From 96ed969ed129d4cb9df51e961c554de81454d442 Mon Sep 17 00:00:00 2001 From: Ellen Kraffmiller Date: Wed, 8 Jul 2026 08:39:24 -0400 Subject: [PATCH 1/2] update keycloak version in dockerfiles, add new config for updated version, update jar files built with new version --- dev-env/keycloak/Dockerfile | 3 ++- ...iltin-users-authenticator-1.0-SNAPSHOT.jar | Bin 230694 -> 230703 bytes dev-env/keycloak/keycloak.conf | 2 ++ dev-env/keycloak/quarkus.properties | 11 +++++++++++ dev-env/keycloak/setup-spi.sh | 8 ++++++++ dev-env/keycloak/test-realm.json | 4 ++-- dev-env/shib-dev-env/keycloak/Dockerfile | 3 ++- ...iltin-users-authenticator-1.0-SNAPSHOT.jar | Bin 230565 -> 230703 bytes dev-env/shib-dev-env/keycloak/keycloak.conf | 2 ++ .../shib-dev-env/keycloak/quarkus.properties | 11 +++++++++++ dev-env/shib-dev-env/keycloak/setup-spi.sh | 8 ++++++++ dev-env/shib-dev-env/keycloak/test-realm.json | 2 +- 12 files changed, 49 insertions(+), 5 deletions(-) create mode 100644 dev-env/keycloak/keycloak.conf create mode 100644 dev-env/shib-dev-env/keycloak/keycloak.conf diff --git a/dev-env/keycloak/Dockerfile b/dev-env/keycloak/Dockerfile index 3b0bc8bac..85ee15ef2 100644 --- a/dev-env/keycloak/Dockerfile +++ b/dev-env/keycloak/Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/keycloak/keycloak:26.3.2 +FROM quay.io/keycloak/keycloak:26.6.4 # Add the Oracle JDBC jars ARG ORACLE_JDBC_VERSION=23.8.0.25.04 @@ -12,6 +12,7 @@ ENV KC_HEALTH_ENABLED=true COPY keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar /opt/keycloak/providers/ # Copy additional configurations +COPY keycloak.conf /opt/keycloak/conf/ COPY quarkus.properties /opt/keycloak/conf/ COPY test-realm.json /opt/keycloak/data/import/ diff --git a/dev-env/keycloak/keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar b/dev-env/keycloak/keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar index 051b8f1b394fbd2c9a6bd7de3496c629afc3f36b..9bd21227a12ac2179706a6a5a73e896bff91ad9e 100644 GIT binary patch delta 6659 zcmZWt30%$D7w`AGrPumOsYEI*Ds4}D+80ZU7EOy*6h$RVNSmhYOY+0PSh6IBrj*?% z*~_3bWH7>5=5H(8#Ej*Ce((0)lzAU|_xnA|J@?#m&%L#0xoY)tRn^cyBC9DQ5C~+( zdHoqzrs^Uq{tk@wmfQC_z%tP9`jo4eA4hE7#O-{(er?sDxHX&8E0U6%FQ30GCleYd zFZlb)m%IrwGBT6#|2NL=+lrlWnv63Ygfb)Ppp@~WgLY;t9T>C0bdb$Pi3fEptc4sM zeUX1H$G*GFy;iwYxJE_c^r=V3w?C>s4eWx#em(y@>(8_s>lq)Zh@7)_WXJv3+N^|{ z6T4q(ZS-5>d7(5ct@A{hC@SLYsgYdCS?^&p9Ru%83s*cbV!o}8<#Fldd4(8zXy}{JtlHSrD zFA)Y&JzlB}nI83OL)W@jCbjYsSHbZ6Fd|>~!OE0X=eH5JMEV)WHJUiWbYr4amt|W? zWP?%84YKzT59;FW{a6V#kgInzq2Q@wt?V0HRNU$`k`C@Vji&=U=UjDOB%J^Uk(`%v zI9KB)TR1->{Yq49$Q@gq{HIaLHxe?A$~h{el<7q1uJoy>O{=~js>)qvcW3O1J)gTj z-n38Stjm|RF0uHMcXggi{iDE*iXOZCm1 z{QT=fr?r$sU%oZ4=)AZ4D?i8RV~<4fd6hoT)XKK1gq?qqq|sRS&SG`ymPT_e7cEh; z=YuUCWpWqas%6Niu3j{$bfa0uEibPv#Y&Y@!2q!S+2J`oR{haJCG zE`Ks9FV{o2@c2n#SYbj_V7v20jSWFN2j28Ja@NR6zipkVC|Iy-gvBG34n{5S{W7`9 z7KhrB+)gOUm=!6$YP%V&?i+Y#w^vcsc%Rz~z4oLxJp2CGzPF#NRfG%LI`z~Qmm9lP zl-=9!vLbEpP^WuZCCvjq$FD3)a*2F*!