Skip to content

Commit 5a5fdb4

Browse files
john-gomjohn-gom
authored
fix: Increase build wait time and fix smtp server (#226)
* fix: Increase build wait time Signed-off-by: John Gomersall <thegoms@gmail.com> * Fix email and realm text alignment on small screens Signed-off-by: John Gomersall <thegoms@gmail.com> * Some docs on configuration Signed-off-by: John Gomersall <thegoms@gmail.com> * Users Signed-off-by: John Gomersall <thegoms@gmail.com> --------- Signed-off-by: John Gomersall <thegoms@gmail.com>
1 parent f0964e7 commit 5a5fdb4

3 files changed

Lines changed: 53 additions & 5 deletions

File tree

‎.github/workflows/container-deploy.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ jobs:
2828
echo "KC_HOSTNAME=https://auth.openfoodfacts.net" >> $GITHUB_ENV
2929
echo "KC_DB_URL_HOST=postgresql" >> $GITHUB_ENV
3030
echo "REDIS_URL=redis://redis:6379" >> $GITHUB_ENV
31-
echo "SMTP_SERVER=10:1.0.102" >> $GITHUB_ENV
3231
echo "COMMON_NET_NAME=po_webnet" >> $GITHUB_ENV
3332
3433
echo "KEYCLOAK_STARTUP=staging" >> $GITHUB_ENV
@@ -43,7 +42,6 @@ jobs:
4342
echo "KC_HOSTNAME=https://auth.openfoodfacts.org" >> $GITHUB_ENV
4443
echo "KC_DB_URL_HOST=10.1.0.120" >> $GITHUB_ENV
4544
echo "REDIS_URL=10.1.0.122:6379" >> $GITHUB_ENV
46-
echo "SMTP_SERVER=pmg.openfoodfacts.org" >> $GITHUB_ENV
4745
echo "COMMON_NET_NAME=common_net" >> $GITHUB_ENV
4846
4947
echo "KEYCLOAK_STARTUP=prod" >> $GITHUB_ENV
@@ -56,7 +54,7 @@ jobs:
5654
checkName: build
5755
ref: ${{ github.event.pull_request.head.sha || github.sha }}
5856
intervalSeconds: 10
59-
timeoutSeconds: 600 # 10m
57+
timeoutSeconds: 1800 # 30m
6058

6159
- name: Do something if build fail
6260
if: steps.wait-build.outputs.conclusion == 'failure'
@@ -115,7 +113,7 @@ jobs:
115113
echo "KC_DB_USERNAME=keycloak" >> .env
116114
echo "KC_DB_PASSWORD=${{ secrets.KC_DB_PASSWORD }}" >> .env
117115
echo "REDIS_URL=${{ env.REDIS_URL }}" >> .env
118-
echo "SMTP_SERVER=${{ env.SMTP_SERVER }}" >> .env
116+
echo "SMTP_SERVER=pmg.openfoodfacts.org" >> .env
119117
echo "KEYCLOAK_HTTP_PORT=5600" >> .env
120118
echo "KEYCLOAK_MANAGEMENT_PORT=5602" >> .env
121119
echo "KEYCLOAK_STARTUP=${{env.KEYCLOAK_STARTUP}}" >> .env

‎README.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,55 @@ The primary responsibility of this service is to support user authentication and
66

77
Ultimately all user and re-user authentication should take place via Keycloak. Other Open Food Facts projects should not be prompting users for their username and password, but instead redirecting to Keycloak. This will allow us to support other authentication methods like Passkeys and social login in the future. However, username and password authentication APIs are currently still provided while all services transition.
88

9+
# Configuring Clients
10+
11+
No clients are pre-configured in the production and staging instances. We only use OIDC clients (not SAML). Clients are configured on the Open Food Facts realm (not master).
12+
13+
## Internal Backend Client
14+
15+
This configuration would only be used for our internal clients that needs to be able query / update, like Product Opener:
16+
17+
* Client authentication: enabled
18+
* Authentication flows: Standard flow, Direct access grants, Service account roles
19+
* Root URL: https://world.openfoodfacts.org/ (or as appropriate)
20+
* Home URL: (blank)
21+
* Valid redirect URLs: cgi/oidc_signin_callback.pl
22+
* Valid post logout redirect URIs: cgi/oidc_signout_callback.pl
23+
* Web origins: +
24+
25+
Go to the service account user for the client (e.g. service-account-off) and join the "User management" group which will assign the realm-management:manage-users and realm-management:query-users roles.
26+
27+
Securely share the randomly generated Client Secret with the client.
28+
29+
## Public External Clients
30+
31+
This applies to clients that just need to be able to initiate a PKCE login flow for a user, such as off-explorer:
32+
33+
* Client authentication: disabled (this makes it a public client)
34+
* Authentication flows: Standard flow (do not enable any other flows)
35+
* Root URL, Home URL, Valid redirect URLs, Valid post logout redirect URIs: As specified by the client
36+
* Web origins: +
37+
38+
There is no service account for these types of client and no secret, so only the Client ID needs to be shared with the client.
39+
40+
## Private External Clients
41+
42+
These would be used if the client has a backend that is able to perform the code for token exchange.
43+
44+
The configuration is the same as for a Public client except that Client authentication is enabled so there will be a secret to share with the client.
45+
46+
# Configuring Users
47+
48+
The default root user should not be used and every administrator should be a specific named individual. Keycloak administrators are added to the master realm.
49+
50+
## Full Administrators
51+
52+
These will have access to all roles and be able to create additional users.
53+
54+
## Open Food Facts administrators
55+
56+
These will have full access to the Open Food Facts realm so can add new clients, reset user passwords, etc.
57+
958
# Components of the Project
1059

1160
Different aspects of the Keycloak deployment are managed by the following components of this project:

‎theme/off/login/resources/css/styles.css‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,10 @@
77
font-size: 1.5em;
88
right: 1em;
99
position: absolute;
10-
top: 1em;
10+
top: 57px;
1111
color: var(--off-text);
1212
display: none;
13+
margin-block-start: 0;
1314
}
1415

1516
.pf-v5-c-login {

0 commit comments

Comments
 (0)