From 0074a1bff3568d135460be3ba445705f0bee8dfe Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 25 Sep 2026 11:34:30 +0000 Subject: [PATCH] feat(k8s): optionally auto-fill the medewerker OTP step for the public demo (refs #177) (#181) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What & why For the public demo on `big-behandel` / `big-beheer`, visitors should see MFA being enforced without needing an authenticator app. This adds an opt-in Keycloak theme that fills in and submits the medewerker OTP code itself. - **Theme as real files in `infra/keycloak/themes/big-demo/`**, next to the realms: - `login/theme.properties`: `keycloak.v2` plus `scripts=js/otp-autofill.js`. I checked the 26.1 source: `keycloak.v2` loads theme `scripts` and sets none of its own. - `login/resources/js/otp-autofill.js`: on the OTP page, computes the code (RFC 6238, Keycloak's default policy) from the fixture secret `BIGMEDEWERKEROTPSEED` and submits it. - `account`, `admin`, `email`: plain children of Keycloak 26's defaults. Without them the account console returns 500 (see notes). - **Seeded like every other file input:** `infra/helm/seed-configmaps.sh` creates the `rr-kc-theme` ConfigMap, and the chart mounts it as a directory. The podspec gains `items` so flat ConfigMap keys map to theme paths. Keycloak runs `start-dev` (no theme cache), so edits show up about a minute after a reseed. - **Switch:** `demo.otpAutofill` only decides whether `KC_SPI_THEME_DEFAULT=big-demo` is set. `big.env` now skips env values that render empty, and no existing env var is empty. **Off, the render is identical to main except for that one missing variable,** so Keycloak keeps its stock theme. The realm JSONs are untouched, so compose and the e2e tests still require a code. - **Single-use codes:** a second login in the same 30 s window spends the next counter, as `nextUnusedCounter` does in the e2e. Past that it only fills in the field and doesn't submit, so a rejected code can't loop. - **Deploy workflow:** repo variable `OTP_AUTOFILL=true` โ†’ `--set demo.otpAutofill=true`. Flipping it changes the pod's env, so Keycloak restarts. Refs #177 ## Definition of Done - [x] Linked Gitea issue (above). - [ ] Failing test committed before the implementation. *(Not done; checks below.)* - [x] Conventional Commits referencing the issue (`refs #NN`). - [ ] CI green - [x] `docker compose up` unaffected (chart only). - [x] Docs updated (Talos runbook, "Publishing through the labs Caddy"). - [ ] ADR. The fixture-secret trade-off is ADR-0031's; this only automates typing it in. ## Notes for reviewers - **Tested on the live cluster.** I patched the running Keycloak with the rendered theme (autofill on) and ran real headless Chromium logins against the public hosts: - `merel-behandelaar` on big-behandel: only username and password typed. The OTP page loaded the script, submitted by itself, and the user landed in the Werkbak. - `jan-burger` on big-mijn still logs in (regression check). - `/realms/medewerker/account/` returns 200. - **Account console 500, found live and fixed in the second commit.** `KC_SPI_THEME_DEFAULT` applies to every theme type, and Keycloak does *not* fall back for a type the theme lacks (`NullPointerException ... "theme" is null`). `big-demo` now declares login, account, admin and email, each a plain child of Keycloak 26's default. It's one ConfigMap mounted as a directory; the podspec gains `items` for that. - **Keycloak restarts cause about 5 minutes of BFF 401s.