feat: enhance Keycloak client configuration with additional fields for redirect URIs, logout settings, and URLs

helm/crds/provisioning.totalsoft.ro_keycloakclients.yaml

@@ -47,6 +47,10 @@ spec:
             type: object
           spec:
             properties:
+              baseUrl:
+                description: BaseUrl is the default URL used when the auth server
+                  needs to redirect or link back to the client.
+                type: string
               categoryOverrides:
                 additionalProperties:
                   x-kubernetes-preserve-unknown-fields: true
@@ -157,6 +161,14 @@ spec:
                   - domain
                   type: object
                 type: array
+              frontchannelLogout:
+                description: FrontchannelLogout enables front-channel logout.
+                type: boolean
+              frontchannelLogoutUrl:
+                description: FrontchannelLogoutUrl The URL Keycloak calls to perform
+                  front-channel logout. It is only applicable when FrontchannelLogoutEnabled
+                  is true.
+                type: string
               fullScopeAllowed:
                 description: FullScopeAllowed allows full scope.
                 type: boolean
@@ -171,9 +183,18 @@ spec:
               organization:
                 description: Associated tenant name.
                 type: string
+              pkceCodeChallengeMethod:
+                description: PkceCodeChallengeMethod is the PKCE code challenge method.
+                type: string
               platformRef:
                 description: Target platform (custom resource name).
                 type: string
+              postLogoutRedirectUris:
+                description: PostLogoutRedirectUris is the list of valid redirect
+                  URIs after logout.
+                items:
+                  type: string
+                type: array
               protocol:
                 description: Protocol e.g. "openid-connect"
                 type: string
@@ -209,6 +230,15 @@ spec:
               realm:
                 description: Associated realm.
                 type: string
+              redirectUris:
+                description: RedirectUris is the list of valid redirect URIs after
+                  login.
+                items:
+                  type: string
+                type: array
+              rootUrl:
+                description: RootUrl is the root URL appended to relative URLs.
+                type: string
               serviceAccountsEnabled:
                 description: ServiceAccountsEnabled enables service accounts.
                 type: boolean
@@ -268,6 +298,11 @@ spec:
                   Overrides for tenants. Dictionary with tenant name as key, spec override as value.
                   The spec override has the same structure as Spec
                 type: object
+              webOrigins:
+                description: WebOrigins is the list of allowed CORS origins.
+                items:
+                  type: string
+                type: array
             required:
             - clientId
             - clientName

internal/controllers/provisioning/provisioners/pulumi/keycloak_client.go

@@ -50,7 +50,7 @@ func deployKeycloakClient(target provisioning.ProvisioningTarget,
 		func(platform *platformv1.Platform) string { return spec.ClientName },
 	)
 
-	client, err := openid.NewClient(ctx, keycloakClient.Name, &openid.ClientArgs{
+	clientArgs := &openid.ClientArgs{
 		RealmId:                   pulumi.String(realm.Id),
 		ClientId:                  pulumi.String(clientId),
 		Name:                      pulumi.String(clientName),
@@ -61,8 +61,39 @@ func deployKeycloakClient(target provisioning.ProvisioningTarget,
 		StandardFlowEnabled:       pulumi.Bool(spec.StandardFlowEnabled),
 		ImplicitFlowEnabled:       pulumi.Bool(spec.ImplicitFlowEnabled),
 		DirectAccessGrantsEnabled: pulumi.Bool(spec.DirectAccessGrantsEnabled),
+		FrontchannelLogoutEnabled: pulumi.Bool(spec.FrontchannelLogout),
+		FrontchannelLogoutUrl:     pulumi.String(spec.FrontchannelLogoutUrl),
 		FullScopeAllowed:          pulumi.Bool(spec.FullScopeAllowed),
-	}, pulumi.DependsOn(dependencies))
+		RootUrl:                   pulumi.String(spec.RootUrl),
+		BaseUrl:                   pulumi.String(spec.BaseUrl),
+		PkceCodeChallengeMethod:   pulumi.String(spec.PkceCodeChallengeMethod),
+	}
+
+	if len(spec.PostLogoutRedirectUris) > 0 {
+		redirectUris := make(pulumi.StringArray, len(spec.PostLogoutRedirectUris))
+		for i, u := range spec.PostLogoutRedirectUris {
+			redirectUris[i] = pulumi.String(u)
+		}
+		clientArgs.ValidPostLogoutRedirectUris = redirectUris
+	}
+
+	if len(spec.RedirectUris) > 0 {
+		redirectUris := make(pulumi.StringArray, len(spec.RedirectUris))
+		for i, u := range spec.RedirectUris {
+			redirectUris[i] = pulumi.String(u)
+		}
+		clientArgs.ValidRedirectUris = redirectUris
+	}
+
+	if len(spec.WebOrigins) > 0 {
+		webOrigins := make(pulumi.StringArray, len(spec.WebOrigins))
+		for i, o := range spec.WebOrigins {
+			webOrigins[i] = pulumi.String(o)
+		}
+		clientArgs.WebOrigins = webOrigins
+	}
+
+	client, err := openid.NewClient(ctx, keycloakClient.Name, clientArgs, pulumi.DependsOn(dependencies))
 	if err != nil {
 		return nil, err
 	}

pkg/apis/provisioning/v1alpha1/keycloakClientTypes.go

@@ -31,6 +31,30 @@ type KeycloakClientSpec struct {
 	// Associated tenant name.
 	Organization string `json:"organization,omitempty"`
 
+	// RootUrl is the root URL appended to relative URLs.
+	// +optional
+	RootUrl string `json:"rootUrl,omitempty"`
+
+	// BaseUrl is the default URL used when the auth server needs to redirect or link back to the client.
+	// +optional
+	BaseUrl string `json:"baseUrl,omitempty"`
+
+	// RedirectUris is the list of valid redirect URIs after login.
+	// +optional
+	RedirectUris []string `json:"redirectUris,omitempty"`
+
+	// PostLogoutRedirectUris is the list of valid redirect URIs after logout.
+	// +optional
+	PostLogoutRedirectUris []string `json:"postLogoutRedirectUris,omitempty"`
+
+	// PkceCodeChallengeMethod is the PKCE code challenge method.
+	// +optional
+	PkceCodeChallengeMethod string `json:"pkceCodeChallengeMethod,omitempty"`
+
+	// WebOrigins is the list of allowed CORS origins.
+	// +optional
+	WebOrigins []string `json:"webOrigins,omitempty"`
+
 	// Enabled indicates if the client is enabled.
 	Enabled bool `json:"enabled"`
 
@@ -52,6 +76,14 @@ type KeycloakClientSpec struct {
 	// DirectAccessGrantsEnabled enables direct access grants (resource owner password).
 	DirectAccessGrantsEnabled bool `json:"directAccessGrantsEnabled"`
 
+	// FrontchannelLogout enables front-channel logout.
+	// +optional
+	FrontchannelLogout bool `json:"frontchannelLogout,omitempty"`
+
+	// FrontchannelLogoutUrl The URL Keycloak calls to perform front-channel logout. It is only applicable when FrontchannelLogoutEnabled is true.
+	// +optional
+	FrontchannelLogoutUrl string `json:"frontchannelLogoutUrl,omitempty"`
+
 	// Protocol e.g. "openid-connect"
 	Protocol string `json:"protocol,omitempty"`