snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/build/docker/keycloak/README.md

@@ -0,0 +1,39 @@
+# Keycloak development environment
+
+## Setting up
+
+### OpenID
+
+Overwrite your `OpenIdSettings` section in your config.json file by running `make config-openid` and restarting your server.
+
+- [Official OpenID with Keycloak documentation](https://docs.mattermost.com/onboard/sso-openidconnect.html)
+
+### SAML
+
+Overwrite your `SamlSettings` section in your config.json file by running `make config-saml` and restarting your server.
+
+- [Official SAML with Keycloak documentation](https://docs.mattermost.com/onboard/sso-saml-keycloak.html)
+
+### LDAP
+
+Overwrite your `LdapSettings` section in your config.json file by running `make config-ldap` and restarting your server.
+
+- [Official LDAP with Keycloak documentation](https://docs.mattermost.com/onboard/ad-ldap.html)
+
+## Credentials to log in
+
+- **Admin account**, used to log in to the Keycloak Admin UI:
+  - `admin`/`admin`
+
+- **User accounts**, used to log in to Mattermost:
+  - `homer`/`password`
+  - `marge`/`password`
+  - `lisa`/`password`
+
+## Updating the `realm-export.json`
+
+The `realm-export.json` file is automatically imported by the keycloak development container. If you make any modifications to this file or to the base configuration, export it by running a terminal in the container and running:
+
+```bash
+/opt/keycloak/bin/kc.sh export --realm mattermost --users realm_file --file /opt/keycloak/data/import/realm-export.json
+```

server/build/docker/keycloak/kc-healthcheck.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -eu -o pipefail
+
+/opt/keycloak/bin/kcadm.sh config credentials -x --server http://localhost:8080 --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD"
+/opt/keycloak/bin/kcadm.sh get realms/mattermost >/dev/null

server/build/docker/keycloak/keycloak.crt

@@ -0,0 +1,3 @@
+-----BEGIN CERTIFICATE-----
+MIICozCCAYsCBgGNzWfMwjANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDAptYXR0ZXJtb3N0MB4XDTI0MDIyMTIwNDA0OFoXDTM0MDIyMTIwNDIyOFowFTETMBEGA1UEAwwKbWF0dGVybW9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOnsgNexkO5tbKkFXN+SdMUuLHbqdjZ9/JSnKrYPHLarf8801YDDzV8wI9jjdCCgq+xtKFKWlwU2rGpjPbefDLV1m7CSu0Iq+hNxDiBdX3wkEIK98piDpx+xYGL0aAbXn3nAlqFOWQJLKLM1I65ZmK31YZeVj4Kn01W4WfsvKHoxPjLPwPTug4HB6vaQXqEpzYYYHyuJKvIYNuVwo0WQdaPRXb0poZoYzOnoB6tOFrim6B7/chqtZeXQc7h6/FejBsV59aO5uATI0aAJw1twzjCNIiOeJLB2jlLuIMR3/Yaqr8IRpRXzcRPETpisWNilhV07ZBW0YL9ZwuU4sHWy+iMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAW4I1egm+czdnnZxTtth3cjCmLg/UsalUDKSfFOLAlnbe6TtVhP4DpAl+OaQO4+kdEKemLENPmh4ddaHUjSSbbCQZo8B7IjByEe7x3kQdj2ucQpA4bh0vGZ11pVhk5HfkGqAO+UVNQsyLpTmWXQ8SEbxcw6mlTM4SjuybqaGOva1LBscI158Uq5FOVT6TJaxCt3dQkBH0tK+vhRtIM13pNZ/+SFgecn16AuVdBfjjqXynefrSihQ20BZ3NTyjs/N5J2qvSwQ95JARZrlhfiS++L81u2N/0WWni9cXmHsdTLxRrDZjz2CXBNeFOBRio74klSx8tMK27/2lxMsEC7R+DA==
+-----END CERTIFICATE-----