** This is not caused by this PR, but you'll see it whenever Keycloak restarts. Dev-mode Keycloak makes new signing keys on each boot, and the BFF refreshes its cached keys at most every 5 minutes. Seen live: 401 right after the restart, 204 about 4ยฝ minutes later. Flipping `OTP_AUTOFILL` restarts Keycloak, so expect this briefly. - `make k8s-lint` and `make k8s-drift` pass. The rendered script's code matches `infra/keycloak/check_realms.py otp`. - **Security:** with it on, the public behandel and beheer portals are protected only by the committed password `test123`. That's intentional for synthetic demo data. Never enable it anywhere real. ๐Ÿค– Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: https://git.labs.respellion.tech/eho/register-referentie/pulls/181 --- .gitea/workflows/deploy.yaml | 5 +++- docs/runbooks/kubernetes-talos.md | 12 ++++++++++ .../helm/big-reference/templates/_helpers.tpl | 12 ++++++++-- infra/helm/big-reference/values.yaml | 21 +++++++++++++++- infra/helm/seed-configmaps.sh | 9 +++++++ .../themes/big-demo/account/theme.properties | 4 ++++ .../themes/big-demo/admin/theme.properties | 4 ++++ .../themes/big-demo/email/theme.properties | 4 ++++ .../login/resources/js/otp-autofill.js | 24 +++++++++++++++++++ .../themes/big-demo/login/theme.properties | 11 +++++++++ 10 files changed, 102 insertions(+), 4 deletions(-) create mode 100644 infra/keycloak/themes/big-demo/account/theme.properties create mode 100644 infra/keycloak/themes/big-demo/admin/theme.properties create mode 100644 infra/keycloak/themes/big-demo/email/theme.properties create mode 100644 infra/keycloak/themes/big-demo/login/resources/js/otp-autofill.js create mode 100644 infra/keycloak/themes/big-demo/login/theme.properties diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index 1f9dfae..5c53711 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -31,6 +31,9 @@ jobs: # origin, e.g. https://big-auth.labs.respellion.tech (runbook, "Publishing # through the labs Caddy"). KEYCLOAK_URL: ${{ vars.KEYCLOAK_URL }} + # `true` fills in the medewerker OTP step for the public demo (chart value + # demo.otpAutofill). The fixture secret is committed: demo only. + OTP_AUTOFILL: ${{ vars.OTP_AUTOFILL }} steps: - uses: https://github.com/actions/checkout@v4 @@ -97,7 +100,7 @@ jobs: make k8s-reseed \ TALOS_HOST=${TALOS_HOST:-localhost} \ K8S_REGISTRY=${TALOS_VM_IP:-192.168.122.173}:30500 \ - K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL}" + K8S_SET="${KEYCLOAK_URL:+--set keycloakUrl=$KEYCLOAK_URL} --set demo.otpAutofill=${OTP_AUTOFILL:-false}" # `dev` is a mutable tag and helm sees an unchanged pod template, so the # new images only land on a restart (pullPolicy is already Always). diff --git a/docs/runbooks/kubernetes-talos.md b/docs/runbooks/kubernetes-talos.md index 75b3c2b..d35a8f4 100644 --- a/docs/runbooks/kubernetes-talos.md +++ b/docs/runbooks/kubernetes-talos.md @@ -430,6 +430,18 @@ make k8s-up TALOS_HOST=localhost K8S_REGISTRY=:30500 \ For deploy-on-merge, set the repository variable `KEYCLOAK_URL` to the same value. With it set, the `localhost` port-forwards (ยง5) no longer log in: the issuer is one string. +Staff logins still hit the enforced OTP step. For a demo, set the repository variable +`OTP_AUTOFILL=true` (chart value `demo.otpAutofill`): Keycloak then uses the `big-demo` +theme, which fills in and submits the code from the fixture secret, so the step is visible +but needs no authenticator. Keycloak restarts when the value flips. Demo only โ€” the secret +is committed. + +The theme lives in `infra/keycloak/themes/big-demo/` and is seeded as the `rr-kc-theme` +ConfigMap by `infra/helm/seed-configmaps.sh` on every deploy. Keycloak runs `start-dev`, +which doesn't cache themes, so an edit shows up about a minute after the ConfigMap changes. +A *new* theme file also needs a key in the seed script and a path in the keycloak `files` +in `values.yaml`. + One-time setup: 1. Fedora host: install `infra/development/big-portals-tunnel.service` from the Infra repo diff --git a/infra/helm/big-reference/templates/_helpers.tpl b/infra/helm/big-reference/templates/_helpers.tpl index 24bb55d..7efbf86 100644 --- a/infra/helm/big-reference/templates/_helpers.tpl +++ b/infra/helm/big-reference/templates/_helpers.tpl @@ -94,6 +94,10 @@ volumes: {{- with .defaultMode }} defaultMode: {{ . }} {{- end }} + {{- with .items }} + items: +{{- toYaml . | nindent 8 }} + {{- end }} {{- end }} {{- with $w.data }} - name: data @@ -125,13 +129,17 @@ volumes: {{/* Env list from a map. Every value is run through `tpl`, so values.yaml can name cluster-internal hosts ({{ .Release.Namespace }}) and the node address -({{ .Values.host }}) without the chart hard-coding either. +({{ .Values.host }}) without the chart hard-coding either. A value that renders +empty is left out, which is how a setting is made conditional on a chart value. */}} {{- define "big.env" -}} {{- $root := index . 