Allow pushing user-allocation membership to Keycloak by QuanMPhm · Pull Request #249 · nerc-project/coldfront-plugin-cloud

QuanMPhm · 2025-10-03T20:29:45Z

Closes nerc-project/operations#948. More details in the commit message
There are still some questions I have below, so this is still a draft for now.

src/coldfront_plugin_cloud/kc_client.py

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py

QuanMPhm · 2025-10-06T17:42:21Z

@knikolla Two more questions:

Do we also want validate_allocations to add PIs to Keycloak groups for pre-existing allocations?
When a PI adds a user to an Coldfront project or allocation, do those users also get added to a the project's Keycloak group?

src/coldfront_plugin_cloud/kc_client.py

src/coldfront_plugin_cloud/tasks.py

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py

QuanMPhm · 2025-10-30T19:07:52Z

@knikolla I've addressed your comments except one. Also, do you have responses to these questions?

src/coldfront_plugin_cloud/base.py

knikolla · 2026-03-18T13:22:44Z

@QuanMPhm please resolve conflicts. Are there any questions that I missed answering?

QuanMPhm · 2026-03-20T12:18:01Z

@knikolla Just this one. I will resolve the conflicts while waiting for your answer

knikolla · 2026-03-20T14:49:39Z

@knikolla Just this one. I will resolve the conflicts while waiting for your answer

Responded.

src/coldfront_plugin_cloud/openshift.py

src/coldfront_plugin_cloud/base.py

knikolla

Did a quick first pass and provided some comments.

Also this needs to be possible configurable via a setting.

knikolla · 2026-03-23T19:48:36Z

@QuanMPhm Actually, another thought, do you think it would make sense to implement this in the Keycloak plugin? https://github.com/nerc-project/coldfront-plugin-keycloak

It could listen to signals in the same way that the cloud plugin listens to signals. It already has a keycloak client implemented.

And there is nothing in pushing users to a Keycloak group that is specific to either OpenShift or OpenStack.

QuanMPhm · 2026-03-24T16:10:47Z

@knikolla I see that it does make sense to seperate the Keycloak functionality from the rest of the plugin. It makes sense to me. I forgot that repo existed. There would need to be some overhaul to add integration and unit tests to coldfront-plugin-keycloak. Is that fine?

knikolla · 2026-03-25T13:43:53Z

@knikolla I see that it does make sense to seperate the Keycloak functionality from the rest of the plugin. It makes sense to me. I forgot that repo existed. There would need to be some overhaul to add integration and unit tests to coldfront-plugin-keycloak. Is that fine?

For now let's keep it here (as not to frontload the work) and we can easily split it out later if needed. Perhaps try implementing it here via signals so as to keep it loosely coupled so that if we need to split it later it doesn't require a lot of uncoupling.

QuanMPhm · 2026-04-06T22:23:28Z

@knikolla @larsks I have a question about the Coldfront Keycloak PR. I know we previously decided to represent user-membership to an allocation by adding them to a Keycloak group with the same name as the ALLOCATION_PROJECT_ID . Would it make more sense for the group name to be the allocation's ID on Coldfront instead? This has a stronger guarantee of uniqueness, and we won't have to disambiguate for projects with the same name in different clusters. Developers or tools can correlate the allocation id to the on-cluster project id by using the Coldfront API.

knikolla · 2026-04-06T22:26:29Z

@knikolla @larsks I have a question about the Coldfront Keycloak PR. I know we previously decided to represent user-membership to an allocation by adding them to a Keycloak group with the same name as the ALLOCATION_PROJECT_ID . Would it make more sense for the group name to be the allocation's ID on Coldfront instead? This has a stronger guarantee of uniqueness, and we won't have to disambiguate for projects with the same name in different clusters. Developers or tools can correlate the allocation id to the on-cluster project id by using the Coldfront API.

See my comment here #249 (comment)

QuanMPhm · 2026-04-07T19:09:00Z

@knikolla @larsks I have revised the PR and made the Keycloak integration a toggle-able feature. Calls to the Keycloak API is now triggered through signals. I have questions below that I think would be of interest to you both

src/coldfront_plugin_cloud/tasks.py

knikolla

Quick first pass for direction feedback.

src/coldfront_plugin_cloud/signals.py

src/coldfront_plugin_cloud/tasks.py

src/coldfront_plugin_cloud/kc_client.py

knikolla

Looking much better. Almost there.

A follow-up to this (after we merge the validate_allocations refactor) should investigate how to cleanly implement this in validate_allocations too.

knikolla · 2026-04-07T20:58:22Z

src/coldfront_plugin_cloud/attributes.py

    CloudResourceAttribute(name=RESOURCE_PROJECT_DOMAIN),
    CloudResourceAttribute(name=RESOURCE_ROLE),
    CloudResourceAttribute(name=RESOURCE_QUOTA_RESOURCES),
+    CloudResourceAttribute(name=RESOURCE_KEYSTONE_GROUP_TEMPLATE),


Keycloak :)

knikolla · 2026-04-07T21:04:06Z

Looking much better. Almost there.

A follow-up to this (after we merge the validate_allocations refactor) should investigate how to cleanly implement this in validate_allocations too.

Actually... I would make it a whole separate CLI command. validate_keycloak_groups.