=Krw^vUu3#FFNyb>~WQbA1Yxuc)ZUm0nF8 ztB`9{6tlczrDps5pX?eNFF9`r@J-G7@?uc(lb=t|d0w%|(!p|JY=Wu7UEdLUYm@%^ z=;K!LOfEL5X>D}YjXl50PnvYd;!5tKZEdsODzb97XxW>hp{TJNb^K72#j_j=T-r`=A-Z8Aw zdCzIl4=F#6$yWZSYqz(a((dU2Bic4Me{QlUFSxhf^L%(>k%xukE_@lh$?G<)Xy`hxB&`tLnY3#Vvz2B*8& zZTaI&`t@p^=3^I}D&2?2pG{w!uIKP`<<6hR9!m48^{Y-uYBhhc^-TT8Y5Q*nZfcMJ zYjL}s`tzx$9;K{*c`2{o=+TAZ{(0*1g1LG`Mn+xuZBHoxRs8H2_=<582$1o*1+a@%SVKrs`?d;%%Qbq-04agv>z5of&u?$sD zoj7am#97HUX*2(0$scf*|A8MJ`qlGuDZ|;?>cUF{qD)FE;Zshgt{=cuxHit)H{A! zhso_HDaYeNlU*8oq^7>)={MKDqsIL0}gP)8G z3F@Xi!>h7}8ZH7_bA^ZK4h_!9A&wEzf$Zj8nH_ z)%*4Fy48w0!COp29DpERM<*ZEMk&b1jO(L12!v)NUVKYImKiQn6IPfJLrT=}L?m1` zBg1-WYy)+3VyMqwe6P3rZX1pMc%R;V{N9H!a}p}P;($LP%mz4ZPKFprt~!ic{2A8A z>V^~N?QGtsY`!%J>0@B&j0R! z33B7zqqZv44JQ_iJ=_~kyqH$dwcGaTa;T90auzRgm`PT;F2Vy z8{0NfG8VvRYvRo2OzuMnAi;)+m@ZgjLxR|XDO}kUL-=ZgUM^3?@gVNw)cz1{i+IsA z9>aE9;=<0%5X-h_D8g4>){==>hx;c}2+A`s&PgJS^U+KswK>&Uny^oVN>Q^xWKVS9 zrHHt*i?YRltI1Y`aU)QAaGr#axD4b4JSYB zj4SvAEzTr@ZQjBQjn-~efw5yzHpK;H%24D&5}3c>z6%-8UfD(MKkZWI!&HM=t{8m( z3ZB*B+$)s9buO}Jcy@0kWrOw!;EOAUWw=j5Xn@cI)uxX`wTvHmRvWgBB%|1i`=y{C z*S&urAEX6qRD~s_1qp7LiWAl1akU#6$*LUW$DHFqHTcH~{S9?Tf6ZbNBHXbE(hrH1 z_qh{SR_+Ltd0>WZj)-TsVD}%D5dFA2M^(T&7F}d};F>F8jRzKMNWIwlod+4gmNtmT z9-hRBeSca!?T|(#*yxGj%{n8NS$Pp9c{H=jPXX&@(NdURR{9C@fc=a#jzQ!{inQ8a2*L<(DNaV?0Gt# z;e(C95o&x$7;DiE2Ys*{^nHmPtNR=5@I#R0OKh1{u)~*xvvPMSr|yRi*n1SD_z_oT zIh6a6D7N(h&zXY0Kc3!I5ay5dKkzZn4dnbEYe1kU#`(w}Lz(l0vgJ<{pwbH25u=cO z_>`O2HHcIDQv>owVUi~NPmFV)E5X%Kn1|r!JcdD|i5pw%_=XhC5-&Lbayu3Y}+NpKAyquF7f#QPBXNeFub(7@qK50-<@0L)~F z3>ZcdEpQD)^M1D4G~qe@njz#lkMI=|y{mp<=o%WmN1itRKSg$Uhn(WprVm1D~dFOj9d} z!m-C{Kv6hmE83YVJrBpTzSV^S_wfk+aHXJ>2c~Wmgt(#iuJM?QGCW44^*P}ZG6Wd@lzTb@6fEamCBGo-Wt&ctE0WX+fm}kH_vkX)XmT=Hjd^@fg|ud6WssVdOwN0h3~yLz%<`>_Wi{D44r|QKJiQOTalV z7gAa-k@&KPMHD0@Vz1o+I}))g#x0_pY7%i`c0ySaF@Pya_%`e0$MNjBWiT<7=!0+~ z?yCPv3Nk0+ZTD;y1%p@PW9`L646%DPWxO_E45KIE0-M(KVh&8g)@cckJewYkUxV;G%AT$r;^l!g~w%`ep9$26?hlxq}(Ohd4}g@TG{xbuyz6evu` zu->;(kT4xrR&#@bUj@GyCP@s4hb;Pfz*St>9 z@02e1ovy=zJ=H;(&JH{U;-k1T0~M_wQ99`nwvw(4Ou_KSl!<@L^oLjc3oJep6+b zjqnewZQe5i0SxKF-4wrDxGYrke@$iAvM_C#Zz!;ziN#;=mV$LNF>MX+DCnArN9h8H zX5lOIA*`82;@FA*@S>rhHXHR?K2eZ4oA}_b5eH}EgSz@FwY8dq5AUZeF!M2ZHNxtH z!E9XonK>B7Dp@J52&ZM){-BnPi{2~Oi;l}C-mI~FFQy?IpUf2kF|$FL#S#;+TJ+r& zFc-bHD@jC}ux2j$vs3A1eRnSQ5rHbt=z{$`yx;sRc`z7?=Mfv$IDmo{1dQT_`Piji zFQMkTOEEz4&Mih;rWSV0#~Wlt8I`K!;A2*HGX++gSq;d}!3GlmLC3s`}DC5S53gbZK2*It;$%VY18)_o74dNe(;wSTCk4 zpDbo)ob1J5s4mh-EZFDg`pUE*VjAvzOd$ri<)T#P!|FFnfhzwt@nl`DP$p&}K8s?m z@<11A77{-;tAzr!B7(nQw6aj%${ND~OL~fwp|psoGAm(Q5lJQ8RO|-+-xCoDyeC$6 zgCFi;rJVg9x8xsqg%ZXF42p>hncl%dVFx<^VoHcIR^?jp_o{Z{DB0@ z24ay2N)TO=ptNG52`MFLGf1~bAyAhH!E8ACI>qx%L;mHJq2D5++i$r({!vBd|FG4l A3;+NC delta 6406 zcmZXY30#iZ_rQCeTT1&vz3p$M^tQffS5jJ(q;*7*D3zk@LL)7VC8B3^WJt^mV;#E) zV;PbN&5WUtkey*tw&;KEd#hjO?~~qhzUSO?&$;*9`#f*Iu2A2$LR~!~l*sp!Q&Lir zyHR8rzgFE-UiKLpKlr-y!`0V!(4&_7ExcSrsG`#GzUKc% z%gM<_;{X3e`HMz*ES0C9f+6R@gjmjt38h>B6Yg>$Ot9s{n2^KA%7lY|^EL`hQc!xM zz(<@H-m6{Aeg5Yfx!a-TpF&=#3u+0gp_nQ=-9yst=tJ*0`mB$LZLK`yk zLT0~D>JY7K-}{5^tU%Y>Rn8$EMzgh34?f&u^>c-7fucpf+DOhm@bU&1vBs&|CmGt# z$$RTs4a++e!p3R+aI{+OZAXH2XY){6>S()}dh2iWk&|1b{oh)J(Hb!