Edwin van den Houdt
30d8aecf8c
Add infra/keycloak/docker-compose.yml (Keycloak 26.1, dev mode, --import-realm) with four realms imported at boot (infra/keycloak/realms/*.json): digid, eherkenning, eidas, medewerker. Each has a public big-portal OIDC client (standard flow + direct access grants) and test users; protocol mappers inject the identifying claims (bsn / kvk / eidas_id) and medewerker realm roles. Add `make keycloak-up/keycloak-smoke/keycloak-down`; keycloak-smoke runs infra/keycloak/check_realms.py (password-grant login per realm, asserts the claim). Document credentials in docs/synthetic-data.md and a runbook. Verified: `make keycloak-smoke` green — all four realms log in and return the expected claims (bsn 123456782, kvk 12345678, eidas_id FR/NL..., role behandelaar). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
1.1 KiB
JSON
44 lines
1.1 KiB
JSON
{
|
|
"realm": "eidas",
|
|
"enabled": true,
|
|
"displayName": "Mock eIDAS",
|
|
"clients": [
|
|
{
|
|
"clientId": "big-portal",
|
|
"enabled": true,
|
|
"publicClient": true,
|
|
"standardFlowEnabled": true,
|
|
"directAccessGrantsEnabled": true,
|
|
"redirectUris": ["*"],
|
|
"webOrigins": ["*"],
|
|
"protocolMappers": [
|
|
{
|
|
"name": "eidas_id",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
|
"config": {
|
|
"user.attribute": "eidas_id",
|
|
"claim.name": "eidas_id",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"username": "pierre-dupont",
|
|
"enabled": true,
|
|
"firstName": "Pierre",
|
|
"lastName": "Dupont",
|
|
"email": "pierre.dupont@example.fr",
|
|
"emailVerified": true,
|
|
"credentials": [{ "type": "password", "value": "test123", "temporary": false }],
|
|
"attributes": { "eidas_id": ["FR/NL/AB-1234-5678"] }
|
|
}
|
|
]
|
|
}
|