Allow pushing user-allocation membership to Keycloak by QuanMPhm · Pull Request #249 · nerc-project/coldfront-plugin-cloud

QuanMPhm · 2025-10-03T20:29:45Z

Closes nerc-project/operations#948. More details in the commit message
There are still some questions I have below, so this is still a draft for now.

QuanMPhm · 2025-10-03T20:30:01Z

src/coldfront_plugin_cloud/kc_client.py

+
+    def get_user_id(self, cf_username) -> str | None:
+        """Return None if user not found"""
+        # TODO (Quan): Confirm that Coldfront usernames map to Keycloak emails, not email, or something else?


@knikolla @naved001

@QuanMPhm Coldfront usernames map to Keycloak usernames, not emails.

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py

QuanMPhm · 2025-10-06T17:42:21Z

@knikolla Two more questions:

Do we also want validate_allocations to add PIs to Keycloak groups for pre-existing allocations?
When a PI adds a user to an Coldfront project or allocation, do those users also get added to a the project's Keycloak group?

src/coldfront_plugin_cloud/kc_client.py

src/coldfront_plugin_cloud/tasks.py

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py

QuanMPhm · 2025-10-30T19:07:52Z

@knikolla I've addressed your comments except one. Also, do you have responses to these questions?

QuanMPhm · 2025-11-04T18:16:15Z

src/coldfront_plugin_cloud/base.py

+    def assign_role_on_user(self, username, project_id):
+        self.kc_admin_client.create_group(project_id)
+        if user_id := self.kc_admin_client.get_user_id(username):
+            group_id = self.kc_admin_client.get_group_id(project_id)
+            self.kc_admin_client.add_user_to_group(user_id, group_id)
+        else:
+            logger.warning(
+                f"User {username} not found in Keycloak, cannot add to group."
+            )
+
+    def remove_role_from_user(self, username, project_id):
+        user_id = self.kc_admin_client.get_user_id(username)
+        group_id = self.kc_admin_client.get_group_id(project_id)
+        self.kc_admin_client.remove_user_from_group(user_id, group_id)
+


@knikolla @naved001 The Openstack functional tests are failing because the plugin tries to add the coldfront-swift-init user to Openstack projects. The user is added to the cluster proejct, but since they're not registered on Keycloak, they're not added to the Keycloak group. This causes remove_role_from_user() in src/coldfront_plugin_cloud/base.py to raise an 404 error when it uses the Keycloak API to add a non-existant user to a group.

This can be resolved if we allow remove_role_from_user() to ignore if the user is not found, which was the agreed behavior for assign_role_on_user(). Is that acceptable?

knikolla · 2026-03-18T13:22:44Z

@QuanMPhm please resolve conflicts. Are there any questions that I missed answering?

QuanMPhm · 2026-03-20T12:18:01Z

@knikolla Just this one. I will resolve the conflicts while waiting for your answer

knikolla · 2026-03-20T14:49:39Z

@knikolla Just this one. I will resolve the conflicts while waiting for your answer

Responded.

A Keycloak admin client has been added When `activate_allocation` is called, the user is added to a Keycloak group named after the project ID on the remote cluster. If the user does not already exist in Keycloak, the case is ignored for now Authentication to Keycloak is done via client credentials grant When `deactivate_allocation` is called, the user is removed from the Keycloak group Unit tests have been updated to remove dependancy on Keycloak A comment in `validate_allocations` has been updated to reflect the more restrictive validation behavior, where users on cluster projects will be removed if they are not part of the Coldfront allocation (rather than if they are not registered on Coldfront at all). This is relevant for functional tests for this new feature.

knikolla · 2026-03-23T19:15:03Z

src/coldfront_plugin_cloud/openshift.py

            # Role already exists, ignore
            pass

+        super().assign_role_on_user(username, project_id)


Instead of the resource allocators, I think this should be handled in

coldfront-plugin-cloud/src/coldfront_plugin_cloud/tasks.py

Line 89 in 0bfb505

def add_user_to_allocation(allocation_user_pk):

knikolla · 2026-03-23T19:21:25Z

src/coldfront_plugin_cloud/base.py

        return user

+    def assign_role_on_user(self, username, project_id):
+        self.kc_admin_client.create_group(project_id)


Instead of using the group ID, how about introducing a new Resource Attribute to Resources that accepts a format string. For example defaulting to "{resource_name}/{project_name}"

This would allow operator to specify their own format for group names for the clusters.

