wip functional setup without keycloak and silent login

Makefile

@@ -81,7 +81,6 @@ create-env-files: \
 	env.d/development/common \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
-	env.d/development/kc_postgresql \
 	env.d/development/summary \
 	env.d/development/kube-secret \
 	env.d/development/multi_user_transcriber \
@@ -288,9 +287,6 @@ env.d/development/common:
 env.d/development/postgresql:
 	cp -n env.d/development/postgresql.dist env.d/development/postgresql
 
-env.d/development/kc_postgresql:
-	cp -n env.d/development/kc_postgresql.dist env.d/development/kc_postgresql
-
 env.d/development/summary:
 	cp -n env.d/development/summary.dist env.d/development/summary
 

compose.yml

@@ -147,7 +147,7 @@ services:
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
-      - keycloak
+      - dex
       - app-dev
     networks:
       - resource-server
@@ -187,40 +187,16 @@ services:
     volumes:
       - ".:/app"
 
-  kc_postgresql:
-    image: postgres:14.3
-    ports:
-      - "5433:5432"
-    env_file:
-      - env.d/development/kc_postgresql
-
-  keycloak:
-    image: quay.io/keycloak/keycloak:20.0.1
+  # OIDC provider for the development stack. Dex uses in-memory storage, so it
+  # needs no database and no volume: restarting it rotates the signing keys and
+  # drops every active session, which is fine locally.
+  dex:
+    image: dexidp/dex:v2.45.1
+    command: ["dex", "serve", "/etc/dex/config.yaml"]
     volumes:
-      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
-    command:
-      - start-dev
-      - --features=preview
-      - --import-realm
-      - --proxy=edge
-      - --hostname-url=http://localhost:8083
-      - --hostname-admin-url=http://localhost:8083/
-      - --hostname-strict=false
-      - --hostname-strict-https=false
-    environment:
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_DB: postgres
-      KC_DB_URL_HOST: kc_postgresql
-      KC_DB_URL_DATABASE: keycloak
-      KC_DB_PASSWORD: pass
-      KC_DB_USERNAME: meet
-      KC_DB_SCHEMA: public
-      PROXY_ADDRESS_FORWARDING: 'true'
-    ports:
-      - "8080:8080"
-    depends_on:
-      - kc_postgresql
+      - ./docker/auth/dex.yaml:/etc/dex/config.yaml:ro
+    expose:
+      - "5556"
 
   livekit:
     image: livekit/livekit-server

docker/auth/dex.yaml

@@ -0,0 +1,93 @@
+# Dex configuration for the local development stack.
+#
+# This file replaces the former Keycloak "meet" realm (docker/auth/realm.json).
+# The client and the users below are a one-to-one port of that realm.
+#
+# Storage is in-memory on purpose: no database container, no volume, ~30 MB of
+# RAM instead of the Keycloak + PostgreSQL pair. The trade-off is that
+# restarting the `dex` service rotates the signing keys and drops every active
+# session, so you have to log in again.
+
+# Must match OIDC_OP_URL in env.d/development/common. Dex serves all of its
+# endpoints under the path component of the issuer, i.e. /dex/auth, /dex/token,
+# /dex/keys, /dex/userinfo and /dex/.well-known/openid-configuration.
+issuer: http://localhost:8083/dex
+
+storage:
+  type: memory
+
+web:
+  http: 0.0.0.0:5556
+  allowedOrigins:
+    - http://localhost:3000
+    - http://localhost:8071
+
+logger:
+  level: info
+  format: text
+
+oauth2:
+  # Logging in implies authorization: no consent screen, as with the realm.
+  skipApprovalScreen: true
+
+expiry:
+  idTokens: 24h
+  signingKeys: 6h
+
+staticClients:
+  - id: meet
+    name: Meet
+    secret: ThisIsAnExampleKeyForDevPurposeOnly
+    # Dex does not support wildcards: every callback URL must be listed
+    # explicitly. The path is the one exposed by mozilla-django-oidc through
+    # lasuite.oidc_login, mounted under api/<version>/ by core.urls.
+    redirectURIs:
+      - http://localhost:3000/api/v1.0/callback/
+      - http://localhost:3200/api/v1.0/callback/
+      - http://localhost:8070/api/v1.0/callback/
+      - http://localhost:8071/api/v1.0/callback/
+      - http://localhost:8088/api/v1.0/callback/
+
+enablePasswordDB: true
+
+# Dex's local password database authenticates on the *email address*, not on
+# the username, so the login is now "meet@meet.world" (password unchanged).
+#
+# Hashes are bcrypt with cost 10, the minimum dex accepts. To add a user:
+#   htpasswd -bnBC 10 "" <password> | tr -d ':\n'
+staticPasswords:
+  - email: meet@meet.world
+    hash: "$2b$10$qVCVTnaF67S/7a.pQM4djOgpj61FxD/yz6LoiQdtX0TKISelAfZxC"
+    username: meet
+    name: John Doe
+    preferredUsername: John
+    userID: 4ad6106f-a64f-43eb-ad0e-380d2cad9a9d
+    groups:
+      - user
+
+  - email: user@chromium.e2e
+    hash: "$2b$10$4Rs3Jd/Q23RM09g7c1Z/yeGmEjoAYlMKXDBkkjERaRDlz0Doiwl2q"
+    username: user-e2e-chromium
+    name: E2E Chromium
+    preferredUsername: E2E
+    userID: 1cd83dfc-153f-4987-b8a6-a2ac72d39122
+    groups:
+      - user
+
+  - email: user@webkit.e2e
+    hash: "$2b$10$D50UlVVMA7qWlB.Pw8P02eMJpo8qfwWuGiA63IeTqq/3mAE7RyH3m"
+    username: user-e2e-webkit
+    name: E2E Webkit
+    preferredUsername: E2E
+    userID: 9b9bd390-a6e5-42f8-a06d-9a11ede7bb8c
+    groups:
+      - user
+
+  - email: user@firefox.e2e
+    hash: "$2b$10$0D8WW7.KXMkzSY2b9JhwYeIM3WkTPQCwGd36/G3TZ/HHh4ObCVRga"
+    username: user-e2e-firefox
+    name: E2E Firefox
+    preferredUsername: E2E
+    userID: ec3e8750-7629-42f1-a0c3-6e23968a2fba
+    groups:
+      - user

