EDGAR: Issue-132 - Edgar uses client secret and client id from provid…

…ed setup string and writes those information in its toml file if they are not existent yet.
eclipse-opendut · Apr 15, 2024 · 1d78272 · 1d78272
1 parent 8620c3f
commit 1d78272
Show file tree

Hide file tree

Showing 17 changed files with 270 additions and 82 deletions.
diff --git a/.ci/docker/carl/docker-compose.yml b/.ci/docker/carl/docker-compose.yml
@@ -32,8 +32,8 @@ services:
       - OPENDUT_CARL_OPENTELEMETRY_ENDPOINT=http://otel-collector:4317
       # OIDC
       - OPENDUT_CARL_NETWORK_OIDC_ENABLED=true
-      - OPENDUT_CARL_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-carl-client
-      - OPENDUT_CARL_NETWORK_OIDC_CLIENT_CLIENT_SECRET=6754d533-9442-4ee6-952a-97e332eca38e
+      - OPENDUT_CARL_NETWORK_OIDC_CLIENT_ID=opendut-carl-client
+      - OPENDUT_CARL_NETWORK_OIDC_CLIENT_SECRET=6754d533-9442-4ee6-952a-97e332eca38e
       - OPENDUT_CARL_NETWORK_OIDC_CLIENT_PEER_ID=opendut-edgar-client
       - OPENDUT_CARL_NETWORK_OIDC_CLIENT_PEER_SECRET=c7d6ace0-b90f-471a-bb62-a4ecac4150f8
       - OPENDUT_CARL_NETWORK_OIDC_CLIENT_ISSUER_URL=https://keycloak/realms/opendut/

diff --git a/.ci/docker/edgar/docker-compose.yml b/.ci/docker/edgar/docker-compose.yml
@@ -21,8 +21,8 @@ services:
       - OPENDUT_CLEO_NETWORK_CARL_PORT=443
       - OPENDUT_CLEO_NETWORK_TLS_DOMAIN_NAME_OVERRIDE=carl  # default developer certificate is only valid for localhost
       - OPENDUT_CLEO_NETWORK_OIDC_ENABLED=true
-      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-cleo-client
-      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_CLIENT_SECRET=918642e0-4ec4-4ef5-8ae0-ba92de7da3f9
+      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_ID=opendut-cleo-client
+      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_SECRET=918642e0-4ec4-4ef5-8ae0-ba92de7da3f9
       - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_ISSUER_URL=https://keycloak/realms/opendut/
       - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_SCOPES=
 
@@ -31,8 +31,8 @@ services:
       - OPENDUT_EDGAR_NETWORK_CARL_PORT=443
       - OPENDUT_EDGAR_NETWORK_TLS_DOMAIN_NAME_OVERRIDE=carl  # default developer certificate is only valid for localhost
       - OPENDUT_EDGAR_NETWORK_OIDC_ENABLED=true
-      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-edgar-client
-      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_CLIENT_SECRET=c7d6ace0-b90f-471a-bb62-a4ecac4150f8
+      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_ID=opendut-edgar-client
+      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_SECRET=c7d6ace0-b90f-471a-bb62-a4ecac4150f8
       - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_ISSUER_URL=https://keycloak/realms/opendut/
       - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_SCOPES=
       - OPENDUT_EDGAR_OPENTELEMETRY_ENABLED=true
@@ -73,8 +73,8 @@ services:
       - OPENDUT_CLEO_NETWORK_CARL_PORT=443
       - OPENDUT_CLEO_NETWORK_TLS_DOMAIN_NAME_OVERRIDE=carl  # default developer certificate is only valid for localhost
       - OPENDUT_CLEO_NETWORK_OIDC_ENABLED=true
-      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-cleo-client
-      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_CLIENT_SECRET=918642e0-4ec4-4ef5-8ae0-ba92de7da3f9
+      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_ID=opendut-cleo-client
+      - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_SECRET=918642e0-4ec4-4ef5-8ae0-ba92de7da3f9
       - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_ISSUER_URL=https://keycloak/realms/opendut/
       - OPENDUT_CLEO_NETWORK_OIDC_CLIENT_SCOPES=
 
