Local development#21
Open
constantine2nd wants to merge 15 commits into
Open
Conversation
The local deploy script (run-local-postgres-cicd.sh) failed under a Java 11 shell default because the provider targets Java 17. Add an ensure_java17 step that auto-selects an installed JDK 17+ before the Maven build, with a clear error if none is found. Also compile the provider against the same Keycloak version the image runs by passing -Dversion.keycloak from .env (KEYCLOAK_VERSION), and bump every stale 26.5.1 reference (pom default + docs/comments) to 26.5.3 for consistency.
…ofile
Keycloak reads theme.properties per theme type (<theme>/login/theme.properties),
not the top-level <theme>/theme.properties. The obp login theme had no parent
declared, so nothing from the base theme resolved: the user-profile-commons.ftl
import threw HTTP 500 on the VERIFY_PROFILE page, base message keys rendered as
raw keys (firstName, lastName, error-user-attribute-required), and styles/CSS
classes never applied.
- themes/obp/login/theme.properties: add parent=base, styles, locales, i18n,
branding and the kc*Class block (consolidated from the dead top-level file).
- themes/obp/theme.properties: delete — Keycloak never read it; it only misled.
- login-update-profile.ftl: render via the userProfileFormFields macro (prefills
from the profile bean, drops the non-editable username field, marks required
attributes) instead of legacy ${user.*} vars that KC26 no longer populates.
- messages_en.properties: add firstName/lastName/doSubmit/doCancel and user
profile validation keys (explicit; base now also provides them).
- Repoint the deploy script's theme health check and the docs to the per-type
theme.properties path.
Verified end to end: admin login reaches VERIFY_PROFILE, the page renders 200
with correct labels and validation messages, and submitting the profile issues
an auth code.
The obp login theme advertised 8 locales but shipped only messages_en. With
parent=base now resolving standard keys, OBP-custom keys (obpWelcome, branded
titles, etc.) still rendered as raw keys in non-English locales. Add full
translated bundles mirroring messages_en.properties for all advertised locales
(zh-CN kept as declared, file messages_zh_CN.properties).
Each bundle has identical key parity with en (178 keys), preserves placeholders
({0}/{1}/{2}), <strong> tags, and proper nouns (Open Bank Project, TESOBE,
Keycloak). Translations are machine-generated and should be reviewed by native
speakers before production use.
Add docs/ONBOARDING.md — a fresh-start walkthrough covering prerequisites, creating the Keycloak database, the .env KEYCLOAK_VERSION requirement, deploy, first-login VERIFY_PROFILE prompt, enabling realm i18n, teardown, and a troubleshooting table. Link it from the README documentation section.
Every --no-cache rebuild orphans the previous image and intermediate stages into dangling images, which accumulate (~600MB each). Label both build stages with com.openbankproject.image=obp-keycloak-provider and, after building, run a label-filtered `docker image prune` so only THIS project's dangling leftovers are removed — other projects' images and the shared build cache are never touched.
…, log knobs) Improve deployment/maintenance observability without touching the provider Java: - entrypoint prints a build banner (build-info.txt: timestamp + JAR checksum) at startup so logs identify exactly which image is running. - docker run caps the json-file log (--log-opt max-size=10m max-file=5, overridable via DOCKER_LOG_MAX_SIZE/DOCKER_LOG_MAX_FILE) to prevent unbounded log growth on long-lived hosts. - pass KC_LOG_LEVEL (default INFO; supports category overrides like io.tesobe:DEBUG) and KC_LOG_CONSOLE_OUTPUT (default/json) so verbosity and format can be tuned without rebuilding. - document all four in env.sample.
Add a "Logging & observability" section to docs/ONBOARDING.md covering KC_LOG_LEVEL / KC_LOG_CONSOLE_OUTPUT / DOCKER_LOG_MAX_* and how to use them (identify the running build via the startup banner, debug just io.tesobe, JSON logs for aggregators, health/metrics endpoints), plus the known WARN-noise/PII caveat and the operational workaround.
