sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,059 Commits 1 Branch 58 Tags
2de32638e14a32dabb877fddffddd2fa60fdff3a
Commit Graph
99 Commits
Author SHA1 Message Date
Michael Barz 0bcad8b5e1 ci: bring up the new continous deployments 2024-06-28 15:01:05 +02:00
Ralf HaferkampandRalf Haferkamp 936d12f6ac keycloak deployment: Add demo groups 
Update the keycloak example to include the demo groups. Also add a new
client scope "groups" and enable for all owncloud clients.

Related issue: #5538
 2024-06-19 15:18:24 +02:00
Ralf HaferkampandRalf Haferkamp 025a66faf4 keycloak deployment: Bump keycloak to 25.0.0 
Also regenerated realm export and client config using the new release.
 2024-06-19 15:18:24 +02:00
Ralf HaferkampandRalf Haferkamp 8d30a8f516 keycloak deployment: Prettify client configs 
This is just a reformatting commit. It should allows us to get
reasonable diffs, when re-exporting configs from newer keycloak
releases.
 2024-06-19 15:18:24 +02:00
Thomas MüllerandGitHub 03bd1d5272 fix: CSP frame-src to enable PDF viewing (#9313) 2024-06-04 14:29:21 +02:00
Thomas MüllerandGitHub 4f7480d322 feat: drop github.com/a8m/envsubst in favor of gookit/config (#9028) 2024-04-30 18:05:58 +02:00
Sawjan GurungandGitHub 9035b832c0 fix ocis_keycloak deployment (#9025) 2024-04-30 17:40:18 +05:45
Roman Perekhod 5a7c2c3568 bumps keycloak version 2024-03-19 08:06:39 +01:00
Michael Barz ca6d87103e feat: use global variables for password policy 2023-12-06 14:30:54 +01:00
Michael StinglandMichael Barz 7af9cd9e53 Add example config for 3rd party WebDAV client Cyberduck 2023-12-01 11:10:28 +01:00
Roman Perekhod 5c549469f8 add banned password list to the default deployments 2023-11-22 15:30:17 +01:00
Ralf Haferkamp 48306cbef3 deployment: Disable username validation for keycloak example 
Set 'GRAPH_USERNAME_MATCH' to 'none'. To accept any username that is
also valid for keycloak.
 2023-09-05 16:51:01 +02:00
Dennis Sieben de5dfef15d - disabled revokeRefreshToken in Keycloak config 2023-08-09 16:27:59 +02:00
Willy Kloucek 0f3dddafab remove references to oc.ios://ios.owncloud.com since it is no longer used 2023-06-05 13:57:05 +02:00
Ralf HaferkampandRalf Haferkamp 94d9dd80eb ocis_keycloak: Don't start builtin IDP when using keycloak 2023-05-24 17:12:38 +02:00
Ralf HaferkampandRalf Haferkamp 47f5245f55 ocis_keycloak: Fix deployment example 
After commit 52951b42b0 we need to set PROXY_USER_CS3_CLAIM and
PROXY_USER_OIDC_CLAIM for the keycloak example to still work.

Also update release notes to mentions the changed default.
 2023-05-24 17:12:38 +02:00
Ralf Haferkamp 3baeee3b73 ocis_keycloak: Enable backchannel logout for "web" client 
This enables backchannel logout for the "web" client.

Also this bumps keycloak to 21.1
 2023-04-24 16:02:52 +02:00
Michael Barz 8d76b15e6e add roles to scope 2023-04-04 22:41:47 +02:00
Ralf HaferkampandGitHub 087e768f35 ocis_keycloak: Move to role assignment via oidc claim (#5882) 
Use the new PROXY_ROLE_ASSIGNMENT_DRIVER "oidc". This also means we can
now run with OCIS_ADMIN_USER_ID being empty. So that no admin user will
be created on startup and no default role assignment will happen.

By setting GRAPH_ASSIGN_DEFAULT_USER_ROLE to "false", we make sure to
not create the default "user" role assignment when auto provisioning a
user.
 2023-03-20 21:04:37 +01:00
Ralf HaferkampandGitHub b57504696b ocis_keycloak: Add ocis roles as realm roles (#5750) 
* ocis_keycloak: Add ocis roles as realm roles

This adds the roles ocisAdmin, ocisSpaceAdmin, ocisUser and ocisGuest as realm roles
to the the oCIS realm. It also assigns those roles to the demo users.

Additionally the missing demo user "Katherine Johnson" is added with the role of
"ocisSpaceAdmin".

