Package: keycloak-config-tool
Keycloak Configuration ToolThe purpose of this tool is to allow for configuration-based updates to the Keycloak service. The tool will:Process the actions configurationDecrypt any string values encrypted with thekms-encryption-toolboxWait for Keycloak to become availableExecute the configured actions against KeycloakLocal InstallationThis tool requires thatpython3andpip3be installed on your machine for a local installation. Once those tools are installed, simply run the following command to install the tool:pip3 install .This will create an executable namedkeycloak-config-toolin your path.Running testsYou needtoxin order to run tests. If you don't have it, simply run the following to install it:pip3 install toxYou can run tests just by calling in the repository root:toxCommand-line UsageThe tool takes the following command-line flags:NameRequired?DefaultDescriptionExample--keycloak-base-urlYesNONEThe base URL for Keycloak.--keycloak-base-url https://keycloak.host/auth/--keycloak-timeoutNo180The timeout (in seconds) to use when waiting for keycloak to become available.--keycloak-timeout 300--keycloak-usernameYesNONEThe username of an admin user on the Keycloak instance.--keycloak-username admin--keycloak-passwordYesNONEThe password for the admin user.--keycloak-password password--deploy-config-dirYesNONEThe path to the root directory. The tool will expect to find thesrcandvardirectories under this directory.--deploy-config-dir ./deploy--deploy-envYesNONEThe deployment environment (use 'local' for local stacks).--deploy-env local--config-onlyNoNONEIf provided, only print out the configuration, and take no further action.--config-only--encryption-prefixNodecrypt:Prefix of all encrypted values to be used to determine if any decryption is required.--encryption-prefix _DECRYPT_:--aws-profileNoNONEAWS profile to be used for contacting KMS when decryption is required.--aws-profile samlDocker UsageThe tool is also available as a Docker image for use indocker-composeenvironments. The image repository is located at:applause/keycloak-config-toolThe image takes the following environment variables:NameRequired?DefaultDescriptionExampleKEYCLOAK_BASE_URLYesNONEThe base URL for Keycloak.KEYCLOAK_BASE_URL=https://keycloak.host/auth/KEYCLOAK_TIMEOUTNo180The timeout (in seconds) to use when waiting for keycloak to become available.KEYCLOAK_TIMEOUT=300KEYCLOAK_USERNAMEYesNONEThe username of an admin user on the Keycloak instance.KEYCLOAK_USERNAME=adminKEYCLOAK_PASSWORDYesNONEThe password for the admin user.KEYCLOAK_PASSWORD=passwordDEPLOY_CONFIG_DIRYesNONEThe path to the root directory. The tool will expect to find thesrcandvardirectories under this directory. This directory will need to be a accessible as a mounted volume.DEPLOY_CONFIG_DIR=/mnt/deployDEPLOY_ENVYesNONEThe deployment environment (use 'local' for local stacks).DEPLOY_ENV=localCOMPLETION_SIGNAL_PORTNoNONEFor dockerize compatibility. A port to open up a TCP listener on when the tool completes successfully. This will allow integration test docker-compose environments to know when the tool has successfully completed. If no value is provided, the container will simply stop when it completes.COMPLETION_SIGNAL_PORT=3456ENCRYPTION_PREFIXNodecrypt:Prefix of all encrypted values to be used to determine if any decryption is required.ENCRYPTION_PREFIX=_DECRYPT_:AWS_PROFILENoNONEAWS profile to be used for contacting KMS when decryption is required.AWS_PROFILE=samlConfigurationThe tool expects a specific configuration file structure under the directory specified by--deploy-config-dir:.
+-- src
|   +-- keycloak.json 
+-- var
    +-- keycloak
        +-- *.varThekeycloak.jsonfile is contains a JSON array of action configurations (covered later). The var files support a variables file for each environment (e.g.,local.var) plus adefaults.varfile. The order of precedence for variables is:Environment variablesVariables located in the environment-specific variables fileVariables located in thedefaults.varvariables fileVariables are substituted in thekeycloak.jsonfile using a#{VAR}syntax,NOT a${VAR}syntax, as Keycloak API JSON payloads already support that syntax.ActionsEach action supports the following properties:Property NameRequired?DefaultDescriptionExamplenameYesNONEThe name of the action. This name must be unique."name": "importTestRealm"actionYesNONEThe type of the action (covered later)."action": "importRealm"descriptionNoNONEThe description for the action."description": "Create a test user for integration testing."ignoreNofalseIftrue, then the action will be ignored. Otherwise, the action will be executed. Defaults to false. Parameterizing this property allows for certain actions to be executed for certain environments."ignore": #{IGNORE_IMPORT_TEST_REALM}Supported ActionsThe following actions are supported by the tool.importRealmImports a realm into Keycloak via a realm file.This action can only be run in thelocalenvironment.Property NameRequired?DefaultDescriptionExamplerealmFileYesNONEThe file containing the realm to be imported. This file's path is relative to the configuration file."realmFile": "./keycloak/test-realm.json"overwriteNofalseWhether or not to overwrite the realm if it already exists."overwrite": truecreateRoleCreates a role in Keycloak.Property NameRequired?DefaultDescriptionExamplerealmNameYesNONEThe name of the realm."realmName": "test"roleYesNONEThe Keycloak role representation."role": { ... }createClientCreates a client in Keycloak.NOTE:The client secret MUST be a lower-cased UUID.Property NameRequired?DefaultDescriptionExamplerealmNameYesNONEThe name of the realm."realmName": "test"rolesNo[]The roles to apply to the client service account."roles": [ "test-role" ]clientYesNONEThe Keycloak client representation."client": { ... }createUserCreates a user in Keycloak.NOTE:Theusernamefield is not needed. This field will be auto-populated from theemailfield.Property NameRequired?DefaultDescriptionExamplerealmNameYesNONEThe name of the realm."realmName": "test"rolesNo[]The roles to apply to the user."roles": [ "test-role" ]passwordNoNONEThe password to apply to the user."password": "test123"userYesNONEThe Keycloak user representation."user": { ... }customRun a custom action. The custom action file must contain a class namedCustomAction. Seetest/data/deploy/src/keycloak/test_custom.pyfor an example.Property NameRequired?DefaultDescriptionExamplefileYesNONEThe file containing the custom action class. This file's path is relative to the configuration file."realmFile": "./keycloak/test_custom.py"