Add a note in the Direct Docker Commands block linking to ONBOARDING.md §6 so the log-level/format, rotation, and build-banner knobs are discoverable from the development scripts README.
… cut PII The provider logged per-request/by-design activity at WARN (e.g. isValid() markers, "password validation SUCCESSFUL", "FEDERATED STORAGE DETECTED", every read-only "OPERATION DISABLED" setter) and printed names/emails at INFO. That made WARN useless for alerting and leaked PII into logs. Demote routine tracing and read-only no-ops to DEBUG, and move name/email lines to DEBUG. Genuinely actionable conditions stay at WARN/ERROR: invalid ID format, user-not-found-by-id, OBP HTTP errors / 500 retries / null responses, interrupts, and admin-token failures. Behaviour is unchanged — log levels only. Use KC_LOG_LEVEL=...,io.tesobe:DEBUG to restore the verbose tracing when needed.
Brings the CI pipeline fixes from OpenBankProject/OBP-Keycloak-Provider: - .github/Dockerfile: ARG KEYCLOAK_VERSION=26.5.3 default + per-stage re-declarations — fixes the empty-version 'invalid reference format' CI build failure on this fork. - build_container.yml: tag images with the commit SHA. - remove the retired auto_update_base_image.yml workflow. Clean merge — no conflicts; all local work (theme parent=base fix, locale bundles, provider log-level fix, docker leftover-reclaim, logging knobs) is preserved.
On forks without the DOCKER_HUB_ORGANIZATION repo variable, the image tag became
docker.io//obp-keycloak:... (empty org) and `docker build` failed instantly with
"invalid reference format" — so every push showed a red build.
- Default the org to a placeholder ('obp') via `vars.DOCKER_HUB_ORGANIZATION ||
'obp'` so the tag is always valid and the build runs (validates the Dockerfile).
- Gate the push/sign steps on a real org being set
(DEPLOY_CONTAINERS == 'true' && DOCKER_HUB_ORGANIZATION != '') so the
placeholder is never published.
Upstream (org variable set) is unaffected — the fallback only applies when unset.
…g the form
obp-dark sets `styles=css/styles.css`, which replaces (not appends to) the parent
keycloak theme's `styles=css/login.css`. That parent stylesheet is what keeps the
locale menu collapsed (#kc-locale ul { display:none }, shown on hover). Without it
the language <ul> rendered fully expanded and overlapped the username/password
fields, so credentials could not be entered once i18n was enabled.
Add the collapse behaviour to obp-dark's stylesheet (display:none by default,
shown on hover/focus-within, absolutely positioned with z-index above the form),
styled for dark mode.
…ontrols Adopt the OBP API sandbox portal's "obptheme" dark palette (converted from its OKLCH design tokens) and tidy the login controls: - documented palette as CSS variables: navy/purple primary surfaces (bg #0a0917, card #141423, border #23242f), near-white text (#fafafa / muted #a1a1a1), and the OBP green accent (#54b167 / hover #78bf86). - Sign In button, links, and input focus now use the OBP green accent. - float the language selector to the top-right of the card and style its toggle like the form's input controls (dark bg, matching border, caret, green hover); dropdown gets rounded corners + shadow. - fix the password-visibility (eye) icon contrast — was dark-on-dark; now muted light with a green hover.
The OBP provider implemented UserRegistrationProvider but threw UnsupportedOperationException from addUser/removeUser. On first-broker login (e.g. Google OIDC), Keycloak's UserStorageManager routes user creation to registration-capable federation providers before its own DB, so the throw aborted the flow with IDENTITY_PROVIDER_FIRST_LOGIN_ERROR. Removing the capability makes UserStorageManager fall through to Keycloak's local store, which materializes and links the brokered identity. OBP users remain read-only via lookup/query/credential validation; they were never creatable or deletable through Keycloak.
…storage Document that brokered IdP users (e.g. Google OIDC) are stored in Keycloak's own database, since this provider is intentionally not a UserRegistrationProvider. Clarifies the read-only OBP federation vs. local IdP user management distinction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.