From c0ddf5a6c69ab8ccd2605b7eeba7db5011c7fd8a Mon Sep 17 00:00:00 2001 From: dannyrb Date: Wed, 8 May 2019 20:13:24 -0400 Subject: [PATCH] Updated seed data for keycloak --- .../config/ohif-keycloak-realm.json | 370 ++++++++++++++---- 1 file changed, 298 insertions(+), 72 deletions(-) diff --git a/docker/OpenResty-Orthanc-Keycloak/config/ohif-keycloak-realm.json b/docker/OpenResty-Orthanc-Keycloak/config/ohif-keycloak-realm.json index 56ae5be87..0e9e52104 100644 --- a/docker/OpenResty-Orthanc-Keycloak/config/ohif-keycloak-realm.json +++ b/docker/OpenResty-Orthanc-Keycloak/config/ohif-keycloak-realm.json @@ -55,7 +55,9 @@ "description": "${role_admin}", "composite": true, "composites": { - "realm": ["create-realm"], + "realm": [ + "create-realm" + ], "client": { "master-realm": [ "view-authorization", @@ -103,7 +105,16 @@ } ], "client": { - "pacs": [], + "pacs": [ + { + "id": "962a5239-e039-4479-a0ee-1dc38d1c26a2", + "name": "uma_protection", + "composite": false, + "clientRole": true, + "containerId": "c35bd685-47ac-41ed-aea2-9a91ed49b947", + "attributes": {} + } + ], "security-admin-console": [], "admin-cli": [], "broker": [ @@ -188,7 +199,9 @@ "composite": true, "composites": { "client": { - "master-realm": ["query-clients"] + "master-realm": [ + "query-clients" + ] } }, "clientRole": true, @@ -265,7 +278,10 @@ "composite": true, "composites": { "client": { - "master-realm": ["query-users", "query-groups"] + "master-realm": [ + "query-users", + "query-groups" + ] } }, "clientRole": true, @@ -291,6 +307,7 @@ "attributes": {} } ], + "ohif-viewer": [], "account": [ { "id": "e5eb771e-50f9-4a5d-821a-5acb796def58", @@ -308,7 +325,9 @@ "composite": true, "composites": { "client": { - "account": ["manage-account-links"] + "account": [ + "manage-account-links" + ] } }, "clientRole": true, @@ -328,33 +347,41 @@ } }, "groups": [], - "defaultRoles": ["offline_access", "uma_authorization"], - "requiredCredentials": ["password"], + "defaultRoles": [ + "offline_access", + "uma_authorization" + ], + "requiredCredentials": [ + "password" + ], "otpPolicyType": "totp", "otpPolicyAlgorithm": "HmacSHA1", "otpPolicyInitialCounter": 0, "otpPolicyDigits": 6, "otpPolicyLookAheadWindow": 1, "otpPolicyPeriod": 30, - "otpSupportedApplications": ["FreeOTP", "Google Authenticator"], + "otpSupportedApplications": [ + "FreeOTP", + "Google Authenticator" + ], "scopeMappings": [ { "clientScope": "offline_access", - "roles": ["offline_access"] + "roles": [ + "offline_access" + ] } ], "clients": [ { - "id": "9d9cdaff-e20b-482d-a9ea-b10be872baf6", - "clientId": "account", - "name": "${client_account}", - "baseUrl": "/auth/realms/master/account", + "id": "91038db7-cd41-4be5-b8a3-9e0a2bed6801", + "clientId": "broker", + "name": "${client_broker}", "surrogateAuthRequired": false, "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "**********", - "defaultRoles": ["view-profile", "manage-account"], - "redirectUris": ["/auth/realms/master/account/*"], + "redirectUris": [], "webOrigins": [], "notBefore": 0, "bearerOnly": false, @@ -423,14 +450,75 @@ ] }, { - "id": "91038db7-cd41-4be5-b8a3-9e0a2bed6801", - "clientId": "broker", - "name": "${client_broker}", + "id": "bf6d39c7-b50d-4ef7-b9c2-7090cea45694", + "clientId": "ohif-viewer", + "rootUrl": "http://127.0.0.1", + "adminUrl": "http://127.0.0.1", + "baseUrl": "/", "surrogateAuthRequired": false, "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "**********", - "redirectUris": [], + "redirectUris": [ + "*" + ], + "webOrigins": [ + "http://127.0.0.1" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": false, + "publicClient": true, + "frontchannelLogout": false, + "protocol": "openid-connect", + "attributes": { + "saml.assertion.signature": "false", + "saml.force.post.binding": "false", + "saml.multivalued.roles": "false", + "saml.encrypt": "false", + "saml.server.signature": "false", + "saml.server.signature.keyinfo.ext": "false", + "exclude.session.state.from.auth.response": "false", + "saml_force_name_id_format": "false", + "saml.client.signature": "false", + "tls.client.certificate.bound.access.tokens": "false", + "saml.authnstatement": "false", + "display.on.consent.screen": "false", + "saml.onetimeuse.condition": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "defaultClientScopes": [ + "web-origins", + "role_list", + "profile", + "roles", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "id": "d7688747-ad9b-4c36-9e4e-fdacc2a0da1f", + "clientId": "security-admin-console", + "name": "${client_security-admin-console}", + "baseUrl": "/auth/admin/master/console/index.html", + "surrogateAuthRequired": false, + "enabled": true, + "clientAuthenticatorType": "client-secret", + "secret": "**********", + "redirectUris": [ + "/auth/admin/master/console/*" + ], "webOrigins": [], "notBefore": 0, "bearerOnly": false, @@ -439,13 +527,30 @@ "implicitFlowEnabled": false, "directAccessGrantsEnabled": false, "serviceAccountsEnabled": false, - "publicClient": false, + "publicClient": true, "frontchannelLogout": false, "protocol": "openid-connect", "attributes": {}, "authenticationFlowBindingOverrides": {}, "fullScopeAllowed": false, "nodeReRegistrationTimeout": 0, + "protocolMappers": [ + { + "id": "cae1b65f-11a6-42c3-9b2b-a513383fa2d6", + "name": "locale", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-attribute-mapper", + "consentRequired": false, + "config": { + "userinfo.token.claim": "true", + "user.attribute": "locale", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "locale", + "jsonType.label": "String" + } + } + ], "defaultClientScopes": [ "web-origins", "role_list", @@ -501,19 +606,25 @@ "id": "c35bd685-47ac-41ed-aea2-9a91ed49b947", "clientId": "pacs", "rootUrl": "http://127.0.0.1", + "baseUrl": "/pacs-admin", "surrogateAuthRequired": false, "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "**********", - "redirectUris": ["/callback*"], - "webOrigins": ["*"], + "redirectUris": [ + "*" + ], + "webOrigins": [ + "*" + ], "notBefore": 0, "bearerOnly": false, "consentRequired": false, - "standardFlowEnabled": false, + "standardFlowEnabled": true, "implicitFlowEnabled": true, - "directAccessGrantsEnabled": false, - "serviceAccountsEnabled": false, + "directAccessGrantsEnabled": true, + "serviceAccountsEnabled": true, + "authorizationServicesEnabled": true, "publicClient": false, "frontchannelLogout": false, "protocol": "openid-connect", @@ -535,11 +646,57 @@ "authenticationFlowBindingOverrides": {}, "fullScopeAllowed": true, "nodeReRegistrationTimeout": -1, + "protocolMappers": [ + { + "id": "e6bb76b6-3a75-4b51-a44d-62ff6574add2", + "name": "Client Host", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientHost", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientHost", + "jsonType.label": "String" + } + }, + { + "id": "204f7fb0-75a9-41fe-804c-ce5a01612b03", + "name": "Client IP Address", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientAddress", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientAddress", + "jsonType.label": "String" + } + }, + { + "id": "41d65674-2d03-40de-98c1-f082dfb0a19d", + "name": "Client ID", + "protocol": "openid-connect", + "protocolMapper": "oidc-usersessionmodel-note-mapper", + "consentRequired": false, + "config": { + "user.session.note": "clientId", + "id.token.claim": "true", + "access.token.claim": "true", + "claim.name": "clientId", + "jsonType.label": "String" + } + } + ], "defaultClientScopes": [ "web-origins", "role_list", + "openid", "profile", "roles", + "id_token", "email" ], "optionalClientScopes": [ @@ -547,18 +704,66 @@ "phone", "offline_access", "microprofile-jwt" - ] + ], + "authorizationSettings": { + "allowRemoteResourceManagement": true, + "policyEnforcementMode": "ENFORCING", + "resources": [ + { + "name": "Default Resource", + "type": "urn:pacs:resources:default", + "ownerManagedAccess": false, + "attributes": {}, + "_id": "9314f7b1-e8ce-4c34-bddf-97d351131a51", + "uris": [ + "/*" + ] + } + ], + "policies": [ + { + "id": "145d1ee5-89fe-4d06-900f-b8910f8e5e2a", + "name": "Default Policy", + "description": "A policy that grants access only for users within this realm", + "type": "js", + "logic": "POSITIVE", + "decisionStrategy": "AFFIRMATIVE", + "config": { + "code": "// by default, grants any permission associated with this policy\n$evaluation.grant();\n" + } + }, + { + "id": "1d389ae1-f20b-46ab-aa76-fd2d4f984ee2", + "name": "Default Permission", + "description": "A permission that applies to the default resource type", + "type": "resource", + "logic": "POSITIVE", + "decisionStrategy": "UNANIMOUS", + "config": { + "defaultResourceType": "urn:pacs:resources:default", + "applyPolicies": "[\"Default Policy\"]" + } + } + ], + "scopes": [] + } }, { - "id": "d7688747-ad9b-4c36-9e4e-fdacc2a0da1f", - "clientId": "security-admin-console", - "name": "${client_security-admin-console}", - "baseUrl": "/auth/admin/master/console/index.html", + "id": "9d9cdaff-e20b-482d-a9ea-b10be872baf6", + "clientId": "account", + "name": "${client_account}", + "baseUrl": "/auth/realms/master/account", "surrogateAuthRequired": false, "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "**********", - "redirectUris": ["/auth/admin/master/console/*"], + "defaultRoles": [ + "view-profile", + "manage-account" + ], + "redirectUris": [ + "/auth/realms/master/account/*" + ], "webOrigins": [], "notBefore": 0, "bearerOnly": false, @@ -567,30 +772,13 @@ "implicitFlowEnabled": false, "directAccessGrantsEnabled": false, "serviceAccountsEnabled": false, - "publicClient": true, + "publicClient": false, "frontchannelLogout": false, "protocol": "openid-connect", "attributes": {}, "authenticationFlowBindingOverrides": {}, "fullScopeAllowed": false, "nodeReRegistrationTimeout": 0, - "protocolMappers": [ - { - "id": "cae1b65f-11a6-42c3-9b2b-a513383fa2d6", - "name": "locale", - "protocol": "openid-connect", - "protocolMapper": "oidc-usermodel-attribute-mapper", - "consentRequired": false, - "config": { - "userinfo.token.claim": "true", - "user.attribute": "locale", - "id.token.claim": "true", - "access.token.claim": "true", - "claim.name": "locale", - "jsonType.label": "String" - } - } - ], "defaultClientScopes": [ "web-origins", "role_list", @@ -607,6 +795,24 @@ } ], "clientScopes": [ + { + "id": "ff6c8925-4b44-4731-9f19-fd7ed8a917f2", + "name": "id_token", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true" + } + }, + { + "id": "5839229a-d156-46dd-b952-43dfa184d83b", + "name": "openid", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "true", + "display.on.consent.screen": "true" + } + }, { "id": "994ea57f-df2e-401d-85f3-7b230a2864fc", "name": "microprofile-jwt", @@ -688,11 +894,11 @@ "protocolMapper": "oidc-usermodel-realm-role-mapper", "consentRequired": false, "config": { - "multivalued": "true", "user.attribute": "foo", "access.token.claim": "true", "claim.name": "realm_access.roles", - "jsonType.label": "String" + "jsonType.label": "String", + "multivalued": "true" } }, { @@ -702,11 +908,11 @@ "protocolMapper": "oidc-usermodel-client-role-mapper", "consentRequired": false, "config": { - "multivalued": "true", "user.attribute": "foo", "access.token.claim": "true", "claim.name": "resource_access.${client_id}.roles", - "jsonType.label": "String" + "jsonType.label": "String", + "multivalued": "true" } }, { @@ -1115,7 +1321,9 @@ }, "smtpServer": {}, "eventsEnabled": false, - "eventsListeners": ["jboss-logging"], + "eventsListeners": [ + "jboss-logging" + ], "enabledEventTypes": [], "adminEventsEnabled": false, "adminEventsDetailsEnabled": false, @@ -1132,8 +1340,8 @@ "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", - "oidc-usermodel-property-mapper", "saml-user-attribute-mapper", + "oidc-usermodel-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-property-mapper", "oidc-usermodel-attribute-mapper" @@ -1147,7 +1355,9 @@ "subType": "anonymous", "subComponents": {}, "config": { - "allow-default-scopes": ["true"] + "allow-default-scopes": [ + "true" + ] } }, { @@ -1165,8 +1375,12 @@ "subType": "anonymous", "subComponents": {}, "config": { - "host-sending-registration-request-must-match": ["true"], - "client-uris-must-match": ["true"] + "host-sending-registration-request-must-match": [ + "true" + ], + "client-uris-must-match": [ + "true" + ] } }, { @@ -1176,7 +1390,9 @@ "subType": "anonymous", "subComponents": {}, "config": { - "max-clients": ["200"] + "max-clients": [ + "200" + ] } }, { @@ -1191,9 +1407,9 @@ "oidc-usermodel-property-mapper", "saml-role-list-mapper", "saml-user-property-mapper", - "oidc-address-mapper", - "oidc-full-name-mapper", "saml-user-attribute-mapper", + "oidc-full-name-mapper", + "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper" ] } @@ -1205,7 +1421,9 @@ "subType": "authenticated", "subComponents": {}, "config": { - "allow-default-scopes": ["true"] + "allow-default-scopes": [ + "true" + ] } }, { @@ -1224,7 +1442,9 @@ "providerId": "rsa-generated", "subComponents": {}, "config": { - "priority": ["100"] + "priority": [ + "100" + ] } }, { @@ -1233,7 +1453,9 @@ "providerId": "aes-generated", "subComponents": {}, "config": { - "priority": ["100"] + "priority": [ + "100" + ] } }, { @@ -1242,8 +1464,12 @@ "providerId": "hmac-generated", "subComponents": {}, "config": { - "priority": ["100"], - "algorithm": ["HS256"] + "priority": [ + "100" + ], + "algorithm": [ + "HS256" + ] } } ] @@ -1708,15 +1934,15 @@ "dockerAuthenticationFlow": "docker auth", "attributes": { "_browser_header.xXSSProtection": "1; mode=block", - "_browser_header.strictTransportSecurity": "max-age=31536000; includeSubDomains", "_browser_header.xFrameOptions": "SAMEORIGIN", - "quickLoginCheckMilliSeconds": "1000", + "_browser_header.strictTransportSecurity": "max-age=31536000; includeSubDomains", "permanentLockout": "false", + "quickLoginCheckMilliSeconds": "1000", "displayName": "Keycloak", "_browser_header.xRobotsTag": "none", "maxFailureWaitSeconds": "900", - "displayNameHtml": "
Keycloak
", "minimumQuickLoginWaitSeconds": "60", + "displayNameHtml": "
Keycloak
", "failureFactor": "30", "maxDeltaTimeSeconds": "43200", "_browser_header.xContentTypeOptions": "nosniff", @@ -1724,9 +1950,9 @@ "_browser_header.contentSecurityPolicyReportOnly": "", "bruteForceProtected": "false", "_browser_header.contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';", - "offlineSessionMaxLifespanEnabled": "false", - "waitIncrementSeconds": "60" + "waitIncrementSeconds": "60", + "offlineSessionMaxLifespanEnabled": "false" }, "keycloakVersion": "6.0.1", "userManagedAccessAllowed": false -} +} \ No newline at end of file