server/build/docker/keycloak/ldap.mmsettings.json

@@ -0,0 +1,36 @@
+{
+    "LdapSettings": {
+        "Enable": true,
+        "EnableSync": false,
+        "LdapServer": "localhost",
+        "LdapPort": 389,
+        "ConnectionSecurity": "",
+        "BaseDN": "dc=mm,dc=test,dc=com",
+        "BindUsername": "cn=admin,dc=mm,dc=test,dc=com",
+        "BindPassword": "mostest_password",
+        "UserFilter": "",
+        "GroupFilter": "",
+        "GuestFilter": "",
+        "EnableAdminFilter": false,
+        "AdminFilter": "",
+        "GroupDisplayNameAttribute": "cn",
+        "GroupIdAttribute": "entryUUID",
+        "FirstNameAttribute": "cn",
+        "LastNameAttribute": "sn",
+        "EmailAttribute": "mail",
+        "UsernameAttribute": "uid",
+        "NicknameAttribute": "cn",
+        "IdAttribute": "uid",
+        "PositionAttribute": "title",
+        "LoginIdAttribute": "uid",
+        "PictureAttribute": "",
+        "SyncIntervalMinutes": 60,
+        "SkipCertificateVerification": false,
+        "PublicCertificateFile": "",
+        "PrivateKeyFile": "",
+        "QueryTimeout": 60,
+        "MaxPageSize": 0,
+        "LoginFieldName": "",
+        "Trace": false
+    }
+}

server/build/docker/keycloak/openid.mmsettings.json

@@ -0,0 +1,14 @@
+{
+    "OpenIdSettings": {
+        "Enable": true,
+        "Secret": "9Y7dykcoA9luTC77XtXxOu9UbNx3rhj6",
+        "Id": "mattermost-openid",
+        "Scope": "profile openid email",
+        "AuthEndpoint": "",
+        "TokenEndpoint": "",
+        "UserAPIEndpoint": "",
+        "DiscoveryEndpoint": "http://localhost:8484/realms/mattermost/.well-known/openid-configuration",
+        "ButtonText": "Login using OpenID",
+        "ButtonColor": "#ffaa4c"
+    }
+}

server/build/docker/keycloak/saml.mmsettings.json

@@ -0,0 +1,35 @@
+{
+    "SamlSettings": {
+        "Enable": true,
+        "EnableSyncWithLdap": false,
+        "EnableSyncWithLdapIncludeAuth": false,
+        "IgnoreGuestsLdapSync": false,
+        "Verify": false,
+        "Encrypt": false,
+        "SignRequest": false,
+        "IdpURL": "http://localhost:8484/realms/mattermost/protocol/saml",
+        "IdpDescriptorURL": "http://localhost:8484/realms/mattermost",
+        "IdpMetadataURL": "http://localhost:8484/realms/mattermost/protocol/saml/descriptor",
+        "ServiceProviderIdentifier": "mattermost",
+        "AssertionConsumerServiceURL": "http://localhost:8065/login/sso/saml",
+        "SignatureAlgorithm": "RSAwithSHA256",
+        "CanonicalAlgorithm": "Canonical1.0",
+        "ScopingIDPProviderId": "",
+        "ScopingIDPName": "",
+        "IdpCertificateFile": "saml-idp.crt",
+        "PublicCertificateFile": "",
+        "PrivateKeyFile": "",
+        "IdAttribute": "id",
+        "GuestAttribute": "",
+        "EnableAdminAttribute": false,
+        "AdminAttribute": "",
+        "FirstNameAttribute": "givenName",
+        "LastNameAttribute": "surname",
+        "EmailAttribute": "email",
+        "UsernameAttribute": "username",
+        "NicknameAttribute": "",
+        "LocaleAttribute": "",
+        "PositionAttribute": "",
+        "LoginButtonText": "SAML"
+    }
+}