feat(keycloak): Add keycloak theme, capture university, add ORCid int…

…egration (#971)

We build a custom keycloak theme with keycloakify (which is react based), which gets packaged (like most Keycloak themes) into a .jar file. We then put that jar file into a Docker image which serves just as a directory to store the image, and copies it out into a volume that is also mounted on keycloak in the right place for keycloak to get the theme. Keycloak does indeed gets the theme and uses it as the login theme.

We also enable the declarative_user_profile feature of Keycloak, and use it to capture the user's University / Organisation.

We also add ORCid keycloak integration and capture the ORCid where possible

.github/workflows/e2e-k3d.yml

@@ -4,10 +4,11 @@ on:
   workflow_dispatch:
   push:
     paths:
-      - "website/**"
       - "backend/**"
+      - "keycloak/**"
       - "kubernetes/**"
       - "preprocessing/**"
+      - "website/**"
       - "deploy.py"
       - ".github/scripts/**"
       - ".github/workflows/**"
@@ -80,26 +81,12 @@ jobs:
         run: cd website && npx playwright install-deps
         if: steps.playwright-cache.outputs.cache-hit == 'true'
 
-      - name: Wait for Backend Docker Image
-        uses: lewagon/[email protected]
-        with:
-          ref: ${{ github.sha }}
-          check-name: Build Backend Docker Image
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Wait for Website Docker Image
-        uses: lewagon/[email protected]
-        with:
-          ref: ${{ github.sha }}
-          check-name: Build Website Docker Image
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Deploy with helm
         uses: WyriHaximus/github-action-helm3@v4
         with:
           exec: ./deploy.py --verbose helm --branch ${{ github.ref_name }} --sha ${{ github.sha }} --dockerconfigjson ${{ secrets.GHCR_DOCKER_CONFIG }}
 
-      - name: Wait for the pods to be ready
+      - name: Wait for the pods to be ready (timeout 480s)
         run: ./.github/scripts/wait_for_pods_to_be_ready.py
       - name: Sleep for 20 secs
         run: sleep 20

.github/workflows/keycloakify-build.yml

@@ -0,0 +1,67 @@
+name: keycloakify-build
+
+on:
+  push:
+  workflow_dispatch:
+
+env:
+  DOCKER_IMAGE_NAME: ghcr.io/loculus-project/keycloakify
+
+concurrency:
+  group: ci-${{ github.ref }}-keycloak
+  cancel-in-progress: true
+
+jobs:
+  dockerImage:
+    name: Build keycloakify Docker Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      checks: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate files hash
+        id: files-hash
+        run: |
+          DIR_HASH=$(echo -n ${{ hashFiles('./keycloak/keycloakify/**','.github/workflows/keycloakify-build.yml') }})
+          echo "DIR_HASH=$DIR_HASH" >> $GITHUB_ENV
+      - name: Setup Docker metadata
+        id: dockerMetadata
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.DOCKER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ env.DIR_HASH }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=branch
+            type=sha,prefix=commit-
+      - name: Check if image exists
+        id: check-image
+        run: |
+          EXISTS=$(docker manifest inspect ${{ env.DOCKER_IMAGE_NAME }}:${{ env.DIR_HASH }} > /dev/null 2>&1 && echo "true" || echo "false")
+          echo "CACHE_HIT=$EXISTS" >> $GITHUB_ENV
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push image
+        if: env.CACHE_HIT == 'false'
+        uses: docker/build-push-action@v5
+        with:
+          context: ./keycloak/keycloakify
+          push: true
+          tags: ${{ steps.dockerMetadata.outputs.tags }}
+          cache-from: type=gha,scope=keycloakify=${{ github.ref }}
+          cache-to: type=gha,mode=max,scope=keycloakify=${{ github.ref }}
+      - name: Tag and push image if cache hit
+        if: env.CACHE_HIT == 'true'
+        run: |
+          TAGS=(${{ steps.dockerMetadata.outputs.tags }})
+          for TAG in "${TAGS[@]}"; do
+            docker buildx imagetools create --tag $TAG ${{ env.DOCKER_IMAGE_NAME }}:${{ env.DIR_HASH }}
+          done

keycloak/keycloakify/.gitignore

@@ -0,0 +1,57 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+
+# Runtime data
+pids
+*.pid
+*.seed
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (http://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules
+jspm_packages
+
+# Optional npm cache directory
+.npm
+
+# yarn cache directory
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+
+# Optional REPL history
+.node_repl_history
+
+.vscode
+
+.DS_Store
+
+/dist
+
+/build_keycloak
+/build
+/storybook-static

keycloak/keycloakify/.storybook/main.js

@@ -0,0 +1,16 @@
+module.exports = {
+    "stories": [
+        "../src/**/*.stories.tsx",
+    ],
+    "addons": [
+        "@storybook/addon-links",
+        "@storybook/addon-essentials",
+        "@storybook/addon-interactions",
+        "@storybook/preset-create-react-app"
+    ],
+    "framework": "@storybook/react",
+    "core": {
+        "builder": "@storybook/builder-webpack5"
+    },
+    "staticDirs": ['../public']
+}

keycloak/keycloakify/.storybook/preview.js

@@ -0,0 +1,13 @@
+export const parameters = {
+    actions: {argTypesRegex: "^on[A-Z].*"},
+    controls: {
+        matchers: {
+            color: /(background|color)$/i,
+            date: /Date$/,
+        },
+    },
+    options: {
+        storySort: (a, b) =>
+            a[1].kind === b[1].kind ? 0 : a[1].id.localeCompare(b[1].id, undefined, {numeric: true}),
+    },
+}

