feat: identity group auth

src/pepr/operator/controllers/keycloak/client-sync.ts

@@ -89,9 +89,11 @@ async function syncClient(
     // If an existing client is found, update it
     if (token && !isRetry) {
       Log.debug(pkg.metadata, `Found existing token for ${clientReq.clientId}`);
+      handleClientGroups(clientReq);
       client = await apiCall(clientReq, "PUT", token);
     } else {
       Log.debug(pkg.metadata, `Creating new client for ${clientReq.clientId}`);
+      handleClientGroups(clientReq);
       client = await apiCall(clientReq);
     }
 
@@ -142,6 +144,18 @@ async function syncClient(
   }
 }
 
+/**
+ * Handles the client groups by converting the groups to attributes.
+ * @param clientReq - The client request object.
+ */
+function handleClientGroups(clientReq: Sso) {
+  if (clientReq.groups) {
+    clientReq.attributes = clientReq.attributes || {};
+    clientReq.attributes["uds.core.groups"] = JSON.stringify(clientReq.groups);
+    delete clientReq.groups;
+  }
+}
+
 async function apiCall(sso: Partial<Sso>, method = "POST", authToken = "") {
   // Handle single test mode
   if (UDSConfig.isSingleTest) {

src/pepr/operator/crd/generated/package-v1alpha1.ts

@@ -478,6 +478,10 @@ export interface Sso {
    * Whether the SSO client is enabled
    */
   enabled?: boolean;
+  /**
+   * The client sso group type
+   */
+  groups?: Groups;
   /**
    * If true, the client will generate a new Auth Service client as well
    */
@@ -526,6 +530,16 @@ export enum ClientAuthenticatorType {
   ClientSecret = "client-secret",
 }
 
+/**
+ * The client sso group type
+ */
+export interface Groups {
+  /**
+   * List of group allowed to access to client
+   */
+  anyOf?: string[];
+}
+
 /**
  * Specifies the protocol of the client, either 'openid-connect' or 'saml'
  */

src/pepr/operator/crd/sources/package/v1alpha1.ts

@@ -303,6 +303,19 @@ const sso = {
           type: "string",
         },
       },
+      groups: {
+        description: "The client sso group type",
+        type: "object",
+        properties: {
+          anyOf: {
+            description: "List of group allowed to access to client",
+            type: "array",
+            items: {
+              type: "string",
+            },
+          },
+        },
+      },
     },
   } as V1JSONSchemaProps,
 } as V1JSONSchemaProps;