Skip to content

✨ Keycloak: Configuration to support multiple certificates in Election Event#2570

Open
BelSequent wants to merge 53 commits intomainfrom
feat/meta-11110-pending/main
Open

✨ Keycloak: Configuration to support multiple certificates in Election Event#2570
BelSequent wants to merge 53 commits intomainfrom
feat/meta-11110-pending/main

Conversation

@BelSequent
Copy link
Copy Markdown
Contributor

Copilot AI review requested due to automatic review settings March 30, 2026 10:33
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Keycloak voting-portal theme to conditionally show the certificate (mTLS) login entry point based on a realm-level policy flag, aligning the login UI with election-event certificate configuration.

Changes:

  • Gate the certificate login option behind realm.attributes['voter-digital-cert-policy'] == 'enabled'.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 31, 2026

PR Preview Action v1.8.1

QR code for preview link

🚀 View preview at
https://docs.sequentech.io/docusaurus/pr-preview/pr-2570/

Built to branch doc-previews at 2026-04-16 13:57 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 112 out of 114 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

hasura/metadata/databases/backend-db/tables/sequent_backend_certificate_authority.yaml:116

  • Hasura permissions for certificate_authority are now completely unscoped (check: {} / filter: {}) for ca-read, ca-write, and election-event-cas-tab. This means anyone with these roles can read/insert/delete all certificate authorities across the whole database. If the intent is to restrict CA management to a supertenant/admin context, consider removing the election-event-cas-tab select permission here and adding a tighter filter (or moving CA management to a separate table/schema with explicit supertenant-only roles).
insert_permissions:
    - comment: ""
      permission:
          check: {}
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - pem
      role: admin-user
    - comment: ""
      permission:
          check: {}
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - pem
              - created_at
      role: service-account
select_permissions:
    - comment: ""
      permission:
          allow_aggregations: true
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - pem
              - created_at
          filter: {}
      role: admin-user
    - comment: ""
      permission:
          allow_aggregations: true
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - created_at
              - pem
          filter: {}
      role: ca-read
    - comment: ""
      permission:
          allow_aggregations: true
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - created_at
              - pem
          filter: {}
      role: election-event-cas-tab
    - comment: ""
      permission:
          columns:
              - id
              - common_name
              - subject
              - issuer_common_name
              - issuer
              - not_before
              - not_after
              - fingerprint_sha256
              - serial_number
              - pem
              - created_at
          filter: {}
      role: service-account
delete_permissions:
    - comment: ""
      permission:
          filter: {}
      role: admin-user
    - comment: ""
      permission:
          filter: {}
      role: ca-write
    - comment: ""
      permission:
          filter: {}
      role: service-account

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .devcontainer/keycloak-nginx/keycloak-mtls.conf.template Outdated
Comment thread hasura/metadata/actions.yaml Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants