Help us shape the future of Go! Take the 2026 Go Developer Survey

identityprovider

package
v0.4.26 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: Apache-2.0 Imports: 39 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ExternalClientIDEnv         = "BASEHARBOR_EXTERNAL_OIDC_CLIENT_ID"
	ExternalClientSecretFileEnv = "BASEHARBOR_EXTERNAL_OIDC_CLIENT_SECRET_FILE"
	ExternalCAFileEnv           = "BASEHARBOR_EXTERNAL_OIDC_CA_FILE"
)
View Source 
const (
	// Match the release catalog's immutable OCI index on both native engines.
	KeycloakImage   = "quay.io/keycloak/keycloak:26.8.0@sha256:b0f60d489d51c5d113390bdf5461d4c06e6051be026c05549f2e1e10ec352bcc"
	KeycloakService = "keycloak"
)

Variables

This section is empty.

Functions

func CoreIdentityDependency added in v0.4.25 

func CoreIdentityDependency(dataDir, namespace string) (capability.ProviderInstance, string, error)

CoreIdentityDependency identifies the physical installation module without registering an application capability or allocating runtime material.

func DestroyAllSharedKeycloakAt 

func DestroyAllSharedKeycloakAt(ctx context.Context, runtime KeycloakRuntime, dataDir, namespace string) error

func EnsureCoreIdentity added in v0.4.23 

func EnsureCoreIdentity(ctx context.Context, runtime KeycloakRuntime, issuer serviceaccess.Issuer, dataDir, namespace, installationID string, ha ...bool) (string, error)

EnsureCoreIdentity realizes installation Identity through the existing native provider. No Application, repository, workload binding or login is required. Application placement preferences do not redefine this installation scope.

func FetchDiscovery 

func FetchDiscovery(ctx context.Context, client *http.Client, issuer string) (application.IdentityDiscovery, error)

func FetchDiscoveryAt 

func FetchDiscoveryAt(ctx context.Context, client *http.Client, endpointIssuer, expectedIssuer string) (application.IdentityDiscovery, error)

func FinalizeManagedOperatorOIDC 

func FinalizeManagedOperatorOIDC(ctx context.Context, runtime KeycloakRuntime, issuer serviceaccess.Issuer, dataDir, namespace, target, environment string) error

func KeycloakManagementSurfaces 

func KeycloakManagementSurfaces(app application.Manifest, dataDir, namespace string) ([]application.ManagementUISurface, error)

func KeycloakSQLDependency added in v0.4.25 

func KeycloakSQLDependency(app application.Manifest, placement capability.ProviderPlacement, dataDir, namespace string, coreSQL bool) (capability.ProviderInstance, string, error)

KeycloakSQLDependency projects the SQL module selected by the existing native renderer. It offers no application capability and allocates no identity or runtime state. A caller supplies the already selected issuer/storage choice.

func RefreshCoreIdentitySQLTrust added in v0.4.24 

func RefreshCoreIdentitySQLTrust(dataDir, namespace string, core bhruntime.Files) error

RefreshCoreIdentitySQLTrust updates only the existing installation-owned SQL trust projection. It does not create a realm, database, provider or topology. Write in place: existing bind mounts must see both overlap and retirement.

func RetireKeycloakRuntime added in v0.4.25 

func RetireKeycloakRuntime(ctx context.Context, provider bhruntime.RuntimeRetirementProvider, app application.Manifest, placement capability.ProviderPlacement, dataDir, namespace string) (bhruntime.RuntimeRetirement, error)

RetireKeycloakRuntime preserves realms, users, databases, TLS/recovery state and credentials. Re-add uses the same existing realization and authority.

func SetKeycloakCanonicalURL 

func SetKeycloakCanonicalURL(files KeycloakFiles, canonicalURL string) error

func VerifyCoreIdentity added in v0.4.23 

func VerifyCoreIdentity(ctx context.Context, dataDir, namespace, installationID, expectedIssuer string) error

func VerifyCoreOperatorTokenFlow added in v0.4.24 

func VerifyCoreOperatorTokenFlow(ctx context.Context, dataDir, namespace, installationID, issuer string) error

VerifyCoreOperatorTokenFlow performs a real OAuth password grant against the installation-owned Keycloak admin identity and requires an authenticated Admin REST response over provisioned TLS. Built-in admin-cli uses lightweight tokens, which Keycloak 26.7 rejects at UserInfo. The Core realm, ownership and OIDC discovery are verified independently before this token exercise.

Types

type ExternalDriver 

type ExternalDriver struct {
	// contains filtered or unexported fields
}

func NewExternalDriver 

func NewExternalDriver(app application.Manifest, files application.RuntimeFiles, issuer string) (*ExternalDriver, error)

func NewRegisteredExternalDriver added in v0.4.25 

func NewRegisteredExternalDriver(app application.Manifest, files application.RuntimeFiles, dataDir string) (*ExternalDriver, error)

func (*ExternalDriver) Bind 

func (d *ExternalDriver) Bind(ctx context.Context, _ capability.Resource, _ capability.Binding) error

func (*ExternalDriver) Descriptor 

func (d *ExternalDriver) Descriptor() capability.Provider

func (*ExternalDriver) Preflight 

func (d *ExternalDriver) Preflight(ctx context.Context, resource capability.Resource, binding capability.Binding) error

func (*ExternalDriver) Provision 

func (d *ExternalDriver) Provision(context.Context, capability.Resource, capability.Binding) error

func (*ExternalDriver) Verify 

func (d *ExternalDriver) Verify(ctx context.Context, _ capability.Resource, _ capability.Binding) error

type ExternalIdentityBindingChange added in v0.4.25 

type ExternalIdentityBindingChange struct {
	Changed           bool
	IssuerBefore      string
	IssuerAfter       string
	ClientChanged     bool
	CredentialChanged bool
	TrustChanged      bool
	InputsVerified    bool
	Revision          string `json:"-"`
}

The revision is an opaque consent input. No confidential material or standalone material fingerprint is projected into provider consequences.

func InspectRegisteredExternalBindingChange added in v0.4.25 

func InspectRegisteredExternalBindingChange(app application.Manifest, files application.RuntimeFiles, dataDir string) (ExternalIdentityBindingChange, error)

type KeycloakDriver 

type KeycloakDriver struct {
	// contains filtered or unexported fields
}

func NewKeycloakDriver 

func NewKeycloakDriver(runtime KeycloakRuntime, app application.Manifest, appFiles application.RuntimeFiles, issuer serviceaccess.Issuer, dataDir, namespace string) *KeycloakDriver

func NewKeycloakDriverWithRealization added in v0.4.19 

func NewKeycloakDriverWithRealization(realization KeycloakRealization, app application.Manifest, appFiles application.RuntimeFiles) *KeycloakDriver

func (*KeycloakDriver) Bind 

func (d *KeycloakDriver) Bind(ctx context.Context, _ capability.Resource, _ capability.Binding) error

func (*KeycloakDriver) Descriptor 

func (d *KeycloakDriver) Descriptor() capability.Provider

func (*KeycloakDriver) DestroyApplication 

func (d *KeycloakDriver) DestroyApplication(ctx context.Context) error

func (*KeycloakDriver) IntegrationDescriptor 

func (d *KeycloakDriver) IntegrationDescriptor() capability.IntegrationDescriptor

func (*KeycloakDriver) Preflight 

func (d *KeycloakDriver) Preflight(_ context.Context, resource capability.Resource, binding capability.Binding) error

func (*KeycloakDriver) Provision 

func (d *KeycloakDriver) Provision(ctx context.Context, resource capability.Resource, binding capability.Binding) error

func (*KeycloakDriver) RotateAdminCredential added in v0.4.21 

func (d *KeycloakDriver) RotateAdminCredential(ctx context.Context) error

func (*KeycloakDriver) RotateClientSecret added in v0.4.21 

func (d *KeycloakDriver) RotateClientSecret(ctx context.Context) error

func (*KeycloakDriver) RotatePKI added in v0.4.21 

func (d *KeycloakDriver) RotatePKI(ctx context.Context) error

func (*KeycloakDriver) RotateSigningKey added in v0.4.21 

func (d *KeycloakDriver) RotateSigningKey(ctx context.Context) error

RotateSigningKey performs overlap-safe realm signing-key rotation. The new key is published passively before it becomes active. The old key remains in JWKS and continues to verify old tokens until replacement signing has been observed and cryptographically verified.

func (*KeycloakDriver) SetApplicationOrigins 

func (d *KeycloakDriver) SetApplicationOrigins(origins []string) error

func (*KeycloakDriver) Verify 

func (d *KeycloakDriver) Verify(ctx context.Context, _ capability.Resource, binding capability.Binding) error

func (*KeycloakDriver) VerifyExisting 

func (d *KeycloakDriver) VerifyExisting(ctx context.Context, binding capability.Binding, origins []string) error

type KeycloakFiles 

type KeycloakFiles struct {
	SharedSQL          *bhruntime.Files
	Dir                string
	Compose            string
	Env                string
	Project            string
	ConsumerNetwork    string
	InternalNetwork    string
	PublicPort         int
	AdminPort          int
	PublicURL          string
	CanonicalPublicURL string
	AdminURL           string
	PublicAccess       serviceaccess.HTTPGatewayFiles
	AdminAccess        serviceaccess.HTTPGatewayFiles
}

func EnsureKeycloakFilesAt 

func EnsureKeycloakFilesAt(ctx context.Context, app application.Manifest, issuer serviceaccess.Issuer, dataDir, namespace string) (KeycloakFiles, error)

func ExistingCoreRuntimeFiles added in v0.4.24 

func ExistingCoreRuntimeFiles(dataDir, namespace string) (KeycloakFiles, error)

ExistingCoreRuntimeFiles resolves the installation-owned Keycloak Compose and backing SQL without regenerating secrets or changing provider topology.

func ExistingKeycloakFiles 

func ExistingKeycloakFiles(app application.Manifest) (KeycloakFiles, error)

func ExistingKeycloakFilesAt 

func ExistingKeycloakFilesAt(app application.Manifest, dataDir, namespace string) (KeycloakFiles, error)

func ExistingKeycloakRuntimeInventoryAt added in v0.4.25 

func ExistingKeycloakRuntimeInventoryAt(app application.Manifest, placement capability.ProviderPlacement, dataDir, namespace string) (KeycloakFiles, []bhruntime.ProjectResource, error)

ExistingKeycloakRuntimeInventoryAt reconstructs only the canonical runtime shape from existing protected owner state. It neither issues credentials nor rewrites TLS projections. The union-plan caller must prove no consumers remain.

type KeycloakInstance added in v0.4.19 

type KeycloakInstance struct {
	StateDir         string
	EndpointBaseURL  string
	PublicBaseURL    string
	WorkloadBaseURL  string
	TrustBundle      []byte
	PublicHTTPClient *http.Client
	AdminHTTPClient  *http.Client
	AdminUsername    string
	AdminPassword    string
}

KeycloakInstance is the runtime-neutral control surface consumed by the identity Core. Runtime-native deployment identity remains inside the realization that produced this instance.

type KeycloakLifecycle added in v0.4.19 

type KeycloakLifecycle interface {
	Validate(context.Context, KeycloakFiles) error
	Apply(context.Context, KeycloakFiles) error
	Destroy(context.Context, KeycloakFiles) error
}

KeycloakLifecycle is the provider-realization boundary consumed by identity semantics. It deliberately avoids Compose/project lifecycle vocabulary.

func NewKeycloakLifecycle added in v0.4.19 

func NewKeycloakLifecycle(runtime KeycloakRuntime) KeycloakLifecycle

type KeycloakRealization added in v0.4.19 

type KeycloakRealization interface {
	Apply(context.Context) (KeycloakInstance, error)
	Existing(context.Context) (KeycloakInstance, error)
	Destroy(context.Context) error
}

KeycloakRealization is the deployment/runtime boundary for the managed Keycloak reference provider. Adding Kubernetes/OpenShift/cloud realizations must not require changes to Keycloak identity semantics.

type KeycloakRuntime 

type KeycloakRuntime interface {
	ConfigProject(context.Context, string, string, string) error
	UpProject(context.Context, string, string, string) error
	DestroyProject(context.Context, string, string, string) error
}

KeycloakRuntime is the legacy local-runtime realization used by the current Docker/Podman reference implementation.

type ManagedOperatorOIDC 

type ManagedOperatorOIDC struct {
	Issuer       string
	ClientID     string
	CallbackPort int
}

func EnsureManagedDevelopmentAccess 

func EnsureManagedDevelopmentAccess(ctx context.Context, runtime KeycloakRuntime, issuer serviceaccess.Issuer, dataDir, namespace, target, username, password string) (ManagedOperatorOIDC, error)

func EnsureManagedOperatorOIDC 

func EnsureManagedOperatorOIDC(ctx context.Context, runtime KeycloakRuntime, issuer serviceaccess.Issuer, dataDir, namespace, target, environment string) (ManagedOperatorOIDC, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.