0 -}} {{- range $k, $v := index . 1 }} +{{- $val := tpl (toString $v) $root }} +{{- if $val }} - name: {{ $k }} - value: {{ tpl (toString $v) $root | quote }} + value: {{ $val | quote }} +{{- end }} {{- end }} {{- end -}} diff --git a/infra/helm/big-reference/values.yaml b/infra/helm/big-reference/values.yaml index 31f4df4..1fb687f 100644 --- a/infra/helm/big-reference/values.yaml +++ b/infra/helm/big-reference/values.yaml @@ -30,6 +30,12 @@ host: 192.168.122.100 # portals' authority (runbook, "Publishing through the labs Caddy"). keycloakUrl: "" +demo: + # Fill in and submit the medewerker OTP step from the fixture secret, so a public + # demo shows MFA enforced without an authenticator: makes the big-demo theme + # (infra/keycloak/themes/big-demo) Keycloak's default. Demo only: the secret is committed. + otpAutofill: false + # Set when pulling from a private registry (e.g. the Gitea Container Registry). imagePullSecrets: [] @@ -277,11 +283,24 @@ workloads: # this issuer back, which is what browser tokens carry (infra/host-browser.yml). KC_HOSTNAME: '{{ include "big.keycloakUrl" . }}' KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true" + # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak + # keeps its stock theme and the mounted big-demo theme is unused. + KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}' ports: [{ name: http, port: 8080 }] # TCP, not /health/ready on the management port: nothing here gates on realm # import, and a wrong health path would leave the Service with no endpoints. probe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 15 } - files: [{ configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import }] + files: + - { configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import } + # infra/keycloak/themes/big-demo, seeded by infra/helm/seed-configmaps.sh. + - configMap: rr-kc-theme + mountPath: /opt/keycloak/themes/big-demo + items: + - { key: login.properties, path: login/theme.properties } + - { key: otp-autofill.js, path: login/resources/js/otp-autofill.js } + - { key: account.properties, path: account/theme.properties } + - { key: admin.properties, path: admin/theme.properties } + - { key: email.properties, path: email/theme.properties } # โ”€โ”€ Flowable (S-03) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ flowable-db: diff --git a/infra/helm/seed-configmaps.sh b/infra/helm/seed-configmaps.sh index 9dd9961..9d8f05e 100755 --- a/infra/helm/seed-configmaps.sh +++ b/infra/helm/seed-configmaps.sh @@ -30,6 +30,15 @@ seed() { # name seed rr-oz-config --from-file="$repo/infra/openzaak/setup_configuration/" seed rr-nrc-config --from-file="$repo/infra/opennotificaties/setup_configuration/" seed rr-kc-realms --from-file="$repo/infra/keycloak/realms/" +# The big-demo login theme (demo.otpAutofill). ConfigMap keys are flat, so each +# file gets a key here and its path back in the keycloak `files` in values.yaml. +theme="$repo/infra/keycloak/themes/big-demo" +seed rr-kc-theme \ + --from-file=login.properties="$theme/login/theme.properties" \ + --from-file=otp-autofill.js="$theme/login/resources/js/otp-autofill.js" \ + --from-file=account.properties="$theme/account/theme.properties" \ + --from-file=admin.properties="$theme/admin/theme.properties" \ + --from-file=email.properties="$theme/email/theme.properties" seed rr-objecttypen-config --from-file="$repo/infra/objecttypen/setup_configuration/" seed rr-objecten-config --from-file="$repo/infra/objecten/setup_configuration/" # register.py + the RegisterRecord JSON schema (the __pycache__ dir is skipped: diff --git a/infra/keycloak/themes/big-demo/account/theme.properties