From 20f5ef8faab47fed4bcf4d40cfe02382d3bbdf4d Mon Sep 17 00:00:00 2001
From: William Petit <wpetit@cadoles.com>
Date: Thu, 21 Jul 2022 11:21:56 +0200
Subject: [PATCH] feat: allow custom hydra clients generation

---
 defaults/main.yml                  |  7 +++++++
 tasks/main.yml                     |  9 +++++++++
 tasks/oidc-test.yml                | 13 +++++++++----
 templates/hydra-client.json.j2     | 14 ++++++++++++++
 templates/oidc-test-client.json.j2 | 19 -------------------
 5 files changed, 39 insertions(+), 23 deletions(-)
 create mode 100644 templates/hydra-client.json.j2
 delete mode 100644 templates/oidc-test-client.json.j2

diff --git a/defaults/main.yml b/defaults/main.yml
index 1f1be3f..02eb2d7 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -17,6 +17,13 @@ hydra_database_port: 3306
 public_scheme: http
 public_host: "{{ ansible_default_ipv4.address | default(ansible_all_ipv4_addresses[0]) }}"
 
+# Hydra clients
+
+hydra_clients:
+  - client_id: default-client
+    client_name: Default client
+    redirect_uris: ["{{ public_scheme }}://{{ public_host }}"]
+
 # Hydra Passwordless configuration
 
 enable_hydra_passwordless: yes
diff --git a/tasks/main.yml b/tasks/main.yml
index e29db4c..9832521 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -51,6 +51,15 @@
     - Restart HAProxy
   become: true
 
+- name: Create hydra-clients
+  template:
+    src: hydra-client.json.j2
+    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
+  with_items: "{{ hydra_clients }}"
+  notify:
+    - Restart cadoles-pod-hydra-v1
+  become: true
+
 - name: Configure cadoles-pod-hydra-v1
   template:
     src: "{{ item.src }}"
diff --git a/tasks/oidc-test.yml b/tasks/oidc-test.yml
index f4fb3cd..2dd1ca9 100644
--- a/tasks/oidc-test.yml
+++ b/tasks/oidc-test.yml
@@ -2,11 +2,16 @@
 
 - name: Create oidc-test OpenID Connect client configuration
   template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
+    src: hydra-client.json.j2
+    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
   with_items:
-    - src: oidc-test-client.json.j2
-      dest: /etc/hydra/clients.d/oidc-test.json
+    - client_id: "{{ oidc_test_app_client_id }}"
+      client_secret: "{{ oidc_test_app_client_secret }}"
+      client_name: "OIDC Test"
+      redirect_uris: ["{{ public_scheme }}://{{ public_host }}:8080/oauth2/callback"]
+      post_logout_redirect_uris: ["{{ public_scheme }}://{{ public_host }}:8080"]
+      logo_uri: https://www.cadoles.com/images/logo.svg
+
   notify:
     - Restart cadoles-pod-hydra-v1
   become: true
diff --git a/templates/hydra-client.json.j2 b/templates/hydra-client.json.j2
new file mode 100644
index 0000000..67c45b8
--- /dev/null
+++ b/templates/hydra-client.json.j2
@@ -0,0 +1,14 @@
+{
+	"client_id": {{ item.client_id | to_json }},
+	"client_name": {{ item.client_name | default(item.client_id) | to_json }},
+	"client_secret": {{ item.client_secret | default(lookup('ansible.builtin.password', '/dev/null chars=ascii_lowercase,digits length=32')) | to_json }},
+	"grant_types": {{ item.grant_types | default(["authorization_code","refresh_token"]) | to_json }},
+	"jwks": {},
+	"metadata": {},
+	"post_logout_redirect_uris": {{ item.post_logout_redirect_uris | default([]) | to_json }},
+	"redirect_uris": {{ item.redirect_uris | default([]) | to_json }},
+	"response_types": {{ item.response_types | default(["code"]) | to_json }},
+	"logo_uri": {{ item.logo_uri | default("") | to_json }},
+	"scope": {{ item.scope | default("openid profile email") | to_json }},
+	"token_endpoint_auth_method": {{ item.token_endpoint_auth_method | default("client_secret_post") | to_json }}
+}
\ No newline at end of file
diff --git a/templates/oidc-test-client.json.j2 b/templates/oidc-test-client.json.j2
deleted file mode 100644
index 22aaa61..0000000
--- a/templates/oidc-test-client.json.j2
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-	"client_id": "{{ oidc_test_app_client_id }}",
-	"client_name": "OIDC Test",
-	"client_secret": "{{ oidc_test_app_client_secret }}",
-	"grant_types": [
-		"authorization_code",
-		"refresh_token"
-	],
-	"jwks": {},
-	"metadata": {},
-	"post_logout_redirect_uris": ["{{ public_scheme }}://{{ public_host }}:8080"],
-	"redirect_uris": ["{{ public_scheme }}://{{ public_host }}:8080/oauth2/callback"],
-	"response_types": [
-		"code"
-	],
-	"logo_uri": "https://www.cadoles.com/images/logo.svg",
-	"scope": "openid profile email",
-	"token_endpoint_auth_method": "client_secret_post"
-}
\ No newline at end of file