Sso integration improvements

Various changes related to SSO integration

These changes originate from the work done in Keycloak Package to create a development realm with all the dev clients for the apps that need SSO. The changes were identified in the process of testing SSO integration with the packages.

• fix Nexus templating for SSO configuration
  closes #827 (closed)
• Nexus allow for a list of roles
  https://repo1.dso.mil/platform-one/big-bang/apps/developer-tools/nexus/-/merge_requests/23
  https://repo1.dso.mil/platform-one/big-bang/apps/developer-tools/nexus/-/releases/34.1.0-bb.3
• dev-sso-values.yaml missing reference to jwks that is needed by authservice
• add nexus to dev-sso-values.yaml
• update Keycloak version so that the dev realm code can make it to dogfood cluster and CI pipelines where it can be used for SSO testing. There is no Keycloak application code in this new version, only dev changes.
  https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/keycloak/-/merge_requests/41
  https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/keycloak/-/releases/11.0.1-bb.9

added keycloak nexus labels

changed the description

added 1 commit

• 7453c436 - add jwks and nexus

Compare with previous version

added 1 commit

• b7cb31ad - add letsencrypt CA

Compare with previous version

added 1 commit

• cbe44019 - update keycloak version

Compare with previous version

added 1 commit

• 3f7fbefc - template role and set property for license

Compare with previous version

added 1 commit

• a059dcb4 - make license property conditional

Compare with previous version

added 1 commit

• 1cf6aff4 - better templating

Compare with previous version

added statusreview label

marked this merge request as ready

changed milestone to %1.20.0

changed the description

requested review from @michaelmcleroy

requested review from @ryan.j.garcia

added 8 commits

• 1cf6aff4...3f73c897 - 2 commits from branch master
• eae27961 - add jwks and nexus
• 17b962da - add letsencrypt CA
• 05ac7382 - update keycloak version
• a3addae9 - template role and set property for license
• 61407f28 - make license property conditional
• 7b41d4f8 - better templating

Compare with previous version

I'm afraid some of these nexus changes will overlap/conflict with the work done over on https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/970 . Do you mind reviewing that and possibly syncing with the MR creator to see where we can get both these MRs ready and easily mergable?

mentioned in merge request !970 (closed)

added 1 commit

• 711cecb9 - multiple roles

Compare with previous version

resolved all threads

changed the description

The nexus interface is changing. addons.nexus.sso.role changes from a map to a list. This will have to be explained in the 1.20.0 release notes.

The upgrade test fails because the Nexus cypress test is not smart enough to handle an upgrade. Fixing that test is out of scope for this effort.

If any reviewer is interested in seeing a demo of Nexus let me know. It is complicated and you need a license to test.

I think I still have the same concern I had with !970 (closed) - https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/970#note_441326 (which is a concern here since those changes were incorporated here )

It would be nice to have the default behavior still be the same with the role section...example:

if customer passes in nothing to values for role:

• single role is created that matches the previous version

  - id: "keycloak"
    name: "keycloak"
    description: "all keycloak users as admins"
    privileges:
      - "nx-all"
    roles:
      - "nx-admin"

else:

• use customer values for role setup.

mentioned in issue #778 (closed)

Follow up with Michael Knoth once merged in #778 (closed)

added statusdoing label and removed statusreview label

added 1 commit

• dc2bef52 - clean up bogus code

Compare with previous version

resolved all threads

added 1 commit

• 11e995f1 - update comments

Compare with previous version

resolved all threads

mentioned in merge request !1051 (closed)

added statusreview label and removed statusdoing label

approved this merge request

merged

mentioned in commit e6318331

mentioned in issue #637 (closed)