jcoffey-dev
c0377df942
A token the OIDC directory rejects is an authentication failure, so it counts toward the ban; a network, provider or configuration fault stays an error and doesn't. Before, a rejected token was an error too, so bad tokens never led to a ban. The Keycloak container now imports a second realm, so test 10 checks /api/discover and the PACC record answer with each domain's own provider. Test 18 checks that eight sign-ins during an outage don't ban the client, while bad tokens do.
207 lines
4.5 KiB
JSON
207 lines
4.5 KiB
JSON
{
|
|
"realm": "inbuxa",
|
|
"enabled": true,
|
|
"registrationAllowed": false,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"sslRequired": "none",
|
|
"clients": [
|
|
{
|
|
"clientId": "stalwart",
|
|
"enabled": true,
|
|
"clientAuthenticatorType": "client-secret",
|
|
"secret": "stalwart-secret",
|
|
"redirectUris": [
|
|
"*"
|
|
],
|
|
"webOrigins": [
|
|
"*"
|
|
],
|
|
"publicClient": false,
|
|
"protocol": "openid-connect",
|
|
"directAccessGrantsEnabled": true,
|
|
"standardFlowEnabled": true,
|
|
"serviceAccountsEnabled": true,
|
|
"defaultClientScopes": [
|
|
"openid",
|
|
"email",
|
|
"profile",
|
|
"roles"
|
|
],
|
|
"protocolMappers": [
|
|
{
|
|
"name": "groups",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-group-membership-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"full.path": "false",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"claim.name": "groups",
|
|
"userinfo.token.claim": "true"
|
|
}
|
|
},
|
|
{
|
|
"name": "email-claim",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"user.attribute": "email",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"claim.name": "email",
|
|
"userinfo.token.claim": "true",
|
|
"jsonType.label": "String"
|
|
}
|
|
},
|
|
{
|
|
"name": "audience",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"included.client.audience": "stalwart",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"clientId": "stalwart-fallback",
|
|
"enabled": true,
|
|
"clientAuthenticatorType": "client-secret",
|
|
"secret": "stalwart-fallback-secret",
|
|
"redirectUris": [
|
|
"*"
|
|
],
|
|
"webOrigins": [
|
|
"*"
|
|
],
|
|
"publicClient": false,
|
|
"protocol": "openid-connect",
|
|
"directAccessGrantsEnabled": true,
|
|
"standardFlowEnabled": true,
|
|
"serviceAccountsEnabled": true,
|
|
"defaultClientScopes": [
|
|
"openid"
|
|
],
|
|
"optionalClientScopes": [
|
|
"email",
|
|
"profile",
|
|
"roles"
|
|
],
|
|
"protocolMappers": [
|
|
{
|
|
"name": "email-claim-userinfo-only",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"user.attribute": "email",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "false",
|
|
"claim.name": "email",
|
|
"userinfo.token.claim": "true",
|
|
"jsonType.label": "String"
|
|
}
|
|
},
|
|
{
|
|
"name": "groups-userinfo-only",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-group-membership-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"full.path": "false",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "false",
|
|
"claim.name": "groups",
|
|
"userinfo.token.claim": "true"
|
|
}
|
|
},
|
|
{
|
|
"name": "audience",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"included.client.audience": "stalwart",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"username": "[email protected]",
|
|
"enabled": true,
|
|
"email": "[email protected]",
|
|
"emailVerified": true,
|
|
"firstName": "John",
|
|
"lastName": "Doe",
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "this is an OIDC password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"groups": [
|
|
"/[email protected]"
|
|
]
|
|
},
|
|
{
|
|
"username": "[email protected]",
|
|
"enabled": true,
|
|
"email": "[email protected]",
|
|
"emailVerified": true,
|
|
"firstName": "Jane",
|
|
"lastName": "Smith",
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "this is an OIDC password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"groups": [
|
|
"/[email protected]",
|
|
"/[email protected]"
|
|
]
|
|
},
|
|
{
|
|
"username": "[email protected]",
|
|
"enabled": true,
|
|
"email": "[email protected]",
|
|
"emailVerified": true,
|
|
"firstName": "Bill",
|
|
"lastName": "Foobar",
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "this is an OIDC password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"groups": [
|
|
"/[email protected]"
|
|
]
|
|
}
|
|
],
|
|
"groups": [
|
|
{
|
|
"name": "[email protected]",
|
|
"path": "/[email protected]"
|
|
},
|
|
{
|
|
"name": "[email protected]",
|
|
"path": "/[email protected]"
|
|
}
|
|
],
|
|
"id": "inbuxa",
|
|
"displayName": "inbuxa test realm"
|
|
} |