<|EtDM2b(lL z@htVb+8;P3HTDZ3%)?qVnh8~wP6rQ)PRVy;rxKIC!mq|gY`|6HWnDqy#jz}iu**K| zATdA00v)Wfe4)sEciAuK@|8&2x~6H0))%~7ESW>HO8|2aC_eATu<*+5fPC{@qj=#b zcP}P9aF1rfV2_1NIOdU-Ta(!+)javwHs;6JlDVb2N-^A&NfjXnMbqQnUWzCRbKE*2 z>OjHP&Vhwjq=;{!}+@`R(id7r}(7$O4}G65bX=F*{Ipzm8;~IyCK_V z&$|seyG7xHlhqnDGxWVI_IdnLee$A}3V3f@`AiA&U1^tba z)+TBBx9ikB)fqe8TjP44d-ujzw=Y{>zf?{BchBsLH;3()PmWSl^oWk$V7=}61M>jO z)hZ>Q^i>m0i?Xf;J#d`&&g_zHYrSi3-J3#7A#LfLqL;5ve@NO;KVVzmi7`P-PBeST z<^Q^9(wX(j#x9~_2O>A3BLCAN*U`UUt3M)%Nc`dZHEw2WB#nEHi!-0)bY`3@xcj!s zYM9^J!tE~g3tdy4R{1}?(3l@_Z0m0;owV($SDZR-EuOQyX`4q;#D^6n>t|<$FEgCw zFP|Ixs3h`YFeuJgP06>~l36C0|O^ z?yon#^e))9@=1GQ_SxTd9ZQiIthzSa>*x7}PtE_>vwU~Uj2k;=4A*F?J$9k4dWu%+ zaB<_i8p&$O^viS0Y@&?M_-EhVx>}*$)v|0#Sj*mn%4zLY|85`i%=Tvcv<2Lqea1e` z+1E?<<}aUmCN9^!^^S@9%jJ4ohqO9+K37@cX8UpIjayAATN|Tv%DoSSSWW+AzN92I z|61DXNK^9eR#Ehrk-r@9=)5IvC@+k^^Q`pB{9#{wKh#Zl;=E(!uD5M%Fm!N-T$_*j z_0>tWWz9xg+N2J)xJwiRQ6&hD1(IOQZMQKyT54IPdS`yt$)s-n{n% z*}V!IOo_W1we{SdaMzT$%FZg>&L;+0Mb|Z zM?(vCTXd&<0?mAlHl4#+Fx63pl>@rMzw{q1{u|@B<0T*bRrm|wJAkk!6Z|j$$Lok# zjtv7ye_6@LwN;w(uw(};IpC|Y)0nGpP-FpVW4g1TQMg1{Y)L#>)+a3y9H+nmURx0@ z(6b`i%w%tcGX{wv&yv_vn>H-7B8IYQ*Ug-JSirthQvC0TTVli84iO@T^oP$Va~Hwdjtu3zA396+yYuYrK@r#tW@YR_pi(sS^@#Gt4psWYwPQ-^FHA~ns zM_(wKr44-t;R@u;LERiS`C^dNK^Wwhc?gVP^C05J+sp?iXCfA|=Bv}z*M$DgSVuNU zoyl0fb|Ex76C*)2N1f$xo*K*Go--N4>n)}u^?b5Y5cDMCoTDqRj6er^G?wz^<> zw+e;pOD!PG6(`)i6lHsecfz^Ox?(mnmQ$l}Y`F@ky5YzhD}=~mJqULrzT8?^<3=L+ z`>PO{0OyX&V^@r_6^wO9*9B{+YspUvaDO<_g`@5m?$z3E_K!Om%3l(?)sY^UN&dQS zb+ZR9TWe{z+U`Nz`7;~4)lg4dNK(H}&C@cT!oX*l7fNJuu=Q)Zx^wF4(7J zw?5;p-njAx5aCTCxc#ujn?&*Q`ytYs=n202HDLE>9BVrS$DUyn5{6*^BpqTdn-6Kg zli}!6PhC0=3uZ@b=xS?%wGV==M-dpqL?2AK{5Z;bLc?)osPe&bf=+?cP$Gg(A0p+J zf^;Yu#lJW$Xq_>Gqf!j8e<%i+au$I|*mhO}rr@Pg>Pt-cr{^dG4_`8bue>1Z^(J4U z4B(5qs9)0!y!b1Zs4OVeYS4bwgh)S(XmLeot``Z3R}`Vh57U@jhq?jO`wFGzXY?}A|d@Rb+|VS1DO3S(-Zzy10|ZbpFcWj-9l&t z^ZhZU!UmL$;i5mbb4Me}*6hf*1)$@HJ2J=205X`*Ym&((fmqD709=)ezy;!gD10E} z^8$$nrwRK4Ni3i72$4RR2N7rf)??ToL<|M}Cpu8&fEla{!Yz%2eL?6L@SGa0z;QTn z;R#-VeuA0$(%i7)*ET4GVhrjS8#|#xggwG7#RTBfMhrQM#b(epk_7M@)tNFb47cuFf2RBzhP}2H zFAD0WF$&jbx41`9gz2MjYm+Q`k$o1NB5UK8QMegrOT$S#zut;@EDFb5o)2V7q5~%n zcfxV9H4;Xo5yYSW#;%unvmK|*q8*CBd<`6WY%0(ZfyK{pWTeWm+c7B;9h0OKi=aZv z8Oa*>9HotedZ-%6N8#ml(UlTCh>F6>l--#UdiZK9ng}LpeQ}%L(c- zC5+M2qqsh>GYs2C_Ege}Mca~5JvLL>h?$gTM=<&^mZ$?6gy~$Q_(oI@9?HAKFeNJn zpZ5*%Sbp{x^zj&NwA9jF9~$tZy>1BEGO>GnOS!&~ z(t^*5+-%H$^?ahLVe-`%hgRws%KJS6zbqnw;zxKwWy@=sh0EIlzFD|cr=L@+7*1qi zLchIWis@_Y5!30oq7DD_5OpY;PP^_6BR8kx8cqI}DMM!9i{qSDrfiyluM0=sGUd}- zP8T$0;=q&bjKt5xxVPRh#pFF6$69J0^Qmj}CoE}t7MA2W3m2ohgJIRr_#Rk13mqSS zX2k9b9=bbo(D5U6+}6qP^G?5_>its=|zg?;;!4M^&(knIFW46 z6zAbYo!z!iVCk z#Q;(k5Km5kiUlNr5845Fi-;>!?BM%=*FucAU?(LB@OdY%1Xn2G_b~E02hT@h4!%0( z!rC0Ng*QFS3?<)Ubn{B4{9MUf$X=&G?1(Eec@g$%3M^hkin;rsnM-{eg7BM+Si%BIGLc}ruPVfs;nOD6RRS7Ih(Vt`Q~cYB-2Va0 C5_?