notandClaude Opus 5
a87a32e269
CI / build (pull_request) Successful in 1m10s
CI / lint (pull_request) Successful in 1m27s
CI / unit (pull_request) Successful in 1m24s
CI / frontend (pull_request) Successful in 3m27s
CI / mutation (pull_request) Successful in 6m29s
CI / verify-stack (pull_request) Successful in 9m41s
Runbook gains an MFA section and how to get a code; synthetic-data lists the fixture TOTP secret and the extra grant parameter; demo-script gains the S-15c note and its staff logins now mention the second factor. check_realms.py grows an 'otp' argument that prints a current code for a manual demo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# Synthetic data
|
|
|
|
All credentials here are **dev-only** synthetic test data — never real personal data,
|
|
never used outside local development.
|
|
|
|
## Keycloak realms (S-02)
|
|
|
|
Keycloak runs at <http://localhost:8180> (admin console: **admin / admin**). Four realms
|
|
are imported at boot from `infra/keycloak/realms/`. Each has a public OIDC client
|
|
**`big-portal`** (standard flow + direct access grants enabled, redirect URIs `*` for dev).
|
|
|
|
All test users share the password **`test123`**.
|
|
|
|
| Realm | Mimics | User | Identifying claim |
|
|
|---|---|---|---|
|
|
| `digid` | DigiD (burgers) | `jan-burger` | `bsn` = `123456782` |
|
|
| `digid` | DigiD (burgers) | `sanne-burger` | `bsn` = `231477813` (S-26 resume e2e — its own user so it can leave an open registration) |
|
|
| `eherkenning` | eHerkenning (bedrijven) | `acme-ondernemer` | `kvk` = `12345678` |
|
|
| `eidas` | eIDAS (EU) | `pierre-dupont` | `eidas_id` = `FR/NL/AB-1234-5678` |
|
|
| `medewerker` | Internal staff | `merel-behandelaar` | role `behandelaar` |
|
|
| `medewerker` | Internal staff | `tom-teamlead` | roles `behandelaar`, `teamlead` |
|
|
| `medewerker` | Internal staff | `bram-beheerder` | role `beheerder` |
|
|
|
|
`medewerker` users additionally need a **second factor**: that realm enforces MFA (S-15c,
|
|
ADR-0031). All three share the fixture TOTP secret `BIGMEDEWERKEROTPSEED`; print a current
|
|
code with `python3 infra/keycloak/check_realms.py otp`.
|
|
|
|
The identifying claims are injected via OIDC protocol mappers on `big-portal`
|
|
(user-attribute → token claim); `medewerker` roles appear in `realm_access.roles`.
|
|
|
|
## Get a token (for testing)
|
|
|
|
```bash
|
|
curl -s -X POST \
|
|
http://localhost:8180/realms/digid/protocol/openid-connect/token \
|
|
-d grant_type=password -d client_id=big-portal \
|
|
-d username=jan-burger -d password=test123 -d scope=openid | jq -r .access_token
|
|
```
|
|
|
|
For a `medewerker` user, add `-d totp=$(python3 infra/keycloak/check_realms.py otp)` —
|
|
without it the grant is refused with `invalid_grant`.
|
|
|
|
Decode the JWT payload to see the `bsn` claim. `make keycloak-smoke` checks every realm
|
|
automatically.
|