Skip to content

Commit 9ecb4a9

Browse files
filippomcfilippomc
authored
Merge pull request #828 from MetaCell/keycloak-init-fix
CH-231 refactorAPI user init
2 parents bff42a6 + 3001302 commit 9ecb4a9

File tree

2 files changed

+74
-56
lines changed

2 files changed

+74
-56
lines changed

‎applications/accounts/scripts/create_api_user.sh‎

Lines changed: 70 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,78 @@
11
#!/bin/bash
22

3-
NAMESPACE=${CH_ACCOUNTS_REALM}
4-
USERNAME=admin_api
5-
PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password)
3+
export API_USERNAME="admin_api"
4+
export API_PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password 2>/dev/null || echo "")
5+
export TMP_CLIENT="tmp_api_client"
6+
export TMP_CLIENT_SECRET="${KC_BOOTSTRAP_ADMIN_USERNAME}"
67

7-
echo "Checking if API user exists..."
8+
sleep 120
89

9-
# Check if user already exists
10-
if /opt/keycloak/bin/kcadm.sh get users -q "username=$USERNAME" | grep -q "$USERNAME"; then
11-
echo "ERROR: API user $USERNAME already exists, but password is out of sync. You may need to reset it manually."
12-
# /opt/keycloak/bin/kcadm.sh set-password --username "$USERNAME" --new-password "$PASSWORD"
13-
# Removed automatic password reset as that would only work if the main admin password is unchanged from the default password
14-
# That would create the false impression that the password is reset successfully when in fact it has not on production systems
10+
echo "create_api_user: waiting for Keycloak to start..."
11+
12+
create_temporary_client() {
13+
/opt/keycloak/bin/kc.sh bootstrap-admin service --client-id=${TMP_CLIENT} --client-secret:env=TMP_CLIENT_SECRET --http-management-port 9876
14+
}
15+
16+
delete_temporary_client() {
17+
CLIENT_ID=$(/opt/keycloak/bin/kcadm.sh get clients -r master -q clientId=${TMP_CLIENT} --fields id --format csv|tr -d '"')
18+
if [ -n "$CLIENT_ID" ]; then
19+
/opt/keycloak/bin/kcadm.sh delete clients/$CLIENT_ID -r master
20+
fi
21+
}
22+
23+
create_kc_config() {
24+
/opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --client ${TMP_CLIENT} --secret ${TMP_CLIENT_SECRET}
25+
}
26+
27+
api_user_exists() {
28+
return $(/opt/keycloak/bin/kcadm.sh get users -q "username=$API_USERNAME" | grep -q "$API_USERNAME"; echo $?)
29+
}
30+
31+
create_api_user() {
32+
/opt/keycloak/bin/kcadm.sh create users -s "username=${API_USERNAME}" -s enabled=True
33+
}
34+
35+
set_password_and_roles() {
36+
/opt/keycloak/bin/kcadm.sh set-password --username "$API_USERNAME" --new-password "$API_PASSWORD"
37+
/opt/keycloak/bin/kcadm.sh add-roles --uusername "$API_USERNAME" --rolename admin
38+
}
39+
40+
# Wait for Keycloak to be ready - just give it some time to start up
41+
42+
43+
echo "Attempting authentication..."
44+
45+
# First, try to authenticate as admin_api
46+
if [ -n "$API_PASSWORD" ] && /opt/keycloak/bin/kcadm.sh config credentials \
47+
--server http://localhost:8080 \
48+
--realm master \
49+
--user "$API_USERNAME" \
50+
--password "$API_PASSWORD" 2>/dev/null; then
51+
echo "Successfully authenticated as $API_USERNAME"
52+
echo "Startup scripts not needed (admin_api user already exists)"
1553
exit 0
1654
fi
1755

18-
echo "Creating API user $USERNAME"
19-
set -e
20-
# create the user and reload keycloak
21-
/opt/keycloak/bin/kcadm.sh create users -s "username=$USERNAME" -s enabled=True
22-
/opt/keycloak/bin/kcadm.sh set-password --username "$USERNAME" --new-password "$PASSWORD"
23-
/opt/keycloak/bin/kcadm.sh add-roles --uusername "$USERNAME" --rolename admin
56+
echo "admin_api user does not exist or authentication failed. Authenticating to create the user..."
57+
58+
set -e
59+
create_temporary_client
60+
create_kc_config
61+
echo "Temporary credentials successfully created."
62+
63+
echo "Checking if API user exists..."
64+
# Check if user already exists
65+
if ! api_user_exists; then
66+
echo "API user $API_USERNAME doesn't exists, creating..."
67+
create_api_user
68+
echo "API user created successfully"
69+
else
70+
echo "API user $API_USERNAME already exists."
71+
fi
72+
set +e
73+
74+
echo "Setting password and role."
75+
set_password_and_roles
2476

25-
echo "API user created successfully"
77+
echo "Cleaning up temporary client."
78+
delete_temporary_client

‎applications/accounts/scripts/kc-entrypoint.sh‎

Lines changed: 4 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2,51 +2,16 @@
22

33
/opt/keycloak/bin/kc.sh $@ &
44

5-
API_USERNAME="admin_api"
6-
API_PASSWORD=$(cat /opt/cloudharness/resources/auth/api_user_password 2>/dev/null || echo "")
75

8-
echo "Waiting for Keycloak to start..."
9-
10-
# Wait for Keycloak to be ready - just give it some time to start up
11-
sleep 120s
12-
13-
echo "Attempting authentication..."
14-
15-
# First, try to authenticate as admin_api
16-
if [ -n "$API_PASSWORD" ] && /opt/keycloak/bin/kcadm.sh config credentials \
17-
--server http://localhost:8080 \
18-
--realm master \
19-
--user "$API_USERNAME" \
20-
--password "$API_PASSWORD" 2>/dev/null; then
21-
echo "Successfully authenticated as $API_USERNAME"
22-
echo "Startup scripts not needed (admin_api user already exists)"
23-
else
24-
echo "admin_api user does not exist or authentication failed. Authenticating as bootstrap admin to create the user..."
25-
26-
# Authenticate as bootstrap admin to create admin_api user
27-
if ! /opt/keycloak/bin/kcadm.sh config credentials \
28-
--server http://localhost:8080 \
29-
--realm master \
30-
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
31-
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD"; then
32-
echo "ERROR: Failed to authenticate as bootstrap admin. Check KC_BOOTSTRAP_ADMIN credentials."
33-
echo "Continuing without running startup scripts..."
34-
wait
35-
exit 0
36-
fi
37-
38-
echo "Successfully authenticated as bootstrap admin"
39-
40-
# Run startup scripts to create admin_api user
41-
for script in /opt/keycloak/startup-scripts/*.sh;
6+
# Run startup scripts to create admin_api user
7+
for script in /opt/keycloak/startup-scripts/*.sh;
428
do
439
echo "Running startup script: $script"
4410
if bash "$script"; then
4511
echo "Successfully executed $script"
4612
else
4713
echo "Warning: $script failed with exit code $?"
48-
fi
49-
done
50-
fi
14+
fi
15+
done
5116

5217
wait

0 commit comments

Comments
 (0)