Repository navigation
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review: 2
Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
3 open findings
What changed in this PR
This PR ensures Keycloak realm templates and realm imports never carry or preserve inherited user credentials, while still retaining user metadata and service-account configuration and requiring admin password setup.
Changes:
- Strip user credentials from shipped realm templates and from realm imports (Rust + remote-deployment script).
- Introduce tenant bootstrap policy to seed only service accounts plus an admin requiring
UPDATE_PASSWORD. - Add regression coverage (Rust unit tests + an isolated Python script test) and operator documentation.
| File | Description |
|---|---|
scripts/test_tenant_bootstrap_configuration.py |
Adds an isolated integration-style regression test for the remote configuration script’s realm sanitization behavior. |
packages/windmill/src/tasks/tenant_bootstrap_admin.rs |
Introduces tenant bootstrap user-retention + admin password-setup policy with tests. |
packages/windmill/src/tasks/mod.rs |
Registers the new tenant bootstrap policy module. |
packages/windmill/src/tasks/insert_tenant.rs |
Applies the tenant bootstrap policy during new tenant realm provisioning. |
packages/windmill/src/services/import/realm_user_credentials.rs |
Adds realm-import credential stripping logic plus focused regression tests. |
packages/windmill/src/services/import/mod.rs |
Registers the new realm credential stripping helper module. |
packages/windmill/src/services/import/import_election_event.rs |
Integrates credential stripping into realm secret removal flow for imports. |
docs/docusaurus/docs/07-developers/06-keycloak/developers_keycloak.md |
Documents tenant bootstrap and operator steps for admin initialization / remediation. |
.devcontainer/remote-deployment/configure-environment.sh |
Strips realm user credentials and enforces admin password update action before provisioning continues. |
.devcontainer/keycloak/import/tenant-90505c8a-23a9-4cdf-a26b-4e19f6a097d5.json |
Removes embedded credentials from the shipped realm template and adds UPDATE_PASSWORD for admin. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Copilot stopped reviewing on behalf of
edulix due to an error
October 9, 2026 18:05
Keep the template's accented text as written, name the realm template and show jq's error when credential removal fails, skip the script test without jq, state the service-account contract in its test, and put the SPDX header before the new import. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The realm template no longer carries the admin password, so the guide now tells the operator to set it in the Keycloak console. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The template's `api-user` stayed enabled in the admin group with no credentials, so a password set on it later would give a working administrator account. Nothing signs in with it; it is now disabled, with a regression test next to the template's no-credentials test. Without template passwords, a fresh devcontainer's `config-cli.sh` could not sign step-cli in as the tenant `admin`, and the dev tooling's `TRUSTEE1_PASSWORD`/`TRUSTEE2_PASSWORD` no longer matched any account. `init-cli.sh` now sources `set-dev-passwords.sh`, which gives the local `admin`, `trustee1` and `trustee2` those development passwords through the Keycloak admin API, only when they have none, and clears the admin's `UPDATE_PASSWORD` action. Deployments are unaffected. Validation: the focused Windmill `realm_user_credentials` and `tenant_bootstrap_admin` tests pass (7). `set-dev-passwords.sh` was run twice against Keycloak 26.0 with a synthetic realm: it set the missing passwords, kept an existing one, changed nothing on the second run, and the admin's password grant then succeeded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Parent issue: https://github.com/sequentech/meta/issues/13842
Realm imports clear user credentials while retaining user metadata and service-account configuration. New tenant provisioning retains client-backed service accounts and an admin requiring password setup, and the shipped template carries no user credentials. Operator guidance covers initial admin setup and existing-account remediation.
Remote configuration strips imported user credentials, requires admin password setup, and aborts on invalid realm JSON. Its two isolated script regressions pass.
Validation: six focused Rust tests, strict Clippy for the actual policy modules, REUSE, formatting, and applicable shell checks pass. The owning Windmill crate compiles and passes both focused filters (six tests total).
Existing deployed accounts and sessions require the documented operator remediation. No deployment or account changes are performed by this PR.