true",
+      "post.logout.redirect.uris" : "+",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "protocolMappers" : [ {
+      "id" : "25f931c8-a8cf-4186-ab17-74719cb0e8ea",
+      "name" : "Client ID",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientId",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientId",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "bc569e0e-2594-45b5-9c37-cc7dfb8814ec",
+      "name" : "Client IP Address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientAddress",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientAddress",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "47020231-057a-4f04-b94b-4bf8b66abea5",
+      "name" : "Client Host",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientHost",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientHost",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "profile", "roles", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "microprofile-jwt" ],
+    "authorizationSettings" : {
+      "allowRemoteResourceManagement" : true,
+      "policyEnforcementMode" : "ENFORCING",
+      "resources" : [ {
+        "name" : "User Resource",
+        "type" : "urn:teamagochi-backend:resources:user",
+        "ownerManagedAccess" : false,
+        "displayName" : "",
+        "attributes" : { },
+        "_id" : "6cc44cd6-f46b-49bf-b124-3ad96a879862",
+        "uris" : [ "/*" ],
+        "icon_uri" : ""
+      } ],
+      "policies" : [ {
+        "id" : "b6fc530d-8dff-43a3-bf6e-27eff806517e",
+        "name" : "Any User",
+        "description" : "Any user granted with the default roles can access something",
+        "type" : "role",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "roles" : "[{\"id\":\"default-roles-teamagochi\",\"required\":false}]"
+        }
+      }, {
+        "id" : "c9a1d39b-133a-487f-b30f-1a7032ecefc7",
+        "name" : "User Resource Permission",
+        "description" : "Any User (Policy)",
+        "type" : "resource",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "resources" : "[\"User Resource\"]",
+          "applyPolicies" : "[\"Any User\"]"
+        }
+      } ],
+      "scopes" : [ ],
+      "decisionStrategy" : "UNANIMOUS"
+    }
   }, {
     "id" : "2f665b71-cea9-4830-a171-1980e9fc4ee6",
     "clientId" : "teamagochi-webapp",
@@ -888,6 +1019,7 @@
       "config" : {
         "introspection.token.claim" : "true",
         "multivalued" : "true",
+        "userinfo.token.claim" : "true",
         "user.attribute" : "foo",
         "id.token.claim" : "true",
         "access.token.claim" : "true",
@@ -1062,7 +1194,8 @@
       "config" : {
         "id.token.claim" : "true",
         "introspection.token.claim" : "true",
-        "access.token.claim" : "true"
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
       }
     } ]
   }, {
@@ -1171,7 +1304,7 @@
       "subType" : "anonymous",
       "subComponents" : { },
       "config" : {
-        "allowed-protocol-mapper-types" : [ "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "saml-role-list-mapper", "oidc-usermodel-property-mapper" ]
+        "allowed-protocol-mapper-types" : [ "oidc-address-mapper", "saml-user-property-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper", "oidc-full-name-mapper" ]
       }
     }, {
       "id" : "59a69e26-7bca-418b-bdb0-c538d42c7f99",
@@ -1180,7 +1313,7 @@
       "subType" : "authenticated",
       "subComponents" : { },
       "config" : {
-        "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "saml-user-property-mapper", "saml-role-list-mapper", "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper" ]
+        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ]
       }
     }, {
       "id" : "75f731da-45cd-43ad-a244-67d8f59fd1c2",
@@ -1844,8 +1977,8 @@
   "attributes" : {
     "cibaBackchannelTokenDeliveryMode" : "poll",
     "cibaAuthRequestedUserHint" : "login_hint",
-    "oauth2DevicePollingInterval" : "5",
     "clientOfflineSessionMaxLifespan" : "0",
+    "oauth2DevicePollingInterval" : "5",
     "clientSessionIdleTimeout" : "0",
     "clientOfflineSessionIdleTimeout" : "0",
     "cibaInterval" : "5",

platform/data/keycloak/import/teamagochi-users-0.json

@@ -1,6 +1,23 @@
 {
   "realm" : "teamagochi",
   "users" : [ {
+    "id" : "0a02ff2c-b109-4f06-ad78-cc19eb50e6d5",
+    "username" : "service-account-teamagochi-backend",
+    "emailVerified" : false,
+    "createdTimestamp" : 1718119156026,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "teamagochi-backend",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-teamagochi" ],
+    "clientRoles" : {
+      "teamagochi-backend" : [ "uma_protection" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
     "id" : "e1fd1cdf-924c-4c13-b5de-2594ac8f1231",
     "username" : "testmanager01",
     "email" : "[email protected]",

web_backend/pom.xml

@@ -50,6 +50,14 @@
       <groupId>io.quarkus</groupId>
       <artifactId>quarkus-rest-jackson</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.quarkus</groupId>
+      <artifactId>quarkus-oidc</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>io.quarkus</groupId>
+      <artifactId>quarkus-keycloak-authorization</artifactId>
+    </dependency>
     <dependency>
       <groupId>io.quarkus</groupId>
       <artifactId>quarkus-hibernate-orm-panache</artifactId>

web_backend/src/main/resources/application.properties

@@ -18,6 +18,27 @@ quarkus.rest-client.leshan-event-api.http2=true
 # General
 %test.quarkus.http.test-timeout=5s
 
+quarkus.http.cors=true
+quarkus.http.cors.origins=*
+
+## OIDC Configuration
+quarkus.oidc.auth-server-url=http://localhost:4000/kc/realms/teamagochi
+quarkus.oidc.client-id=teamagochi-backend
+quarkus.oidc.credentials.secret=5DACLJH84KTWBG22UpdnS9DSjVCIu5zB
+quarkus.oidc.tls.verification=none
+
+## Enable Policy Enforcement
+quarkus.keycloak.policy-enforcer.enable=true
+quarkus.keycloak.policy-enforcer.enforcement-mode=ENFORCING
+quarkus.keycloak.policy-enforcer.lazy-load-paths=true
+
+## Policy rules
+## For enforcement modes, see https://www.keycloak.org/docs/latest/authorization_services/#resource_server_settings.
+quarkus.keycloak.policy-enforcer.paths.q.paths=/q/*
+quarkus.keycloak.policy-enforcer.paths.q.enforcement-mode=DISABLED
+#%dev.quarkus.keycloak.policy-enforcer.paths.admin.paths=/api/v1/*
+#%dev.quarkus.keycloak.policy-enforcer.paths.admin.enforcement-mode=ENFORCING
+
 # Services
 quarkus.rest.path=/api