From 3156eb459cd7388dad2522a8b763fff9145c684c Mon Sep 17 00:00:00 2001
From: mcgin314 <luther.coleman.mcginty@census.gov>
Date: Wed, 16 Apr 2025 09:36:43 -0400
Subject: [PATCH] Remove references to admin user, for the most part

---
 copy_images.tf              | 27 ---------------------------
 keycloak-server-values.yaml |  4 ++--
 main.tf                     | 21 +++++++++++----------
 outputs.tf                  | 11 ++++++++---
 variables.tf                |  2 +-
 5 files changed, 22 insertions(+), 43 deletions(-)

diff --git a/copy_images.tf b/copy_images.tf
index c77347e..858d2c6 100644
--- a/copy_images.tf
+++ b/copy_images.tf
@@ -32,33 +32,6 @@ locals {
       source_tag      = var.kubectl_image_tag
       tag             = var.kubectl_image_tag
     },
-    # {
-    #   enabled         = true
-    #   dest_path       = null
-    #   name            = "bitnami/keycloak"
-    #   source_image    = "bitnami/keycloak"
-    #   source_registry = "public.ecr.aws"
-    #   source_tag      = var.keycloak_tag
-    #   tag             = var.keycloak_tag
-    # },
-    # {
-    #   enabled         = true
-    #   dest_path       = null
-    #   name            = "bitnami/postgresql"
-    #   source_image    = "bitnami/postgresql"
-    #   source_registry = "public.ecr.aws"
-    #   source_tag      = var.postgresql_tag
-    #   tag             = var.postgresql_tag
-    # },
-    # {
-    #   enabled         = true
-    #   dest_path       = null
-    #   name            = "gogatekeeper"
-    #   source_image    = "bitnami/keycloak-gatekeeper"
-    #   source_registry = "public.ecr.aws"
-    #   source_tag      = var.gogatekeeper_tag
-    #   tag             = var.gogatekeeper_tag
-    # },
   ]
 }
 
diff --git a/keycloak-server-values.yaml b/keycloak-server-values.yaml
index aaa8f6c..6fe67b7 100644
--- a/keycloak-server-values.yaml
+++ b/keycloak-server-values.yaml
@@ -20,12 +20,12 @@ extraEnv: |
   - name: KC_BOOTSTRAP_ADMIN_USERNAME
     valueFrom:
       secretKeyRef:
-        name: keycloak-admin-creds
+        name: keycloak-user-creds
         key: username
   - name: KC_BOOTSTRAP_ADMIN_PASSWORD
     valueFrom:
       secretKeyRef:
-        name: keycloak-admin-creds
+        name: keycloak-user-creds
         key: password
   - name: JAVA_OPTS_APPEND
     value: >-
diff --git a/main.tf b/main.tf
index 0b80697..468b14b 100644
--- a/main.tf
+++ b/main.tf
@@ -1,5 +1,5 @@
 # main.tf
-resource "random_uuid" "admin-secret" {}
+resource "random_uuid" "user_secret" {}
 
 locals {
   public_hostname    = format("%v.%v", var.keycloak_hostname, var.cluster_domain)
@@ -9,17 +9,18 @@ locals {
   internal_port_number       = "8080"
   admin_internal_port_number = "9000"
 
-  admin-client-id = "sso.admin"
+  user_client_id = "sso.user"
+  user_secret    = "user-sso"
 
   secrets_job_script = <<SECRETS
 ensure_secret keycloak-db-creds username keycloak
 ensure_secret keycloak-db-creds password $(mkpasswd 32 false)
 ensure_secret keycloak-db-creds postgres-password $(mkpasswd 32 false)
 ensure_secret keycloak-db-creds replication-password $(mkpasswd 32 false)
-ensure_secret keycloak-admin-creds username admin
-ensure_secret keycloak-admin-creds password $(mkpasswd 32 false)
-ensure_secret admin-sso client_id "sso.admin"
-ensure_secret admin-sso client_secret "${random_uuid.admin-secret.result}"
+ensure_secret keycloak-user-creds username user
+ensure_secret keycloak-user-creds password $(mkpasswd 32 false)
+ensure_secret ${local.user_secret} client_id "${local.user_client_id}"
+ensure_secret ${local.user_secret} client_secret "${random_uuid.user_secret.result}"
 SECRETS
 
   config_job_script = <<CONFIG
@@ -33,12 +34,12 @@ create_realm_role ${var.default_realm} admin \
 	"Admin role for ${var.default_realm}" && \
 create_realm_role ${var.default_realm} user \
 	"User role for ${var.default_realm}" && \
-add_realm_role_to_user ${var.default_realm} "$KEYCLOAK_USER" admin && \
-create_client "${var.default_realm}" "${local.admin-client-id}" \
-	"${random_uuid.admin-secret.result}" "$rootUrl" "" \
+add_realm_role_to_user ${var.default_realm} user user && \
+create_client "${var.default_realm}" "${local.user_client_id}" \
+	"${random_uuid.user_secret.result}" "$rootUrl" "" \
 	"[ \"$redirectUrl\" ]" "" 1 && \
 add_mapper_to_client "${var.default_realm}" \
-	"$(get_client_id "${var.default_realm}" "${local.admin-client-id}")" \
+	"$(get_client_id "${var.default_realm}" "${local.user_client_id}")" \
 	"realm roles" "openid-connect" "oidc-usermodel-realm-role-mapper" \
 	"{ \"multivalued\": \"true\", \"userinfo.token.claim\": \"true\", \"user.attribute\": \"foo\", \"id.token.claim\": \"true\", \"access.token.claim\": \"true\", \"claim.name\": \"realm_access.roles\", \"jsonType.label\": \"String\" }" && \
 restart_server
diff --git a/outputs.tf b/outputs.tf
index 788456a..1b617ad 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -29,17 +29,22 @@ output "discovery_url" {
 
 output "user_auth_realm" {
   description = "The URL for discovering keycloak services."
-  value       = "${module.ingress_resources.service_url}/realms/cluster-admin"
+  value       = "${module.ingress_resources.service_url}/realms/cluster-user"
+}
+
+output "user_secret" {
+  description = "The name of the secret containing the sso user for accessing keycloak."
+  value       = local.user_secret
 }
 
 output "client_id" {
   description = "The client ID for accessing keycloak."
-  value       = local.admin-client-id
+  value       = local.user_client_id
 }
 
 output "client_secret" {
   description = "The client secret for accessing keycloak."
-  value       = random_uuid.admin-secret.result
+  value       = random_uuid.user_secret.result
 }
 
 output "namespace" {
diff --git a/variables.tf b/variables.tf
index 21cfca8..60a8208 100644
--- a/variables.tf
+++ b/variables.tf
@@ -106,7 +106,7 @@ variable "external_database_password" {
 variable "default_realm" {
   description = "The default realm to use to configure the environment."
   type        = string
-  default     = "cluster-admin"
+  default     = "cluster-user"
 }
 
 variable "admin_email" {