Fixes mosip/esignet #2667 Refactor mapper creation logic

helm/keycloak-init/values.yaml

@@ -3,17 +3,14 @@
 # Declare variables to be passed into your templates.
 
 replicaCount: 1
-
 image:
   repository: mosipqa/keycloak-init
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
   tag: develop
-
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
-
 serviceAccount:
   # Specifies whether a service account should be created
   create: true
@@ -22,28 +19,25 @@
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
-
 jobAnnotations: {}
-
 jobSecurityContext: {}
 # fsGroup: 2000
 
 securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
+# capabilities:
+#   drop:
+#   - ALL
+# readOnlyRootFilesystem: true
+# runAsNonRoot: true
 # runAsUser: 1000
 
 service:
   type: ClusterIP
   port: 80
-
 ingress:
   enabled: false
   annotations: {}
-    # kubernetes.io/ingress.class: nginx
+  # kubernetes.io/ingress.class: nginx
   # kubernetes.io/tls-acme: "true"
   hosts:
     - host: chart-example.local
@@ -52,26 +46,21 @@
   #  - secretName: chart-example-tls
   #    hosts:
   #      - chart-example.local
-
 resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
 #   memory: 128Mi
 
 nodeSelector: {}
-
 tolerations: []
-
 affinity: {}
-
-
 ## It is assumed that these configmaps are created when Keycloak was installed and available in the same namespace
 ## as this chart
 keycloak:
@@ -85,7 +74,6 @@
     secret:
       existingSecret: keycloak
       key: admin-password
-
   realms:
     # realm
     mosip:
@@ -117,15 +105,15 @@
         "emailTheme": "mosip"
         "browserSecurityHeaders":
           "contentSecurityPolicy": "frame-src 'self' https://www.google.com; frame-ancestors 'self'; object-src 'none';"
-        # "smtpServer":
-        #   "password": ""
-        #   "starttls": "false"
-        #   "auth": "true"
-        #   "port": "465"
-        #   "host": "smtp.gmail.com"
-        #   "from": ""
-        #   "ssl": "true"
-        #   "user": ""
+          # "smtpServer":
+          #   "password": ""
+          #   "starttls": "false"
+          #   "auth": "true"
+          #   "port": "465"
+          #   "host": "smtp.gmail.com"
+          #   "from": ""
+          #   "ssl": "true"
+          #   "user": ""
       roles:
         - Default
         - ABIS_PARTNER
@@ -236,72 +224,55 @@
         - name: add_oidc_client
           description: Scope required to create OIDC client
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
         - name: update_oidc_client
           description: ''
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
         - name: get_certificate
           description: Scope required to create OIDC client
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
         - name: upload_certificate
           description: ''
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
         - name: individual_id
           description: Scope required to create resident client
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "true",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "true", include.in.token.scope: "true"}
         - name: ida_token
           description: ''
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "true",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "true", include.in.token.scope: "true"}
         - name: send_binding_otp
           description: Scope required to create mpartner-default-mobile client
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
         - name: wallet_binding
           description: Scope required to create mpartner-default-mobile client
           protocol: openid-connect
           "Include In Token Scope": on
-          attributes: {
-            display.on.consent.screen: "false",
-            include.in.token.scope: "true"
-          }
+          attributes: {display.on.consent.screen: "false", include.in.token.scope: "true"}
       clients:
+        # A mapper without protocol_mapper stays oidc-usermodel-attribute-mapper
+        # (mapper_name, mapper_user_attribute, token_claim_name).
+        # Add an audience on the client that needs it:
+        # - mapper_name: esignet-audience
+        #   protocol_mapper: oidc-audience-mapper
+        #   included_client_audience: target-client-id
+        # Use included_custom_audience instead when the audience is not a client id.
+        # Set only one of those fields.
         - name: mosip-abis-client
           mappers: []
           saroles: []
-
         - name: mosip-admin-client
           mappers: []
           saroles:
@@ -312,16 +283,13 @@
             - PUBLISH_MOSIP_HOTLIST_GENERAL
             - uma_authorization
             - PUBLISH_MASTERDATA_TITLES_GENERAL
-
         - name: mosip-admin-services-client
           mappers: []
           saroles: []
-
         - name: mosip-auth-client
           mappers: []
           saroles:
             - AUTH
-
         - name: mosip-crereq-client
           mappers: []
           saroles:
@@ -330,7 +298,6 @@
             - SUBSCRIBE_CREDENTIAL_STATUS_UPDATE_GENERAL
             - offline_access
             - uma_authorization
-
         - name: mosip-creser-client
           mappers: []
           saroles:
@@ -351,14 +318,12 @@
             - METADATA_READ
             - CREATE_SHARE
             - CREDENTIAL_REQUEST
-
         - name: mosip-datsha-client
           mappers: []
           saroles:
             - CREATE_SHARE
             - REGISTRATION_PROCESSOR
             - POLICYMANAGER
-
         - name: mosip-ida-client
           mappers: []
           saroles:
@@ -367,11 +332,9 @@
             - ID_AUTHENTICATION
             - SUBSCRIBE_OIDC_CLIENT_CREATED_GENERAL
             - SUBSCRIBE_OIDC_CLIENT_UPDATED_GENERAL
-
         - name: mosip-misp-client
           mappers: []
           saroles: []
-
         - name: mosip-pms-client
           mappers:
             - mapper_name: phoneNumber
@@ -416,11 +379,9 @@
             - add_oidc_client
             - get_certificate
             - upload_certificate
-
         - name: mosip-policymanager-client
           mappers: []
           saroles: []
-
         - name: mosip-reg-client
           mappers: []
           saroles:
@@ -429,7 +390,6 @@
             - REGISTRATION_OFFICER
             - REGISTRATION_OPERATOR
             - REGISTRATION_SUPERVISOR
-
         - name: mosip-regproc-client
           mappers: []
           saroles:
@@ -449,7 +409,6 @@
             - PUBLISH_REGISTRATION_PROCESSOR_WORKFLOW_PAUSED_FOR_ADDITIONAL_INFO_EVENT_GENERAL
             - SUBSCRIBE_REGISTRATION_PROCESSOR_WORKFLOW_COMPLETED_EVENT_GENERAL
             - SUBSCRIBE_REGISTRATION_PROCESSOR_WORKFLOW_PAUSED_FOR_ADDITIONAL_INFO_EVENT_GENERAL
-
         - name: mpartner-default-mobile
           mappers: []
           saroles:
@@ -464,7 +423,6 @@
           assign_client_scopes:
             - send_binding_otp
             - wallet_binding
-
         - name: mosip-resident-client
           mappers:
             - mapper_name: individual_id
@@ -486,14 +444,12 @@
           assign_client_scopes:
             - individual_id
             - ida_token
-
         - name: mosip-prereg-client
           mappers: []
           saroles:
             - PREREG
             - REGISTRATION_PROCESSOR
             - PRE_REGISTRATION_ADMIN
-
         - name: mosip-creser-idpass-client
           mappers: []
           saroles:
@@ -504,7 +460,6 @@
             - METADATA_READ
             - CREATE_SHARE
             - CREDENTIAL_REQUEST
-
         - name: mosip-syncdata-client
           mappers: []
           saroles:
@@ -513,7 +468,6 @@
             - SUBSCRIBE_CA_CERTIFICATE_UPLOADED_GENERAL
             - REGISTRATION_SUPERVISOR
             - REGISTRATION_OFFICER
-
         - name: mpartner-default-auth
           mappers:
             - mapper_name: langCode
@@ -549,7 +503,6 @@
             - SUBSCRIBE_OIDC_CLIENT_UPDATED_GENERAL
             - PUBLISH_AUTHENTICATION_ERRORS_GENERAL
             - PUBLISH_REMOVE_ID_STATUS_GENERAL
-
         - name: mosip-idrepo-client
           mappers: []
           saroles:
@@ -566,15 +519,13 @@
             - PUBLISH_IDENTITY_CREATED_GENERAL
             - PUBLISH_IDENTITY_UPDATED_GENERAL
             - SUBSCRIBE_REMOVE_ID_STATUS_GENERAL
-
         - name: mpartner-default-print
           mappers: []
           saroles:
             - SUBSCRIBE_CREDENTIAL_ISSUED_INDIVIDUAL
             - PUBLISH_CREDENTIAL_STATUS_UPDATE_GENERAL
             - CREATE_SHARE
             - PRINT_PARTNER
-
         - name: mpartner-default-digitalcard
           mappers: []
           saroles:
@@ -596,7 +547,6 @@
             - uma_authorization
             - offline_access
             - PUBLISH_MOSIP_HOTLIST_GENERAL
-
         # Used only for initial deployment purposes. Maybe deleted from installation later.
         - name: mosip-deployment-client
           saroles:
@@ -605,15 +555,13 @@
             - PARTNER_ADMIN
             - uma_authorization
             - offline_access
-
         - name: mosip-digitalcard-client
           saroles:
             - CREATE_SHARE
             - PUBLISH_CREDENTIAL_STATUS_UPDATE_GENERAL
             - SUBSCRIBE_CREDENTIAL_ISSUED_INDIVIDUAL
             - SUBSCRIBE_IDENTITY_CREATED_GENERAL
             - SUBSCRIBE_IDENTITY_UPDATED_GENERAL
-
         - name: mosip-testrig-client
           saroles:
             - ID_AUTHENTICATION
@@ -679,7 +627,6 @@
             - SUBSCRIBE_OIDC_CLIENT_UPDATED_GENERAL
             - PUBLISH_AUTHENTICATION_ERRORS_GENERAL
       users: []
-
 ## These will be passed as environments variables to keycloak-init docker. Note the expected naming convention is
 ## <clientname>_<secret>.  If empty secret is passed, it shall be randomly generated
 clientSecrets: