Page MenuHomeSoftware Heritage

keycloak: Update puppet configuration
ClosedPublic

Authored by anlambert on Oct 21 2020, 3:22 PM.

Details

Summary

That diff contains three commits updating keycloak configuration trough puppet:

  • Set content_security_policy property on realms. It enables to embed Keycloak UI pages in SWH web applications.
  • Bump swh theme to v0.3.1
  • Set brute_force_protected on realms. Activate Keycloak countermeasures to protect againts bot attacks.

Related to T2718

15:21 $ bin/octocatalog-diff --octocatalog-diff-args --no-truncate-details -t staging kelvingrove.internal.softwareheritage.org
Found host kelvingrove.internal.softwareheritage.org
Cloning into '/tmp/swh-ocd.MtuYmhN6/environments/production/data/private'...
done.
Cloning into '/tmp/swh-ocd.MtuYmhN6/environments/staging/data/private'...
done.
*** Running octocatalog-diff on host kelvingrove.internal.softwareheritage.org
I, [2020-10-21T15:22:04.216775 #4057243]  INFO -- : Catalogs compiled for kelvingrove.internal.softwareheritage.org
I, [2020-10-21T15:22:04.472116 #4057243]  INFO -- : Diffs computed for kelvingrove.internal.softwareheritage.org
diff origin/production/kelvingrove.internal.softwareheritage.org current/kelvingrove.internal.softwareheritage.org
*******************************************
  Keycloak_realm[SoftwareHeritageStaging] =>
   parameters =>
     brute_force_protected =>
      + true
*******************************************
  Keycloak_realm[SoftwareHeritage] =>
   parameters =>
     brute_force_protected =>
      + true
*******************************************
  Keycloak_realm[master] =>
   parameters =>
     brute_force_protected =>
      + true
*******************************************
  Vcsrepo[/opt/swh-keycloak-theme] =>
   parameters =>
     revision =>
      - v0.3.0
      + v0.3.1
*******************************************
*** End octocatalog-diff on kelvingrove.internal.softwareheritage.org

Diff Detail

Repository
rSPSITE puppet-swh-site
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

olasd requested changes to this revision.Oct 21 2020, 8:48 PM
olasd added a subscriber: olasd.

See my comment on D4319; I've very uneasy relaxing the content security policy on the keycloak services, and definitely against allowing it for all domains.

This revision now requires changes to proceed.Oct 21 2020, 8:48 PM
In D4320#107537, @olasd wrote:

See my comment on D4319; I've very uneasy relaxing the content security policy on the keycloak services, and definitely against allowing it for all domains.

Ack, I will remove the commit modifying content security policy.

Update:

  • Remove commit about modifying content_security_policy.
This revision is now accepted and ready to land.Oct 23 2020, 10:30 AM