So you'd read the resource attribute and then call format on the string providing a few documented options for the available variables.

>>> template = "{resource_name}/{project_name}" >>> group = template.format(**{"resource_name": "NERC-OCP", "project_name": "1234"} ... ) >>> >>> group 'NERC-OCP/1234'

knikolla

Did a quick first pass and provided some comments.

Also this needs to be possible configurable via a setting.

knikolla · 2026-03-23T19:48:36Z

@QuanMPhm Actually, another thought, do you think it would make sense to implement this in the Keycloak plugin? https://github.com/nerc-project/coldfront-plugin-keycloak

It could listen to signals in the same way that the cloud plugin listens to signals. It already has a keycloak client implemented.

And there is nothing in pushing users to a Keycloak group that is specific to either OpenShift or OpenStack.

QuanMPhm · 2026-03-24T16:10:47Z

@knikolla I see that it does make sense to seperate the Keycloak functionality from the rest of the plugin. It makes sense to me. I forgot that repo existed. There would need to be some overhaul to add integration and unit tests to coldfront-plugin-keycloak. Is that fine?

knikolla · 2026-03-25T13:43:53Z

@knikolla I see that it does make sense to seperate the Keycloak functionality from the rest of the plugin. It makes sense to me. I forgot that repo existed. There would need to be some overhaul to add integration and unit tests to coldfront-plugin-keycloak. Is that fine?

For now let's keep it here (as not to frontload the work) and we can easily split it out later if needed. Perhaps try implementing it here via signals so as to keep it loosely coupled so that if we need to split it later it doesn't require a lot of uncoupling.

QuanMPhm requested review from knikolla, larsks and naved001 October 3, 2025 20:29

QuanMPhm commented Oct 3, 2025

View reviewed changes

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py Outdated Show resolved Hide resolved

QuanMPhm force-pushed the ops_948/auth_kc branch from 9a53156 to d7da5c4 Compare October 5, 2025 01:32

QuanMPhm marked this pull request as draft October 6, 2025 17:42

knikolla mentioned this pull request Oct 6, 2025

Kristi does Code Reviews (Week of 2025-10-06 and 13) CCI-MOC/ops-issues#1624

Closed

4 tasks

knikolla requested changes Oct 21, 2025

View reviewed changes

src/coldfront_plugin_cloud/kc_client.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/tasks.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py Outdated Show resolved Hide resolved

QuanMPhm force-pushed the ops_948/auth_kc branch from d7da5c4 to 3b80589 Compare October 30, 2025 19:03

QuanMPhm requested a review from knikolla October 30, 2025 19:03

QuanMPhm force-pushed the ops_948/auth_kc branch from 3b80589 to cb1d628 Compare November 4, 2025 18:06

QuanMPhm commented Nov 4, 2025

View reviewed changes

joachimweyl mentioned this pull request Nov 6, 2025

Kristi reviews automatic approval of allocation change requests CCI-MOC/ops-issues#1637

Open

3 tasks

QuanMPhm force-pushed the ops_948/auth_kc branch 2 times, most recently from a217f31 to 0358cb7 Compare March 20, 2026 20:28

QuanMPhm marked this pull request as ready for review March 20, 2026 20:41

QuanMPhm force-pushed the ops_948/auth_kc branch from 0358cb7 to 8fc4ea6 Compare March 20, 2026 20:51

knikolla reviewed Mar 23, 2026

View reviewed changes

knikolla requested changes Mar 23, 2026

View reviewed changes

Conversation

QuanMPhm commented Oct 3, 2025

Uh oh!

QuanMPhm Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

knikolla Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

QuanMPhm commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

QuanMPhm commented Oct 30, 2025

Uh oh!

QuanMPhm Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

knikolla Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

knikolla commented Mar 18, 2026

Uh oh!

QuanMPhm commented Mar 20, 2026

Uh oh!

knikolla commented Mar 20, 2026

Uh oh!

knikolla Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

knikolla Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

knikolla left a comment

Choose a reason for hiding this comment

Uh oh!

knikolla commented Mar 23, 2026

Uh oh!

QuanMPhm commented Mar 24, 2026

Uh oh!

knikolla commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

QuanMPhm commented Oct 6, 2025 •

edited

Loading