notandClaude Opus 5.5
1cc04de630
CI / k8s (pull_request) Successful in 13s
CI / build (pull_request) Successful in 5m36s
CI / unit (pull_request) Successful in 6m18s
CI / frontend (pull_request) Successful in 3m12s
CI / verify-stack (pull_request) Canceled after 0s
CI / mutation (pull_request) Canceled after 8m0s
CI / lint (pull_request) Canceled after 21m26s
A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the script computes the code from the committed fixture secret and submits it, so the demo shows MFA enforced without an authenticator. Off by default: the script is empty and the login is plain keycloak.v2. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
61 lines
2.5 KiB
YAML
61 lines
2.5 KiB
YAML
{{- /*
|
|
Keycloak login theme `big-demo`: keycloak.v2 plus one script. It is always
|
|
mounted and always the default theme (KC_SPI_THEME_DEFAULT), so the only thing
|
|
`demo.otpAutofill` switches is what that script does. Off, it is empty and the
|
|
login is exactly keycloak.v2.
|
|
|
|
On, the medewerker OTP step computes the code from the realm fixture secret
|
|
(docs/runbooks/keycloak.md) and submits it: the demo still shows MFA being
|
|
enforced without anyone needing an authenticator. The secret is committed and
|
|
shared, so this is a demo convenience only — never enable it anywhere real.
|
|
*/ -}}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kc-theme
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" "kc-theme") | nindent 4 }}
|
|
data:
|
|
theme.properties: |
|
|
parent=keycloak.v2
|
|
import=common/keycloak
|
|
scripts=js/otp-autofill.js
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kc-theme-js
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" "kc-theme-js") | nindent 4 }}
|
|
data:
|
|
otp-autofill.js: |
|
|
{{- if .Values.demo.otpAutofill }}
|
|
// RFC 6238 with Keycloak's default policy (HmacSHA1, 6 digits, 30 s) over the
|
|
// raw bytes of the medewerker fixture secret — same as tests/e2e/keycloak-login.ts.
|
|
document.addEventListener('DOMContentLoaded', async () => {
|
|
const input = document.querySelector('input[name="otp"]');
|
|
if (!input || !input.form) return;
|
|
const key = await crypto.subtle.importKey('raw',
|
|
new TextEncoder().encode('BIGMEDEWERKEROTPSEED'), { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
|
|
// A code is single-use, so a second login in the same window spends the next
|
|
// counter (Keycloak's look-ahead accepts it). Past that, fill but don't submit,
|
|
// so a rejected code can't turn into a submit loop.
|
|
const now = Math.floor(Date.now() / 30000);
|
|
let last = -1;
|
|
try { last = Number(sessionStorage.getItem('big-otp-counter')) || -1; } catch {}
|
|
const counter = Math.max(now, last + 1);
|
|
const msg = new DataView(new ArrayBuffer(8));
|
|
msg.setBigUint64(0, BigInt(counter));
|
|
const mac = new Uint8Array(await crypto.subtle.sign('HMAC', key, msg.buffer));
|
|
const o = mac[19] & 0x0f;
|
|
const n = ((mac[o] & 0x7f) << 24 | mac[o + 1] << 16 | mac[o + 2] << 8 | mac[o + 3]) % 1e6;
|
|
input.value = String(n).padStart(6, '0');
|
|
if (counter > now + 1) return;
|
|
try { sessionStorage.setItem('big-otp-counter', String(counter)); } catch {}
|
|
input.form.requestSubmit();
|
|
});
|
|
{{- else }}
|
|
// demo.otpAutofill is off: the OTP step is entered by hand.
|
|
{{- end }}
|