@@ -83,8 +83,8 @@ services:
       - OPENDUT_EDGAR_NETWORK_CARL_PORT=443
       - OPENDUT_EDGAR_NETWORK_TLS_DOMAIN_NAME_OVERRIDE=carl  # default developer certificate is only valid for localhost
       - OPENDUT_EDGAR_NETWORK_OIDC_ENABLED=true
-      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-edgar-client
-      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_CLIENT_SECRET=c7d6ace0-b90f-471a-bb62-a4ecac4150f8
+      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_ID=opendut-edgar-client
+      - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_SECRET=c7d6ace0-b90f-471a-bb62-a4ecac4150f8
       - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_ISSUER_URL=https://keycloak/realms/opendut/
       - OPENDUT_EDGAR_NETWORK_OIDC_CLIENT_SCOPES=
       - OPENDUT_EDGAR_OPENTELEMETRY_ENABLED=true

diff --git a/.ci/docker/theo/src/core/resources/carl.environment.tmpl b/.ci/docker/theo/src/core/resources/carl.environment.tmpl
@@ -9,8 +9,8 @@ OPENDUT_CARL_NETWORK_TLS_KEY=resources/development/tls/carl.key
 OPENDUT_CARL_NETWORK_TLS_CA=resources/development/tls/insecure-development-ca.pem
 
 OPENDUT_CARL_NETWORK_OIDC_ENABLED=true
-OPENDUT_CARL_NETWORK_OIDC_CLIENT_CLIENT_ID=opendut-carl-client
-OPENDUT_CARL_NETWORK_OIDC_CLIENT_CLIENT_SECRET=6754d533-9442-4ee6-952a-97e332eca38e
+OPENDUT_CARL_NETWORK_OIDC_CLIENT_ID=opendut-carl-client
+OPENDUT_CARL_NETWORK_OIDC_CLIENT_SECRET=6754d533-9442-4ee6-952a-97e332eca38e
 OPENDUT_CARL_NETWORK_OIDC_CLIENT_ISSUER_URL=http://localhost:8081/realms/opendut/
 OPENDUT_CARL_NETWORK_OIDC_CLIENT_ISSUER_REMOTE_URL=https://keycloak/realms/opendut/
 OPENDUT_CARL_NETWORK_OIDC_CLIENT_SCOPES=""

diff --git a/.ci/docker/theo/src/core/resources/carl.toml.tmpl b/.ci/docker/theo/src/core/resources/carl.toml.tmpl
@@ -14,8 +14,8 @@ ca = "resources/development/tls/insecure-development-ca.pem"
 enabled = true
 
 [network.oidc.client]
-client.id = "opendut-carl-client"
-client.secret = "6754d533-9442-4ee6-952a-97e332eca38e"
+id = "opendut-carl-client"
+secret = "6754d533-9442-4ee6-952a-97e332eca38e"
 issuer.url = "http://localhost:8081/realms/opendut/"
 issuer.remote.url = "https://keycloak/realms/opendut/"
 scopes = ""

diff --git a/opendut-carl/carl.toml b/opendut-carl/carl.toml
@@ -13,8 +13,8 @@ ca = "/etc/opendut/tls/ca.pem"
 enabled = false
 