(z diff --git a/dev-env/keycloak/keycloak.conf b/dev-env/keycloak/keycloak.conf new file mode 100644 index 000000000..96a9fd708 --- /dev/null +++ b/dev-env/keycloak/keycloak.conf @@ -0,0 +1,2 @@ +db-kind-user-store=postgres +db-kind-user-store-qa=postgres diff --git a/dev-env/keycloak/quarkus.properties b/dev-env/keycloak/quarkus.properties index 64ce6d898..302efba14 100644 --- a/dev-env/keycloak/quarkus.properties +++ b/dev-env/keycloak/quarkus.properties @@ -13,3 +13,14 @@ quarkus.datasource.user-store.jdbc.recovery.password=${DATAVERSE_DB_PASSWORD} quarkus.datasource.user-store.jdbc.xa-properties.serverName=${DATAVERSE_DB_HOST} quarkus.datasource.user-store.jdbc.xa-properties.portNumber=${DATAVERSE_DB_PORT} quarkus.datasource.user-store.jdbc.xa-properties.databaseName=dataverse + +quarkus.datasource.user-store-qa.jdbc.url=jdbc:postgresql://${DATAVERSE_DB_HOST}:${DATAVERSE_DB_PORT}/dataverse +quarkus.datasource.user-store-qa.username=${DATAVERSE_DB_USER} +quarkus.datasource.user-store-qa.password=${DATAVERSE_DB_PASSWORD} +quarkus.datasource.user-store-qa.jdbc.driver=org.postgresql.Driver +quarkus.datasource.user-store-qa.jdbc.transactions=disabled +quarkus.datasource.user-store-qa.jdbc.recovery.username=${DATAVERSE_DB_USER} +quarkus.datasource.user-store-qa.jdbc.recovery.password=${DATAVERSE_DB_PASSWORD} +quarkus.datasource.user-store-qa.jdbc.xa-properties.serverName=${DATAVERSE_DB_HOST} +quarkus.datasource.user-store-qa.jdbc.xa-properties.portNumber=${DATAVERSE_DB_PORT} +quarkus.datasource.user-store-qa.jdbc.xa-properties.databaseName=dataverse diff --git a/dev-env/keycloak/setup-spi.sh b/dev-env/keycloak/setup-spi.sh index 5e0fa29f7..bd6924a07 100755 --- a/dev-env/keycloak/setup-spi.sh +++ b/dev-env/keycloak/setup-spi.sh @@ -27,6 +27,14 @@ ADMIN_TOKEN=$(curl -s -X POST "http://keycloak:9080/realms/master/protocol/openi -d "grant_type=password" \ -d "client_id=admin-cli" | jq -r .access_token) +EXISTING_SPI_COUNT=$(curl -s "http://keycloak:9080/admin/realms/test/components" \ + -H "Authorization: Bearer $ADMIN_TOKEN" | jq '[.[] | select(.providerId == "dv-builtin-users-authenticator" and .providerType == "org.keycloak.storage.UserStorageProvider")] | length') + +if [ "$EXISTING_SPI_COUNT" -gt 0 ]; then + echo "Keycloak SPI already configured in realm." + exit 0 +fi + # Create user storage provider using the components endpoint curl -X POST "http://keycloak:9080/admin/realms/test/components" \ -H "Authorization: Bearer $ADMIN_TOKEN" \ diff --git a/dev-env/keycloak/test-realm.json b/dev-env/keycloak/test-realm.json index 571a1e80f..53e3d32af 100644 --- a/dev-env/keycloak/test-realm.json +++ b/dev-env/keycloak/test-realm.json @@ -2396,7 +2396,7 @@ "clientSessionMaxLifespan": "0", "frontendUrl": "" }, - "keycloakVersion": "26.3.2", + "keycloakVersion": "26.6.4", "userManagedAccessAllowed": false, "organizationsEnabled": false, "verifiableCredentialsEnabled": false, @@ -2407,4 +2407,4 @@ "clientPolicies": { "policies": [] } -} \ No newline at end of file +} diff --git a/dev-env/shib-dev-env/keycloak/Dockerfile b/dev-env/shib-dev-env/keycloak/Dockerfile index 3b0bc8bac..85ee15ef2 100644 --- a/dev-env/shib-dev-env/keycloak/Dockerfile +++ b/dev-env/shib-dev-env/keycloak/Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/keycloak/keycloak:26.3.2 +FROM quay.io/keycloak/keycloak:26.6.4 # Add the Oracle JDBC jars ARG ORACLE_JDBC_VERSION=23.8.0.25.04 @@ -12,6 +12,7 @@ ENV KC_HEALTH_ENABLED=true COPY keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar /opt/keycloak/providers/ # Copy additional configurations +COPY keycloak.conf /opt/keycloak/conf/ COPY quarkus.properties /opt/keycloak/conf/ COPY test-realm.json /opt/keycloak/data/import/ diff --git a/dev-env/shib-dev-env/keycloak/keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar b/dev-env/shib-dev-env/keycloak/keycloak-dv-builtin-users-authenticator-1.0-SNAPSHOT.jar index 3aa3ba47ae4b10ec6d98171cfa46b6cacc4ab155..9bd21227a12ac2179706a6a5a73e896bff91ad9e 100644 GIT binary patch delta 7160 zcmaKw30RHU|G@8kPpkGsw@qCot-7gHD(x!mw9uX`)wH6Nr9@(of8Y0X@08#3{Cjxr`F_rKKijRnzbYPErKlL>izL)IGBPrp0GAh0 zrHb|v?5A&}tK`9+NoKwtH)dUHej2iABfaa@hV@6ZqSkFn*&8?GO7ox1lAIu4X_?Pg zzb}g5a5xF@|0ic10@fL=#O(W#qi{KYoq}xLxhJQ$KRI8AsRj8`{r{ZLH?$h)7@XW2HgCN{dq-qdModM`o;SmP z_gLY4u_QRDyC%spJf!iQ16|nYIy!Tl@5AKDLu$t62;3^QhY2TNIP8Pob(~pq-q6zh z*-OXT&Zb!5g<+Ms3)@_-cQ1dZ`yDZ*{`h!U-Sf5-hm)uJbFFlsQV2cKEcz@PYu`dRLhfcQ*F2r5mB*YdZg!imzpr&@+ICf zd)&CCE{oJh-%Xmj`SqhNGq1d5KN{1w?S6i|qi30Oo$k|~Yh8veRn+8?*sA&6ZMj`@ zyB+7+=6~<~qRW}EWTTsU&Cr!eFI>08Kg>@4JS8*e$o;PeyC&W5wAnd#S+`H;i%+Xe zb@F32+&`M}uHcxFd}oI7n#sz|%G+(sr(CnV^Utj*i3<0Xv%>SW&*Q>Zn@-vc)i`dP zbFOmV>yy2Q9^9!mkM}tzJifHT@3gwl2g7wYgwn-mpBP*;qVIGdculx>_rJ8^Ro>#8Q-wi^x6fVK{C$jBlF=iT#?W`p zb5hc;@6DEd7-zKg!L4V}D>IgBzTY!#w6UqR6K89%2DUlektv{-u93W7ZIEQPby_g@ z7tPx}mQ9c5)io46imEVg%1<&ZUv0yy7gW2AY)Vf}9b=J_ZvN)*^VYKLGIiTT&W(WZ zIlg7N5A<8UeyCOa;2Ut?ZzDf!$FT7`LT{?RirGDKi+RjJxvcOvCdcsUghPEo4f@PJ z-^U-m7S7HS%;Kr038|t=xvW)1`*weB$ar;jU+{tMJ>?7Qzn5k_cr5otDc>vb>hzF> zZNu6Qc1>PC`lXa0szhkibfi8%?uGeAo7KM8`9a;a;a^i`m@W#HUVc@D4r%(h<&e>) zmz)*5*FHYF^iry3Vf2T<{aTj2$Ce!aebc=U+VxUS8WZ?uUzA0|8(%ABT`j_w0-@m6Q-+Y;@ z+SYxj%H+Ujr@#iia;*lh9Jg}oD)(LEb3^6@ew5Mu)>bzCnZ%#lhI?v0?|hcDDopm# z-Cy+&pX}b|ocX$Eczurdx>6~xNQ0@~k2EgcdlhB4${_gt?(82@%q3T&D%V~h!QqUN z|DQXK&$GlXqv6gn)X^rl*nTCJXjQM*aimn3mjhk_@sA&ENf|H}+SR&xL;CMRb3Ru> zbOnyDP8n4tEt34J)6LB(R;u1%(TgPf!5_WRY63f`zHjA05u`tkAbRGwDv5UjP|~t> zAcF|oDP&M-yO14J3+(JsqS7q&ZvPZ}t1XWkQf?gMT{(5pcE6KpbYn_UijK|M{kx9( z98aq9I2IGvV*Gk*!}(9i<@bCywnl#}YPC{%HT&F?nH%0*UL@t^mCrtT=b9H}>mUwC zMd{}jEfYGd5IS)G5IRtfkJ(DFvM#b!U^*jyC~=4`vLTbjx=53E7aBHmMwUg8FPBo| z{P!5+TA1Z3;Cs4AD@xQ`s=vDsdccnlm$*obpOYOwXNE;m=KpwOv_;0e0j3=R?>g28^NQkTJG% zLh^b{$?)WgUtIq|=6%w1hps*rj6~$i1x^`>G%0T-hSE!vq|JU#y=ca^i*?X}czD3w z2D#cHHlo{=H1TTv{^0Xf+K>JQot1*);4sKSs45CWD-9jWT986E>q8P()x@*yO0xK+ zKGG+%Dh4pC$zv0T$A1`G;=lvvF(}GBu_p61K@&F{Ao&4~X6t|>bJL%8&7;C5MQtdv z3X&dNW<8@n0T+)#s%+qkOH?