* Expose realm_roles in "roles" claim of id tokens and userinfo
 2023-03-08 12:11:21 +01:00
Willy Kloucek 33ce53d436 fix account console in keycloak deployment example 2023-02-15 09:18:04 +01:00
Willy Kloucek 1029775635 enable bruteforce protection 2023-02-08 17:26:32 +01:00
Willy Kloucek 700f00fb27 disable refresh token reuse 2023-02-08 17:24:28 +01:00
Willy Kloucek 6dd55b56bf use export from up-to-date keycloak 2023-02-08 17:22:08 +01:00
Willy Kloucek f1625148d1 format keycloak realm 2023-02-08 12:00:58 +01:00
Ralf Haferkamp fdb42af20b Switch to non-legacy keycloak images 
This switches the keycloak service to the more recent quarkus based images. Away
from the legacy wildfly based image.
 2023-01-31 09:17:29 +01:00
Ralf Haferkamp 237d566662 Simplify running with podman 
Allow to adjust the docker socket path used by traefik and the logging driver
so that this example can be more easily used with podman based setups.

With a running podman service ("podman system service --time 0"), this should
basically work:

export DOCKER_SOCKET_PATH="/run/user/1000/podman/podman.sock"
export LOG_DRIVER=journald
docker-compose -H unix:///run/user/1000/podman/podman.sock up
 2023-01-31 09:17:29 +01:00
Willy Kloucek 4ce815453f update and simplify monitoring settings 2022-11-29 09:12:36 +01:00
Willy KloucekandRalf Haferkamp 693857e6b3 improve debugability of deployment examples 2022-11-16 16:56:59 +01:00
Willy Kloucek e69d2e9a06 update deployment examples, especially the wopi example 2022-10-07 09:50:06 +02:00
Ralf Haferkamp 5d121b4bad Do not start auth-bearer service by default 
The auth-bearer service is currently not needed by ocis. Reva tookens
for oidc authenticated clients are currently minted via the auth-machine
service.  This commit does not completely remove the service as we shoud
consider to rework the proxy's oidc middleware to use the auth-bearer
service in the future (see #4701)

Fixes: #4692
 2022-09-28 12:11:06 +02:00
Willy Kloucek 205f87f987 adapt deployment examples 2022-08-05 14:12:08 +02:00
Willy Kloucek b0b7927e6c add ocis config volume to keycloak deployment example 2022-06-28 09:47:17 +02:00
Willy Kloucek 1ace433e60 remove secrets configuration and demo users from keycloak deployment example 2022-06-21 13:07:22 +02:00
David Christofas 287dc62fcf disable color logging in deployment examples 2022-06-09 10:34:32 +02:00
Christian RichterandRalf Haferkamp e01cdb0590 bump traefik in example deployments 
Signed-off-by: Christian Richter <crichter@owncloud.com>
 2022-06-02 12:32:07 +02:00
Willy Kloucek 98118bae69 fix oidc issuer config in the keycloak example 2022-05-31 11:48:49 +02:00
Ralf HaferkampandRalf Haferkamp 201767c99c Fix autoprovisioning (keycload) deployment example 2022-05-24 17:39:01 +02:00
Willy Kloucek 52f9938a3b remove codimd from deployment example 2022-05-09 11:39:20 +02:00
Jörn Friedrich Dreyer 565548ebce storage-metadata -> storage-system 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2022-05-04 08:14:13 +00:00
Phil Davis b3aff31466 Various grammar and typos 2022-04-19 20:47:37 +05:45
Michael Barz 3c2bb52228 adopt demo deployment config 2022-04-09 16:17:03 +02:00
Willy Kloucek c68cf322c9 switch to keycloak legacy (Wildfly) for deployment examples 2022-02-22 12:21:19 +01:00
Ralf Haferkamp 286e54f6ce Fix docker-compose ocis_keycloak example 
docker-compose doesn't like bare boolean values in the `environment`
section. From the compose-file docs:
Any boolean values (true, false, yes, no) need to be enclosed in quotes to
ensure they are not converted to True or False by the YML parser.
 2022-01-19 10:58:23 +01:00
Willy Kloucek 6927cfd0dc remove unused templates 2022-01-13 11:32:32 +01:00
Willy Kloucek 182712b223 fix tracing config 2022-01-13 08:13:14 +01:00
Willy Kloucek a99f20f8b0 fix traefik basic auth defaul 2022-01-03 07:49:23 +01:00
Willy Kloucek 09412992fe fix typo in debug settings and use unused port for debug 2021-11-25 10:40:51 +01:00
Willy Kloucek 0e13b0668f expose debug ports for monitoring in docker-compose-additions for deployment examples 2021-11-24 14:15:00 +01:00
Willy Kloucek 6590565a2f introduce OCIS_INSECURE option 2021-11-10 16:55:12 +01:00