DTaaS keycloak custom claims

[sandrafosssoerensen]

Keycloak Protocol Mappers - PR Overview

This is the short summary of what was implemented in this repository for the
Keycloak mapper work.

What Changed

1. Added an idempotent configurator script:
   • workspaces/test/dtaas/keycloak/configure_keycloak_rest.py
2. Script now configures both custom claims used by DTaaS:
   • profile (from user attribute)
   • groups (from group membership)
3. Added support for two mapper placement modes:
   • shared client scope
   • direct client mappers
4. Set shared scope as the default mode.

Final Claim Decisions

Included:

• sub
• name
• preferred_username
• profile
• groups

Not implemented (by design):

• sub_legacy (GitLab-specific)
• groups_direct (GitLab-specific)
• https://gitlab.org/claims/groups/owner (GitLab-specific and not needed)

Scope Mode

Default behavior is now shared scope:

KEYCLOAK_USE_SHARED_SCOPE=true
KEYCLOAK_SHARED_SCOPE_NAME=your-shared-scope-name

Optional direct-client mode:

KEYCLOAK_USE_SHARED_SCOPE=false

How To Apply

cd workspaces/test/dtaas/keycloak
py configure_keycloak_rest.py --env-file ../config/.env

Verification Checklist

1. In Keycloak client/scopes, profile and groups mappers exist.
2. User is assigned to a Keycloak group (for groups claim to appear).
3. User has profile attribute (or script populated it).
4. userinfo contains expected claims (profile, groups, preferred_username).

[prasadtalasila]

@sandrafosssoerensen Thanks for the PR. The code quality can be improved by using the following conventions.

1. File length limited to 250 lines
2. Function length limited to 25 lines
3. Separation of code into workspaces/test/dtaas/keycloak/src and workspaces/test/dtaas/keycloak/test

Please see this example. You can use src instead of using something like dtaas_services

[sandrafosssoerensen]

@prasadtalasila Thank you. This makes sense. I have also tried to ommit the "# pylint: disable " that I had in some files alongside my update. This required alot of changes. But tell me if it still needs refactoring. Thanks in advance.

Update: Ican see that lint scripts is failing. I will fix this after the meeting. Its related to flake8, which I researched to be used in order to enforce style consistency and check code quality.