notandClaude Opus 5
3567bc1f42
Every seeded medewerker carries a TOTP credential, so Keycloak's conditional-OTP step in both the browser and direct-grant flows always challenges them; a password alone no longer yields a token. CONFIGURE_TOTP becomes a default required action so any medewerker added later must enrol before logging in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
105 lines
3.1 KiB
JSON
105 lines
3.1 KiB
JSON
{
|
|
"realm": "medewerker",
|
|
"enabled": true,
|
|
"displayName": "Medewerkers",
|
|
"requiredActions": [
|
|
{
|
|
"alias": "CONFIGURE_TOTP",
|
|
"name": "Configure OTP",
|
|
"providerId": "CONFIGURE_TOTP",
|
|
"enabled": true,
|
|
"defaultAction": true,
|
|
"priority": 10
|
|
}
|
|
],
|
|
"roles": {
|
|
"realm": [
|
|
{ "name": "behandelaar", "description": "Behandelt registratieaanvragen" },
|
|
{ "name": "teamlead", "description": "Teamleider behandeling" },
|
|
{ "name": "beheerder", "description": "Beheert catalogus en default-fill (beheer-portal, S-15)" }
|
|
]
|
|
},
|
|
"clients": [
|
|
{
|
|
"clientId": "big-portal",
|
|
"enabled": true,
|
|
"publicClient": true,
|
|
"standardFlowEnabled": true,
|
|
"directAccessGrantsEnabled": true,
|
|
"redirectUris": ["*"],
|
|
"webOrigins": ["*"],
|
|
"protocolMappers": [
|
|
{
|
|
"name": "realm roles",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-realm-role-mapper",
|
|
"config": {
|
|
"multivalued": "true",
|
|
"claim.name": "realm_access.roles",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"username": "merel-behandelaar",
|
|
"enabled": true,
|
|
"firstName": "Merel",
|
|
"lastName": "Behandelaar",
|
|
"email": "merel@big.example.nl",
|
|
"emailVerified": true,
|
|
"credentials": [
|
|
{ "type": "password", "value": "test123", "temporary": false },
|
|
{
|
|
"type": "otp",
|
|
"userLabel": "seeded TOTP (fixture)",
|
|
"secretData": "{\"value\":\"BIGMEDEWERKEROTPSEED\"}",
|
|
"credentialData": "{\"subType\":\"totp\",\"digits\":6,\"counter\":0,\"period\":30,\"algorithm\":\"HmacSHA1\"}"
|
|
}
|
|
],
|
|
"realmRoles": ["behandelaar"]
|
|
},
|
|
{
|
|
"username": "tom-teamlead",
|
|
"enabled": true,
|
|
"firstName": "Tom",
|
|
"lastName": "Teamlead",
|
|
"email": "tom@big.example.nl",
|
|
"emailVerified": true,
|
|
"credentials": [
|
|
{ "type": "password", "value": "test123", "temporary": false },
|
|
{
|
|
"type": "otp",
|
|
"userLabel": "seeded TOTP (fixture)",
|
|
"secretData": "{\"value\":\"BIGMEDEWERKEROTPSEED\"}",
|
|
"credentialData": "{\"subType\":\"totp\",\"digits\":6,\"counter\":0,\"period\":30,\"algorithm\":\"HmacSHA1\"}"
|
|
}
|
|
],
|
|
"realmRoles": ["behandelaar", "teamlead"]
|
|
},
|
|
{
|
|
"username": "bram-beheerder",
|
|
"enabled": true,
|
|
"firstName": "Bram",
|
|
"lastName": "Beheerder",
|
|
"email": "bram@big.example.nl",
|
|
"emailVerified": true,
|
|
"credentials": [
|
|
{ "type": "password", "value": "test123", "temporary": false },
|
|
{
|
|
"type": "otp",
|
|
"userLabel": "seeded TOTP (fixture)",
|
|
"secretData": "{\"value\":\"BIGMEDEWERKEROTPSEED\"}",
|
|
"credentialData": "{\"subType\":\"totp\",\"digits\":6,\"counter\":0,\"period\":30,\"algorithm\":\"HmacSHA1\"}"
|
|
}
|
|
],
|
|
"realmRoles": ["beheerder"]
|
|
}
|
|
]
|
|
}
|