keycloak/keycloakify/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:latest as builder
+
+USER root
+RUN apt-get update && apt-get install -y maven
+
+WORKDIR /app
+COPY package.json yarn.lock ./
+RUN yarn
+COPY . .
+RUN yarn build-keycloak-theme
+
+FROM alpine:latest
+RUN mkdir /output
+COPY --from=builder /app/build_keycloak/target/*.jar /output/
+RUN apk add --no-cache wget curl
+RUN wget -P /output https://github.com/eosc-kc/keycloak-orcid/releases/download/1.2.0/keycloak-orcid-1.2.0.jar
+RUN ls -l /output
+CMD sh -c 'cp /output/*.jar /destination/'

keycloak/keycloakify/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+This license applies specifically to this directory
+
+Copyright (c) 2020 GitHub user u/garronej
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

keycloak/keycloakify/README.md

@@ -0,0 +1,14 @@
+# Keycloakify theme
+
+This is a keycloak theme, built with keycloakify, and branched from https://github.com/keycloakify/keycloakify-starter
+
+
+To preview in the storybook:
+```
+yarn # install dependencies (it's like npm install)
+yarn storybook 
+```
+
+To build a JAR and package it into an image that copies it to an output directory, build the Dockerfile. (This is done by CI).
+
+

keycloak/keycloakify/package.json

@@ -0,0 +1,77 @@
+{
+    "name": "loculus-keycloak-theme",
+    "version": "0.0.1",
+    "description": "Adapted from keycloakify-starter",
+    "scripts": {
+        "start": "copy-keycloak-resources-to-public && react-scripts start",
+        "storybook": "copy-keycloak-resources-to-public && start-storybook -p 6006",
+        "build": "react-scripts build && rimraf build/keycloak-resources",
+        "build-keycloak-theme": "yarn build && keycloakify"
+    },
+    "keycloakify": {
+        "themeName": "loculus",
+        "extraThemeProperties": [
+            "foo=bar"
+        ]
+    },
+    "author": "u/garronej",
+    "license": "MIT",
+    "keywords": [],
+    "dependencies": {
+        "evt": "^2.5.7",
+        "keycloakify": "^9.3.0",
+        "react": "18.1.0",
+        "react-dom": "18.1.0"
+    },
+    "devDependencies": {
+        "@storybook/addon-actions": "^6.5.16",
+        "@storybook/addon-essentials": "^6.5.16",
+        "@storybook/addon-interactions": "^6.5.16",
+        "@storybook/addon-links": "^6.5.16",
+        "@storybook/builder-webpack5": "^6.5.16",
+        "@storybook/manager-webpack5": "^6.5.16",
+        "@storybook/node-logger": "^6.5.16",
+        "@storybook/preset-create-react-app": "^4.1.2",
+        "@storybook/react": "^6.5.16",
+        "@storybook/testing-library": "^0.0.13",
+        "@types/node": "^15.3.1",
+        "@types/react": "18.0.9",
+        "@types/react-dom": "18.0.4",
+        "react-scripts": "5.0.1",
+        "rimraf": "^5.0.5",
+        "typescript": "~4.7.0"
+    },
+    "eslintConfig": {
+        "extends": [
+            "react-app",
+            "react-app/jest"
+        ],
+        "rules": {
+            "react-hooks/exhaustive-deps": "off",
+            "@typescript-eslint/no-redeclare": "off",
+            "no-labels": "off"
+        },
+        "overrides": [
+            {
+                "files": [
+                    "**/*.stories.*"
+                ],
+                "rules": {
+                    "import/no-anonymous-default-export": "off"
+                }
+            }
+        ]
+    },
+    "browserslist": {
+        "production": [
+            ">0.2%",
+            "not dead",
+            "not op_mini all"
+        ],
+        "development": [
+            "last 1 chrome version",
+            "last 1 firefox version",
+            "last 1 safari version"
+        ]
+    }
+}

keycloak/keycloakify/public/fonts/WorkSans/font.css

@@ -0,0 +1,39 @@
+/*
+<link rel="preload" href="%PUBLIC_URL%/fonts/WorkSans/worksans-bold-webfont.woff2" as="font" crossorigin="anonymous">
+<link rel="preload" href="%PUBLIC_URL%/fonts/WorkSans/worksans-medium-webfont.woff2" as="font" crossorigin="anonymous">
+<link rel="preload" href="%PUBLIC_URL%/fonts/WorkSans/worksans-regular-webfont.woff2" as="font" crossorigin="anonymous">
+<link rel="preload" href="%PUBLIC_URL%/fonts/WorkSans/worksans-semibold-webfont.woff2" as="font" crossorigin="anonymous">
+<link rel="stylesheet" type="text/css" href="%PUBLIC_URL%/fonts/WorkSans/font.css">
+*/
+
+@font-face {
+  font-family: "Work Sans";
+  font-style: normal;
+  font-weight: normal; /*400*/
+  font-display: swap;
+  src: url("./worksans-regular-webfont.woff2") format("woff2");
+}
+
+@font-face {
+  font-family: "Work Sans";
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url("./worksans-medium-webfont.woff2") format("woff2");
+}
+
+@font-face {
+  font-family: "Work Sans";
+  font-style: normal;
+  font-weight: 600;
+  font-display: swap;
+  src: url("./worksans-semibold-webfont.woff2") format("woff2");
+}
+
+@font-face {
+  font-family: "Work Sans";
+  font-style: normal;
+  font-weight: bold; /*700*/
+  font-display: swap;
+  src: url("./worksans-bold-webfont.woff2") format("woff2");
+}