mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-09 02:45:17 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
68 lines
2.2 KiB
Django/Jinja
68 lines
2.2 KiB
Django/Jinja
{% set user_profile = {
|
||
"attributes": [
|
||
{
|
||
"name": "username",
|
||
"displayName": "${username}",
|
||
"validations": {
|
||
"length": { "min": 3, "max": 255 },
|
||
"pattern": {
|
||
"pattern": "^(?!(?:" ~ KEYCLOAK_RESERVED_USERNAMES_REGEX | replace('\\', '\\\\') ~ ")$)[a-z0-9]+$",
|
||
"error-message": "Username is reserved or contains invalid characters. Only lowercase letters (a–z) and digits (0–9) are allowed."
|
||
}
|
||
},
|
||
"annotations": {},
|
||
"permissions": {"view": ["admin","user"], "edit": ["admin","user"]},
|
||
"multivalued": false
|
||
},
|
||
{
|
||
"name": "email",
|
||
"displayName": "${email}",
|
||
"validations": {"email": {}, "length": {"max": 255}},
|
||
"required": {"roles": ["user"]},
|
||
"permissions": {"view": ["admin","user"], "edit": ["admin","user"]},
|
||
"multivalued": false
|
||
},
|
||
{
|
||
"name": "firstName",
|
||
"displayName": "${firstName}",
|
||
"validations": {"length": {"max": 255}, "person-name-prohibited-characters": {}},
|
||
"required": {"roles": ["user"]},
|
||
"permissions": {"view": ["admin","user"], "edit": ["admin","user"]},
|
||
"multivalued": false
|
||
},
|
||
{
|
||
"name": "lastName",
|
||
"displayName": "${lastName}",
|
||
"validations": {"length": {"max": 255}, "person-name-prohibited-characters": {}},
|
||
"required": {"roles": ["user"]},
|
||
"permissions": {"view": ["admin","user"], "edit": ["admin","user"]},
|
||
"multivalued": false
|
||
},
|
||
{
|
||
"name": LDAP.USER.ATTRIBUTES.SSH_PUBLIC_KEY,
|
||
"displayName": "SSH Public Key",
|
||
"validations": {},
|
||
"annotations": {},
|
||
"permissions": {"view": ["admin","user"], "edit": ["admin","user"]},
|
||
"group": "user-metadata",
|
||
"multivalued": true
|
||
}
|
||
],
|
||
"groups": [
|
||
{
|
||
"name": "user-metadata",
|
||
"displayHeader": "User metadata",
|
||
"displayDescription": "Attributes, which refer to user metadata"
|
||
}
|
||
]
|
||
} %}
|
||
"org.keycloak.userprofile.UserProfileProvider": [
|
||
{
|
||
"providerId": "declarative-user-profile",
|
||
"name": "declarative-user-profile",
|
||
"subComponents": {},
|
||
"config": {
|
||
"kc.user.profile.config": [{{ (user_profile | to_json) | to_json }}]
|
||
}
|
||
}
|
||
] |