#FAz%WO=r<^^zaD4?U0jeU)f;eR^ZZFrp#;_EUuM$dNlZC>D;@$Wh)Mh6xep&(u6 z#$Y%!iTxRTl*+KPF&e?%9XQ??w&g9{VvI}%mGZNPzK16R9ZtP*ZB z2YWhB1f8gx@uIOTUNi>TQMn0&fDC>x23b;XXRy@J0@+Y`vtX=_GXzKi=U5;C)jV4a z=$zTA*whLsF6Q_+-MDJaiXYSRwo77*?`i5Uqwo^#jkSs-gvNH&rGzhqBB>S<;W_Db5-X9p@h;D$NIm;LSom&*GmbQx$u=^tS_h95XUy*0g)TLA~XFh`nWQo^GPq2UVoUN|zgCt$@d?^0n3H^=uN6bFIl*9fLp^g5p zL=115h#aYk*CLsYem#^N$>Cn$P_0Wef&IN;&jh?>WW2)*jQ014#*CAakcnPjzbu87eP9bU{L4Cs^+B$b{bzQ3$_IHT{*>8h>ziLXVJk zf9OeyzIa*@`v!pTW&=X<47f`8dlc-`KLWtdPD6q}1i+#GFq#N~fp9%-G$w+dF;@c% z=YqlYKro0gBUnBN4D`nkVRjJnW>^rRHVCX!1dPDLYsbP@V9j7S=1<0o2@jvn0)HEV zVI#HRieMB-4YkGG$}GZ-GQr!)2Bdv zNlt`RO@X|QOdvwK3p9=0%4Q*u`$ZRmV?&S!RqDnp%y6vi&6UJ;A<#iRuK`3M6skz{ z785Pfw8BvEb8iyCCqrS^Z}laDTo`PbIsUjZ9Fo-X=c?jdJ1BBR7#OS#Ah;$Bwo*Y5 zBk-_xIBeMV$znks=Y_+LbqZlfIOP$>e2&K7LScpNnG4=~D!953&R}(%8qQV2B~zJ| zjUdE)8dAkira~b*qr}9Wl8GTgaxAo}HX2r+&FkbeXns9znFik=*3KX*wliR{bbKJx z^au#GdnUntGr2rm8wmIugQq641(zjqjn_h>9BP}*AF1SO^5F!|I!1Pk-qMboE*v^{}4B{dtm(#9x$eTpkHVMp@PKxfi3BJB8w zD~nUp;Fjt7M@*FP_BmknF%5drgjLc}1a>(r|1CB=8 zJ0j@4gRZjQ;#)Hye%^b61@B=;ve+sUaP0?z(=*{9UBnfcD295}hb`yAySAZEq#8U2 zRO7!8ymk(}Si-MFcs&Pxvw4dJb0N!PKZvixbKxO6w`1TpyNCtQm%xMKIb9rkhLXaOd9YjRnYm?$#B)B_aUlei zJ0d2*`1V5BD=VwTBo5~-f-H?r5K^}Yt)xs(5g~3d+CZhB5$k%3W0_E|E{O3c?6CkA z`A!~0-*QQem9R!WT#mX|29W>0nC#34ZTqX@IZ1pcAGXxAYhogSEtbIgW(Wt6k|oFy z*|$(ww*~&r3BPr-2TL9+79d6L8mv=*5>X$ScElG7kR|ec$SONx&4-jCc3TQh!55sm z6xw3Zj(04D1b=DA_m)E6k72E4$R91%Kv-D=zK*Y0hD^|9ktAG(#v(1v{yC6j@RAX* a9_EF}95s#ji7VogLZmFUN*Dg}!udZkfQwK7 delta 6754 zcmZXY30%$D7r@`|ciVfdT3-8}_FmfeqNI&dl2VG2N@W>Djbt0kAbz96n6V7T5Yc20 zg9`nvg)z3Wg|Qn#g#WqkR)6O2lioewbMCq4+R7>sGzs>3Sx$9UO+Y&lDH7~sHfmdorY*Zh}S4CedERX!=-Iy-P z$~V<(^d^UU-l%hr^fCTMJE!*E4%^M^9p@-o>70(|oWsxj=wYsLDgK4TsPLuRk{iz@l&D8#Pu0oPVB8&gLiCb-(#s{8--m2Zn zvDS5+NWv`aBuT7MXX7T+N^Hu~h8qpjxv9S*MrlBP=g@7Va~o|pe3R$g=w+|n@@s!C z|Kgpu^)?6Q*EEUG-N?M!_w$mX>dpCkF0{`HK5Ewf=)g2vi@91A2TLQ*{Z#TS=);rA z_pQr5emuEO^z2rh`2B?<^GwTyI`zLi_T0YZ&WIg<|FfmiHEo&q+{VYHsVe6k3f`Bs z-1Y2i&`-C2JuED(c;uoPp5JE=(k(bysVXj<+966gy<_pOMS%;}Rvmv^aK*ksAyE6! z)s%#(=ck`7D5zUHVbid})Xe0IiGIZ zdp*1J&oq}#b%S53r1Lk-*taHgW=C?vf{)yx{$&a|6aGAEWP2`iRpzrqJ8_O-e;4_w z3D*WcOg?k}Q{YAyIZLlaZse|QYeTBI@d`I)koF(#e)W>(_vOzgR5krPf6tRa%@+=w zyIVk>uPW9T#1GWNrJFXVu3Y=nLo!e!V{ZEF{j=Q$>6hdC_oveB;8zV6w< z&vQr`eDTr%pN3n8K^_xsHbg9HXn8zfXxW07hxPWYQ7Jvw5Ib-DirUd7M@C-hNUJ|- zTe#&YF}8Lm%5)RJ8p%#f>U6^Pp7M`d<*({E*;}0p6n?8qid(p zvmYM!-FK|Q?xJ$;A9?_?j7=>{oUM%!VCPI z+uvzRW7Z9_zh=3%W!~+w;}d_0|7~i&kwF_~dI+CB)xFb5v#F6>Ui**y+q~2t?v;4n z5L>z3jSw!~33d}FKAm5meM@WHi#CnPZb>SEyD~FX8>|zike#*;d-HCEjr6Z}D2{2q z|7hd7PeIm~&RdUA-gDxiKiQ_I`~J|7A;Cg$WLrY#YRB4=jLwA(s*=vDWeXcz=1+C| zeepslelGuO*_DiSEf1t=+`xMmYuj_vvjl8kzW(8?bnK59N^%$x~=~B z&OrP7b#}J?I=My>P?WGcs^UNApJZ-*JGG|j=~ne)iD4DZZL6EqmGzbvFa5jKFS^G1 zh*fiZ+Yz1~Ff+F4z4}Z^M1ZvY`8jNi`qNju@fJIkuKq z?qu>6%pl7nj2Q?NH+nHFJoEZpZr+lv6k(IM zKWp6ePGAi`pAuQ4_JEHs$ys}~v7}GxIq`%2(lxIg=l83Ac{cZa)D`I(i_{3U=Uacv z*Dm&V@Wv_gCs#GB&qD*$7{BXh|-54i9 zOXJ^@FefG8yOaQKUrGQUa90*N{AfnJ)#z2#dksOW8S!Mw8?