82 lines
4.3 KiB
Bash
82 lines
4.3 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# =============================================================================
|
||
|
|
# eBdesk SiCABE — print-keycloak-requirements.sh
|
||
|
|
# -----------------------------------------------------------------------------
|
||
|
|
# Mencetak KEBUTUHAN Keycloak (nilai konkret dari .env) untuk diserahkan ke
|
||
|
|
# administrator Keycloak — pasangan dari docs/keycloak-existing-requirements.md.
|
||
|
|
#
|
||
|
|
# Read-only: tidak mengubah apa pun; hanya menampilkan.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./scripts/print-keycloak-requirements.sh
|
||
|
|
# ./scripts/print-keycloak-requirements.sh --env-file generated/host-control/.env
|
||
|
|
# ./scripts/print-keycloak-requirements.sh --mask # sembunyikan client secret
|
||
|
|
#
|
||
|
|
# Keluaran bisa disalin ke tiket/email ke pengelola Keycloak.
|
||
|
|
# =============================================================================
|
||
|
|
set -uo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
|
|
# shellcheck source=../lib/common.sh
|
||
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||
|
|
# shellcheck source=../config/environment.defaults.sh
|
||
|
|
source "${SCRIPT_DIR}/config/environment.defaults.sh"
|
||
|
|
|
||
|
|
MASK=0
|
||
|
|
ARGS=()
|
||
|
|
for _a in "$@"; do
|
||
|
|
case "${_a}" in
|
||
|
|
--mask) MASK=1 ;;
|
||
|
|
*) ARGS+=("${_a}") ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
sicabe_load_env "${SCRIPT_DIR}" "${ARGS[@]}"
|
||
|
|
|
||
|
|
REALM="${SICABE_REALM:-sicabe}"
|
||
|
|
KC_PUB="${KEYCLOAK_PUBLIC_URL:-http://localhost:${KEYCLOAK_PORT:-12080}}"
|
||
|
|
SSL_REQ="${KEYCLOAK_SSL_REQUIRED:-external}"
|
||
|
|
SR_HTTP_PORT="${STARROCKS_HTTP_PORT:-12030}"
|
||
|
|
|
||
|
|
# Tampilkan secret: nilai asli, atau '********' bila --mask.
|
||
|
|
show_secret() { # <value> <dev-default>
|
||
|
|
local v="${1:-}" d="${2:-}"
|
||
|
|
if [[ -z "${v}" ]]; then echo "(KOSONG!)"; return; fi
|
||
|
|
if [[ "${MASK}" == "1" ]]; then echo "********"; return; fi
|
||
|
|
if [[ "${v}" == "${d}" ]]; then echo "${v} ← DEFAULT DEV, ganti di produksi"; else echo "${v}"; fi
|
||
|
|
}
|
||
|
|
|
||
|
|
printf '%s\n' "================================================================================"
|
||
|
|
printf '%s\n' " KEBUTUHAN KEYCLOAK (existing) — dari: ${SICABE_ENV_FILE:-${SCRIPT_DIR}/.env}"
|
||
|
|
printf '%s\n' "================================================================================"
|
||
|
|
printf ' Realm : %s\n' "${REALM}"
|
||
|
|
printf ' Issuer : %s/realms/%s\n' "${KC_PUB}" "${REALM}"
|
||
|
|
printf ' sslRequired : %s (external bila ada TLS; none utk http lokal)\n' "${SSL_REQ}"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Realm roles : admin engineer analyst viewer"
|
||
|
|
printf '%s\n' " Users (opsional) : admin engineer analyst viewer"
|
||
|
|
printf '%s\n' " (atau petakan user organisasi ke 4 role di atas)"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " OIDC clients — SEMUA: type=OpenID Connect, client authentication ON,"
|
||
|
|
printf '%s\n' " Standard flow ON, Service accounts ON (publicClient=false)"
|
||
|
|
printf '\n'
|
||
|
|
printf ' %-13s %-34s %s\n' "clientId" "client secret (harus sama)" "redirect URI"
|
||
|
|
printf ' %-13s %-34s %s\n' "------------" "---------------------------" "--------------------------"
|
||
|
|
printf ' %-13s %-34s %s/*\n' "trino" "$(show_secret "${TRINO_CLIENT_SECRET:-}" "trino-secret")" "${TRINO_PUBLIC_URL:-}"
|
||
|
|
printf ' %-13s %-34s %s\n' "starrocks" "$(show_secret "${STARROCKS_CLIENT_SECRET:-}" "starrocks-secret")" "http://<host-starrocks>:${SR_HTTP_PORT}/api/oauth2"
|
||
|
|
printf ' %-13s %-34s %s/*\n' "airflow" "$(show_secret "${AIRFLOW_CLIENT_SECRET:-}" "airflow-secret")" "${AIRFLOW_PUBLIC_URL:-}"
|
||
|
|
printf ' %-13s %-34s %s/*\n' "openmetadata" "$(show_secret "${OPENMETADATA_CLIENT_SECRET:-}" "om-secret")" "${OPENMETADATA_PUBLIC_URL:-}"
|
||
|
|
printf ' %-13s %-34s %s/*\n' "grafana" "$(show_secret "${GRAFANA_CLIENT_SECRET:-}" "grafana-secret")" "${GRAFANA_PUBLIC_URL:-}"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Semua client juga sertakan: http://localhost:* dan https://localhost:*"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Protocol mapper (WAJIB tiap client): Audience 'account' (oidc-audience-mapper)"
|
||
|
|
printf '%s\n' " → Tanpa ini Trino MENOLAK token (Trino memverifikasi aud=account)."
|
||
|
|
printf '%s\n' " StarRocks: tambahan audience 'starrocks' (required_audience=starrocks)."
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Kembalikan ke SiCABE: nama realm, issuer URL, dan 5 client secret di atas."
|
||
|
|
if [[ "${MASK}" == "0" ]]; then
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " ⚠ KELUARAN MEMUAT SECRET — kirim lewat kanal aman; jangan tempel di tiket publik."
|
||
|
|
fi
|
||
|
|
printf '%s\n' "================================================================================"
|