7.3. Keycloak クライアントの作成

手順

1. Operator Installed Operators に移動します。
2. Red Hat Single Sign-On Operator プロジェクトを選択します。
3. Keycloak Client タブを選択し、Create Keycloak Client をクリックします。
4. Keycloak Realm フォームで、YAML view を選択します。

5. デフォルトの YAML ファイルを次のものに置き換えます。

   Copy to Clipboard Toggle word wrap

   kind: KeycloakClient
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: automation-hub-client-secret
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     client:
       name: Automation Hub
       clientId: automation-hub
       secret: <client-secret>                        

   1

   
       clientAuthenticatorType: client-secret
       description: Client for automation hub
       attributes:
         user.info.response.signature.alg: RS256
         request.object.signature.alg: RS256
       directAccessGrantsEnabled: true
       publicClient: true
       protocol: openid-connect
       standardFlowEnabled: true
       protocolMappers:
         - config:
             access.token.claim: "true"
             claim.name: "family_name"
             id.token.claim: "true"
             jsonType.label: String
             user.attribute: lastName
             userinfo.token.claim: "true"
           consentRequired: false
           name: family name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
         - config:
             userinfo.token.claim: "true"
             user.attribute: email
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: email
             jsonType.label: String
           name: email
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             multivalued: "true"
             access.token.claim: "true"
             claim.name: "resource_access.${client_id}.roles"
             jsonType.label: String
           name: client roles
           protocol: openid-connect
           protocolMapper: oidc-usermodel-client-role-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: firstName
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: given_name
             jsonType.label: String
           name: given name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             userinfo.token.claim: "true"
           name: full name
           protocol: openid-connect
           protocolMapper: oidc-full-name-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: username
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: preferred_username
             jsonType.label: String
           name: <username>
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             access.token.claim: "true"
             claim.name: "group"
             full.path: "true"
             id.token.claim: "true"
             userinfo.token.claim: "true"
           consentRequired: false
           name: group
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
         - config:
             multivalued: 'true'
             id.token.claim: 'true'
             access.token.claim: 'true'
             userinfo.token.claim: 'true'
             usermodel.clientRoleMapping.clientId:  'automation-hub'
             claim.name: client_roles
             jsonType.label: String
           name: client_roles
           protocolMapper: oidc-usermodel-client-role-mapper
           protocol: openid-connect
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             included.client.audience: 'automation-hub'
           protocol: openid-connect
           name: audience mapper
           protocolMapper: oidc-audience-mapper
     roles:
       - name: "hubadmin"
         description: "An administrator role for automation hub"

   1

   これを一意の値に置き換えます。

6. Create をクリックし、プロセスが完了するまで待ちます。