 [network.oidc.client]
-client.id = "tbd"
-client.secret = "tbd"
+id = "tbd"
+secret = "tbd"
 # issuer url that CARL uses
 issuer.url = "https://keycloak/realms/opendut/"
 # issuer url that CARL tells the clients to use (required in test environment)

diff --git a/opendut-carl/opendut-carl-api/src/carl/auth/auth_config.rs b/opendut-carl/opendut-carl-api/src/carl/auth/auth_config.rs
@@ -16,8 +16,8 @@ pub struct OidcIdentityProviderConfig {
 
 const OIDC_CLIENT_CONFIG_PREFIX: &str = "network.oidc.client";
 impl OidcIdentityProviderConfig {
-    const CLIENT_ID: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.client.id");
-    const CLIENT_SECRET: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.client.secret");
+    const CLIENT_ID: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.id");
+    const CLIENT_SECRET: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.secret");
     const ISSUER_URL: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.issuer.url");
     const SCOPES: &'static str = formatcp!("{OIDC_CLIENT_CONFIG_PREFIX}.scopes");
 

diff --git a/opendut-carl/src/actions/peers.rs b/opendut-carl/src/actions/peers.rs
@@ -280,7 +280,7 @@ pub async fn generate_peer_setup(params: GeneratePeerSetupParams) -> Result<Peer
 
         let auth_config = match params.oidc_client_manager {
             None => {
-                AuthConfig::disabled()
+                AuthConfig::Disabled
             }
             Some(oidc_client_manager) => {
                 debug!("Generating OIDC client for peer '{peer_name}' <{peer_id}>.");

diff --git a/opendut-carl/src/peer/oidc_client_manager.rs b/opendut-carl/src/peer/oidc_client_manager.rs
@@ -108,8 +108,8 @@ impl TryFrom<&Config> for CarlIdentityProviderConfig {
 }
 
 impl CarlIdentityProviderConfig {
-    const CLIENT_ID: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.client.id");
-    const CLIENT_SECRET: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.client.secret");
+    const CLIENT_ID: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.id");
+    const CLIENT_SECRET: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.secret");
     const COMMON_PEER_ID: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.peer.id");
     const COMMON_PEER_SECRET: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.peer.secret");
     const ISSUER_URL: &'static str = formatcp!("{CARL_OIDC_CONFIG_PREFIX}.issuer.url");

diff --git a/opendut-cleo/cleo.toml b/opendut-cleo/cleo.toml
@@ -12,6 +12,6 @@ enabled = false
 
 [network.oidc.client]
 id = "opendut-cleo-client"
-issuer_url = "https://keycloak/realms/opendut/"
+issuer.url = "https://keycloak/realms/opendut/"
 scopes = "openid,profile,email,roles,groups"
 secret = "<tbd>"
diff --git a/opendut-edgar/edgar.toml b/opendut-edgar/edgar.toml
@@ -19,7 +19,7 @@ enabled = false
 
 [network.oidc.client]
 id = "opendut-edgar-client"
-issuer_url = "https://keycloak/realms/opendut/"
+issuer.url = "https://keycloak/realms/opendut/"
 scopes = "openid,profile,email,roles,groups"
 secret = "<tbd>"
 

diff --git a/opendut-edgar/src/setup/start.rs b/opendut-edgar/src/setup/start.rs
@@ -34,10 +34,13 @@ pub async fn managed(run_mode: RunMode, no_confirm: bool, setup_string: String,
     let mut tasks: Vec<Box<dyn Task>> = vec![
         Box::new(tasks::WriteCaCertificate { certificate: peer_setup.ca }),
         Box::new(tasks::CheckOsRequirements),
-        Box::new(tasks::WriteConfiguration::with_override(write_configuration::ConfigOverride {
-            peer_id: peer_setup.id,
-            carl_url: peer_setup.carl,
-        })),
+        Box::new(tasks::WriteConfiguration::with_override(
+            write_configuration::ConfigOverride {
+                peer_id: peer_setup.id,
+                carl_url: peer_setup.carl,
+                auth_config: peer_setup.auth_config,
+            }),
+        ),
         Box::new(tasks::CheckCarlReachable),
         Box::new(tasks::CopyExecutable),
         Box::new(tasks::LoadKernelModules::default()),