adebaumann/labhelper
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Keycloak shenanigans
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/labhelper) (push) Successful in 17s
Details
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/labhelper-data-loader) (push) Successful in 3s
Details

Browse Source
This commit is contained in:
Adrian A. Baumann
2026-02-25 22:24:44 +01:00
parent 88ff6ddae5
commit 4ad03403aa
6 changed files with 29 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Keycloak-installation.md
View File

@@ -47,7 +47,7 @@ Go to **Clients → labhelper → Client scopes** tab → click the dedicated sc
|---|---|---|
| Name | `groups` | Label for this mapper |
| Token Claim Name | `groups` | The claim name the app reads from the token |
| Full group path | Off | Sends `Lab Administrators` instead of `/Lab Administrators`. The app strips leading slashes anyway, but this is cleaner |
| Full group path | Off | Sends `LabHelper Administrators` instead of `/LabHelper Administrators`. The app strips leading slashes anyway, but this is cleaner |
| Add to ID token | On | |
| Add to access token | On | |
| Add to userinfo | On | The app fetches userinfo after the token exchange |
@@ -56,9 +56,9 @@ Go to **Clients → labhelper → Client scopes** tab → click the dedicated sc
Go to **Groups** (left sidebar) and create these three groups with exactly these names — they map to the existing Django groups:
- `Lab Administrators` — gets `is_staff=True` in Django (admin access)
- `Lab Staff`
- `Lab Viewers`
- `LabHelper Administrators` — gets `is_staff=True` in Django (admin access)
- `LabHelper Staff`
- `LabHelper Viewers`
### 6. Ensure users have an email address
@@ -120,7 +120,7 @@ Overrides `OIDCAuthenticationBackend` to:
- Use `preferred_username` from Keycloak as the Django username
- Set `first_name` and `last_name` from `given_name` / `family_name` claims
- Sync group memberships on every login — if a user is added to or removed from a Keycloak group, it takes effect at their next login
- Set `is_staff=True` for members of `Lab Administrators` (grants Django admin access)
- Set `is_staff=True` for members of `LabHelper Administrators` (grants Django admin access)
`django.contrib.auth.backends.ModelBackend` is kept as a fallback so the Django admin login form still works with a local username/password (useful for emergency superuser access without Keycloak).