b/infra/keycloak/themes/big-demo/account/theme.properties new file mode 100644 index 0000000..50cacd7 --- /dev/null +++ b/infra/keycloak/themes/big-demo/account/theme.properties @@ -0,0 +1,4 @@ +# The chart makes big-demo the default for every theme type, and Keycloak does not +# fall back for a type a theme lacks (the account page then fails), so each type is +# declared as a plain child of Keycloak 26's own default. +parent=keycloak.v3 diff --git a/infra/keycloak/themes/big-demo/admin/theme.properties b/infra/keycloak/themes/big-demo/admin/theme.properties new file mode 100644 index 0000000..3430eff --- /dev/null +++ b/infra/keycloak/themes/big-demo/admin/theme.properties @@ -0,0 +1,4 @@ +# The chart makes big-demo the default for every theme type, and Keycloak does not +# fall back for a type a theme lacks (the admin page then fails), so each type is +# declared as a plain child of Keycloak 26's own default. +parent=keycloak.v2 diff --git a/infra/keycloak/themes/big-demo/email/theme.properties b/infra/keycloak/themes/big-demo/email/theme.properties new file mode 100644 index 0000000..4abe495 --- /dev/null +++ b/infra/keycloak/themes/big-demo/email/theme.properties @@ -0,0 +1,4 @@ +# The chart makes big-demo the default for every theme type, and Keycloak does not +# fall back for a type a theme lacks (the email page then fails), so each type is +# declared as a plain child of Keycloak 26's own default. +parent=keycloak diff --git a/infra/keycloak/themes/big-demo/login/resources/js/otp-autofill.js b/infra/keycloak/themes/big-demo/login/resources/js/otp-autofill.js new file mode 100644 index 0000000..e46ed1b --- /dev/null +++ b/infra/keycloak/themes/big-demo/login/resources/js/otp-autofill.js @@ -0,0 +1,24 @@ +// RFC 6238 with Keycloak's default policy (HmacSHA1, 6 digits, 30 s) over the +// raw bytes of the medewerker fixture secret โ€” same as tests/e2e/keycloak-login.ts. +document.addEventListener('DOMContentLoaded', async () => { + const input = document.querySelector('input[name="otp"]'); + if (!input || !input.form) return; + const key = await crypto.subtle.importKey('raw', + new TextEncoder().encode('BIGMEDEWERKEROTPSEED'), { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']); + // A code is single-use, so a second login in the same window spends the next + // counter (Keycloak's look-ahead accepts it). Past that, fill but don't submit, + // so a rejected code can't turn into a submit loop. + const now = Math.floor(Date.now() / 30000); + let last = -1; + try { last = Number(sessionStorage.getItem('big-otp-counter')) || -1; } catch {} + const counter = Math.max(now, last + 1); + const msg = new DataView(new ArrayBuffer(8)); + msg.setBigUint64(0, BigInt(counter)); + const mac = new Uint8Array(await crypto.subtle.sign('HMAC', key, msg.buffer)); + const o = mac[19] & 0x0f; + const n = ((mac[o] & 0x7f) << 24 | mac[o + 1] << 16 | mac[o + 2] << 8 | mac[o + 3]) % 1e6; + input.value = String(n).padStart(6, '0'); + if (counter > now + 1) return; + try { sessionStorage.setItem('big-otp-counter', String(counter)); } catch {} + input.form.requestSubmit(); +}); diff --git a/infra/keycloak/themes/big-demo/login/theme.properties b/infra/keycloak/themes/big-demo/login/theme.properties new file mode 100644 index 0000000..bfd5838 --- /dev/null +++ b/infra/keycloak/themes/big-demo/login/theme.properties @@ -0,0 +1,11 @@ +# Demo login theme for the public Talos deployment: keycloak.v2 plus a script that +# fills in and submits the medewerker OTP step from the committed fixture secret +# (docs/runbooks/keycloak.md). Only used when the chart's demo.otpAutofill is on โ€” +# it then becomes Keycloak's default theme. Never enable it anywhere real. +# +# Add styles, messages or template overrides here as in any Keycloak theme +# (https://www.keycloak.org/ui-customization/themes); new files must also be +# listed in infra/helm/seed-configmaps.sh and the keycloak `files` in values.yaml. +parent=keycloak.v2 +import=common/keycloak +scripts=js/otp-autofill.js