%X_qy_J#?5ruSanT&F zBl_PR2kLW(p}7LbwBs@-P0gH?_5W7Y_Qa6u4{ObdDRX+%96>o)SP&z}fBVFtL_Gb4 z|4i6N_wOd!!HIc@w;+bR9uJ|`#0n}bh?wE^6z6o~HVdL>PV>5WuwvA9Idmr$i4wnZ zdHjE-Dnf{oF{E1(10~uA@2OQ#W=Zt;7m92YbVqG0Atj55&8Q7^)f1}SSAIi5%Zhlj zm}0Cj+0_&{LcTRo7M^Qp!FH>jkPo4nZ_=h?xC>@|RA8}nxBI69lFYB5|2KGB4*JUd z2?((!?23mq*4V#~gvEHxn&`?>{&E+Debu*snc}5s1>=%?qL6uMHHLBLhg77(z+ko)8!J#Zh&fd%bAG{l26Ri|8ZOt#FlfgK#^- z9!>Ds4)J1lLF%CcTkVKgHtz0iJ2ZKm*2_vFk>snXIqMFW?T9UNN&9lTU}#S)7zoBH z=7)O;U0wrVtvyCXw>8LWTMe4*v9@L4F*S?v7G8SWgVdqNEW`onMi~`e_}IY?)R9d0-=uR?zn%qfs=4JKm`st5(j=;fDjj`3m>t~MSz_X3FhmP zAlHd_@UM~}RFTt%Z_9}WG&*5+-f+u_#PW~~x1ESFL^~4?&I4vSlN3HRP2kd{Q0PiD z!Po@{yO@qZU#J+R57izBry}H(VYv%Q%lHp z;>o|x7B=J=0WU?n&>UHNh?E5IA9Atn00tv)fRj=j^}%?V@{<(fA6STO3Bv z4FapWp~8yo28??KAYZ*5;seMKP6`_W$WVUHE-LB^AvGGXJqbHI2BJ|&jf_HiAXd#z7_-SiZ0ifx4yr(15a!c(7~F!1 z1U?55DJKuoU^1A`KPqS)vw(e4bWjtF4jvvuAQ65&t^v7tuvCT+Q+`}MW#AJ+0(tKf zvTAP&Au0eNxQwe#^#Ff9=0CJ8D4o`z6{`vHq3H3KGs5i_iI8zt5xx(_Fz%g2*$`Sn zi4Q-snYM+X7BS1ae}C-Y--1wD8HEnkQhEC&!QzHQ$h)i#xB8=l^?%Cb^ebwhMB@$} zfJPO6AvA{R1280V4cjJgY5>-A$#rbou}$L@hK9vAWrl@e#E%!X$=asjn9PMRoRtXR z!f{8CyD~m4979}o4{E|m691?jnE_Z1B<_6j1E?8Dj0A&+eW1<-Ls&TwJzsc8X%b)m zh<@6FYXouQY#}p(jNlhNmGyvcBXFpBDMTOMMPQeP=M1|JqU-fiCJ3!BRblBMOw`~N z14BCc2v1)rL%<*$ii^a4OJDbB4B`6}q@yXVe8ar0j>Ncq-cdmx9z~K6erKml5XQeZ zfs810{qqMQ{*#fA-lf8-=~xu@ulk74noX)!G=j#@2=pN=nhfLvc;JR$;lJZKHP{)A zKB@>KIdYs9n_%r2>@-%MVtojY!6?=!Fdwa0Kw zJR06{rC0*%rJS*>g6kDNouKyD}=UlE>^=)=&VnAt)vCJgk(bMm(YT+ZV|vDZ0o zh8O#A8qi6xP6FaSz6@XRMI4ogcr0RW1e7P>3Hy^j(>_kXjN1a35Riz1RS*+y1#t#! zx%MVvzW``XBqMpn{#2_6;lnVx%7IK+F$|B^R@@X+^Wz}SNS2a%5=Idh#b`(pu2Y|A zCY+Dv^kpW8sL8_^Mvo5W6kuB{mW}LU(i)CBxxu|UGg*&Gl)fFp==uu02F7Ea6V%R z6WTKIEl~jGqe&JYTtS%>_KwCabb2`zTw(nRP6-yIVYFUju(%5$ehkUu=dNVhCu1=8 zRja7r0*P680yu1;LSNXCg)f>9zcE3ajeDSOI}`GZ0@jtN)muu^0z)schqa`7-|jU&VP?4$J492}2f z`ah4u^quP&`Fk8bST>(vLQF2slrMf=qyv9y!dj4}dNLPX*`8te@fl7P)bh~9^>d7@ zKaT{z+iAk&JT%n3z;JaQmZ*0#6S|tQ5RCJ&SN=stq?hn8lDYpbpSr)yu+w;a0iDjr zrB?f^m-zDAuQFl&cuaQibtYUNkL7Xv1{1!!*%R*20`%wJ#_*B?T#`+9nUH%A)9)<6 zC^p<g+Yk(zCoPE!-g4nJeohkWka0?UE5>kw)Oke+n}%)=I`(1(_ G(SHHPI^e$m diff --git a/dev-env/shib-dev-env/keycloak/keycloak.conf b/dev-env/shib-dev-env/keycloak/keycloak.conf new file mode 100644 index 000000000..96a9fd708 --- /dev/null +++ b/dev-env/shib-dev-env/keycloak/keycloak.conf @@ -0,0 +1,2 @@ +db-kind-user-store=postgres +db-kind-user-store-qa=postgres diff --git a/dev-env/shib-dev-env/keycloak/quarkus.properties b/dev-env/shib-dev-env/keycloak/quarkus.properties index 64ce6d898..302efba14 100644 --- a/dev-env/shib-dev-env/keycloak/quarkus.properties +++ b/dev-env/shib-dev-env/keycloak/quarkus.properties @@ -13,3 +13,14 @@ quarkus.datasource.user-store.jdbc.recovery.password=${DATAVERSE_DB_PASSWORD} quarkus.datasource.user-store.jdbc.xa-properties.serverName=${DATAVERSE_DB_HOST} quarkus.datasource.user-store.jdbc.xa-properties.portNumber=${DATAVERSE_DB_PORT} quarkus.datasource.user-store.jdbc.xa-properties.databaseName=dataverse + +quarkus.datasource.user-store-qa.jdbc.url=jdbc:postgresql://${DATAVERSE_DB_HOST}:${DATAVERSE_DB_PORT}/dataverse +quarkus.datasource.user-store-qa.username=${DATAVERSE_DB_USER} +quarkus.datasource.user-store-qa.password=${DATAVERSE_DB_PASSWORD} +quarkus.datasource.user-store-qa.jdbc.driver=org.postgresql.Driver +quarkus.datasource.user-store-qa.jdbc.transactions=disabled +quarkus.datasource.user-store-qa.jdbc.recovery.username=${DATAVERSE_DB_USER} +quarkus.datasource.user-store-qa.jdbc.recovery.password=${DATAVERSE_DB_PASSWORD} +quarkus.datasource.user-store-qa.jdbc.xa-properties.serverName=${DATAVERSE_DB_HOST} +quarkus.datasource.user-store-qa.jdbc.xa-properties.portNumber=${DATAVERSE_DB_PORT} +quarkus.datasource.user-store-qa.jdbc.xa-properties.databaseName=dataverse diff --git a/dev-env/shib-dev-env/keycloak/setup-spi.sh b/dev-env/shib-dev-env/keycloak/setup-spi.sh index 5e0fa29f7..bd6924a07 100755 --- a/dev-env/shib-dev-env/keycloak/setup-spi.sh +++ b/dev-env/shib-dev-env/keycloak/setup-spi.sh @@ -27,6 +27,14 @@ ADMIN_TOKEN=$(curl -s -X POST "http://keycloak:9080/realms/master/protocol/openi -d "grant_type=password" \ -d "client_id=admin-cli" | jq -r .access_token) +EXISTING_SPI_COUNT=$(curl -s "http://keycloak:9080/admin/realms/test/components" \ + -H "Authorization: Bearer $ADMIN_TOKEN" | jq '[.[] | select(.providerId == "dv-builtin-users-authenticator" and .providerType == "org.keycloak.storage.UserStorageProvider")] | length') + +if [ "$EXISTING_SPI_COUNT" -gt 0 ]; then + echo "Keycloak SPI already configured in realm." + exit 0 +fi + # Create user storage provider using the components endpoint curl -X POST "http://keycloak:9080/admin/realms/test/components" \ -H "Authorization: Bearer $ADMIN_TOKEN" \ diff --git a/dev-env/shib-dev-env/keycloak/test-realm.json b/dev-env/shib-dev-env/keycloak/test-realm.json index 0b53d51db..65552820e 100644 --- a/dev-env/shib-dev-env/keycloak/test-realm.json +++ b/dev-env/shib-dev-env/keycloak/test-realm.json @@ -2636,7 +2636,7 @@ "frontendUrl": "https://localhost", "acr.loa.map": "{}" }, - "keycloakVersion": "26.1.4", + "keycloakVersion": "26.6.4", "userManagedAccessAllowed": false, "organizationsEnabled": false, "verifiableCredentialsEnabled": false, From 6c07022f9daa0ed8099dc72dfaf76a1e258b5214 Mon Sep 17 00:00:00 2001 From: Ellen Kraffmiller Date: Wed, 8 Jul 2026 09:41:38 -0400 Subject: [PATCH 2/2] specify allowed redirectUris and webOrigins --- dev-env/keycloak/test-realm.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dev-env/keycloak/test-realm.json b/dev-env/keycloak/test-realm.json index 53e3d32af..ae1949a6a 100644 --- a/dev-env/keycloak/test-realm.json +++ b/dev-env/keycloak/test-realm.json @@ -842,9 +842,11 @@ "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "redirectUris": [ - "*" + "http://localhost:8000/modern/*" + ], + "webOrigins": [ + "http://localhost:8000" ], - "webOrigins": [], "notBefore": 0, "bearerOnly": false, "consentRequired": false,