docker/files/etc/nginx/conf.d/default.conf

@@ -40,7 +40,7 @@ server {
     }
 
     location / {
-        proxy_pass http://keycloak:8080;
+        proxy_pass http://dex:5556;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

docker/resource-server/compose.yml

@@ -1,12 +1,13 @@
 version: '3'
 
 # You can add any necessary service here that will join the same docker network
-# sharing keycloak. Services added to the 'meet_resource-server' network will be
-# able to communicate with keycloak and the backend on that network.
+# sharing the OIDC provider. Services added to the 'meet_resource-server'
+# network will be able to communicate with dex (through nginx) and the backend
+# on that network.
 services:
   # busybox service is only used for testing purposes. It provides curl to test
-  # connectivity to the backend and keycloak services. Replace this with your
-  # relevant application services that need to communicate with keycloak.
+  # connectivity to the backend and the OIDC provider. Replace this with your
+  # relevant application services that need to communicate with them.
   busybox:
     image: alpine:latest
     privileged: true

docs/developping_locally.md

@@ -71,8 +71,12 @@ $ make bootstrap FLUSH_ARGS='--no-input'
 
 2. Access the project:
 - The frontend is available at [http://localhost:3000](http://localhost:3000) with the default credentials:
-    - username: meet
+    - email: meet@meet.world
     - password: meet
+
+  Authentication is handled by [dex](https://dexidp.io/), configured in
+  `docker/auth/dex.yaml`. It logs you in by email address, and its storage is
+  in-memory: restarting the `dex` container logs everyone out.
 - The Django backend is available at [http://localhost:8071](http://localhost:8071)
 
 ---

env.d/development/common.dist

@@ -31,24 +31,35 @@ MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
 
 # OIDC
-OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs
-OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/meet/protocol/openid-connect/auth
-OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/token
-OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/userinfo
-OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/token/introspect
-OIDC_OP_URL=http://localhost:8083/realms/meet
+# Provider is dex (docker/auth/dex.yaml), served behind nginx on port 8083.
+# Endpoints reached by the browser use localhost, the ones called server-side
+# by the backend use the nginx service name.
+OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/dex/keys
+OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/dex/auth
+OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/dex/token
+OIDC_OP_USER_ENDPOINT=http://nginx:8083/dex/userinfo
+OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/dex/token/introspect
+OIDC_OP_URL=http://localhost:8083/dex
 
 OIDC_RP_CLIENT_ID=meet
 OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
 OIDC_RP_SIGN_ALGO=RS256
-OIDC_RP_SCOPES="openid email"
+# "profile" is required: dex only emits the name claims under that scope.
+OIDC_RP_SCOPES="openid email profile"
+
+# Dex exposes the display name through the standard "name" and
+# "preferred_username" claims and never emits given_name/family_name.
+OIDC_USERINFO_FULLNAME_FIELDS=name
+OIDC_USERINFO_SHORTNAME_FIELD=preferred_username
 
 LOGIN_REDIRECT_URL=http://localhost:3000
 LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
 LOGOUT_REDIRECT_URL=http://localhost:3000
 
 OIDC_REDIRECT_ALLOWED_HOSTS=localhost:8083,localhost:3000
-OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
+# Dex has no notion of ACR, the eIDAS level requested from ProConnect in
+# production is meaningless here and would just be ignored.
+OIDC_AUTH_REQUEST_EXTRA_PARAMS={}
 
 OIDC_RS_CLIENT_ID=meet
 OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly

env.d/development/kc_postgresql.dist

@@ -1,11 +0,0 @@
-# Postgresql db container configuration
-POSTGRES_DB=keycloak
-POSTGRES_USER=meet
-POSTGRES_PASSWORD=pass
-
-# App database configuration
-DB_HOST=kc_postgresql
-DB_NAME=keycloak
-DB_USER=meet
-DB_PASSWORD=pass
-DB_PORT=5433