A Keycloak admin client has been added When `activate_allocation` is called, the user is added to a Keycloak group named using a format string defined in the allocation's resource attribute "Format String for Keystone Group Names" If the user does not already exist in Keycloak, the case is ignored for now Keycloak integration is optional, toggled by setting the env var "KEYCLOAK_BASE_URL" Authentication to Keycloak is done via client credentials grant When `deactivate_allocation` is called, the user is removed from the Keycloak group New functional test added for Keycloak integration A comment in `validate_allocations` has been updated to reflect the more restrictive validation behavior, where users on cluster projects will be removed if they are not part of the Coldfront allocation (rather than if they are not registered on Coldfront at all).

QuanMPhm · 2026-04-08T02:37:21Z

@knikolla I've allowed the group name template string to accept any allocation attribute. Further documentation is in the docstring for the function _get_keycloak_group_name

knikolla · 2026-04-08T17:55:33Z

@naved001 would appreciate a pass from you.

knikolla

Had some more time to think about how to expose enabling/disable the feature.

knikolla · 2026-04-09T16:26:59Z

src/coldfront_plugin_cloud/tasks.py

+        attributes.RESOURCE_KEYCLOAK_GROUP_TEMPLATE
+    )
+    if group_name_template is None:
+        logger.warning(


I had some more time to think about this. Instead of logging a warning, log an info message here, this way the presence of the Keycloak Group Template Resource Attribute can act as a flag for enabling the feature for each specific Resource individually.

Therefore also switch the order so that the group template is parsed before you look up the user.

Keycloak enabled but no group name template specified for resource <>. Skipping addition to Keycloak group.

knikolla · 2026-04-09T16:27:42Z

src/coldfront_plugin_cloud/tasks.py

+        attributes.RESOURCE_KEYCLOAK_GROUP_TEMPLATE
+    )
+    if group_name_template is None:
+        logger.warning(


Same comment as from addition.

QuanMPhm requested review from knikolla, larsks and naved001 October 3, 2025 20:29

QuanMPhm commented Oct 3, 2025

View reviewed changes

src/coldfront_plugin_cloud/kc_client.py Outdated Show resolved Hide resolved

QuanMPhm commented Oct 3, 2025

View reviewed changes

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py Outdated Show resolved Hide resolved

QuanMPhm force-pushed the ops_948/auth_kc branch from 9a53156 to d7da5c4 Compare October 5, 2025 01:32

QuanMPhm marked this pull request as draft October 6, 2025 17:42

knikolla mentioned this pull request Oct 6, 2025

Kristi does Code Reviews (Week of 2025-10-06 and 13) CCI-MOC/ops-issues#1624

Closed

4 tasks

knikolla requested changes Oct 21, 2025

View reviewed changes

src/coldfront_plugin_cloud/kc_client.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/tasks.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/tests/functional/openshift/test_allocation.py Outdated Show resolved Hide resolved

QuanMPhm force-pushed the ops_948/auth_kc branch from d7da5c4 to 3b80589 Compare October 30, 2025 19:03

QuanMPhm requested a review from knikolla October 30, 2025 19:03

QuanMPhm force-pushed the ops_948/auth_kc branch from 3b80589 to cb1d628 Compare November 4, 2025 18:06

QuanMPhm commented Nov 4, 2025

View reviewed changes

src/coldfront_plugin_cloud/base.py Outdated Show resolved Hide resolved

joachimweyl mentioned this pull request Nov 6, 2025

Kristi reviews automatic approval of allocation change requests CCI-MOC/ops-issues#1637

Open

3 tasks

QuanMPhm force-pushed the ops_948/auth_kc branch 2 times, most recently from a217f31 to 0358cb7 Compare March 20, 2026 20:28

QuanMPhm marked this pull request as ready for review March 20, 2026 20:41

QuanMPhm force-pushed the ops_948/auth_kc branch from 0358cb7 to 8fc4ea6 Compare March 20, 2026 20:51

knikolla reviewed Mar 23, 2026

View reviewed changes

src/coldfront_plugin_cloud/openshift.py Outdated Show resolved Hide resolved

knikolla reviewed Mar 23, 2026

View reviewed changes

src/coldfront_plugin_cloud/base.py Outdated Show resolved Hide resolved

knikolla requested changes Mar 23, 2026

View reviewed changes

QuanMPhm force-pushed the ops_948/auth_kc branch 2 times, most recently from 96e371c to 97d7220 Compare April 7, 2026 18:58

QuanMPhm requested a review from knikolla April 7, 2026 19:06

QuanMPhm commented Apr 7, 2026

View reviewed changes

src/coldfront_plugin_cloud/tasks.py Outdated Show resolved Hide resolved

QuanMPhm commented Apr 7, 2026

View reviewed changes

src/coldfront_plugin_cloud/tasks.py Outdated Show resolved Hide resolved

knikolla requested changes Apr 7, 2026

View reviewed changes

src/coldfront_plugin_cloud/signals.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/tasks.py Outdated Show resolved Hide resolved

src/coldfront_plugin_cloud/kc_client.py Outdated Show resolved Hide resolved

QuanMPhm force-pushed the ops_948/auth_kc branch from 97d7220 to 151aea2 Compare April 7, 2026 20:53

knikolla requested changes Apr 7, 2026

View reviewed changes

QuanMPhm force-pushed the ops_948/auth_kc branch from 151aea2 to d3087ea Compare April 8, 2026 02:35

QuanMPhm requested a review from knikolla April 8, 2026 14:38

knikolla requested changes Apr 9, 2026

View reviewed changes

Conversation

QuanMPhm commented Oct 3, 2025

Uh oh!

Uh oh!

Uh oh!

QuanMPhm commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

QuanMPhm commented Oct 30, 2025

Uh oh!

Uh oh!

knikolla commented Mar 18, 2026

Uh oh!

QuanMPhm commented Mar 20, 2026

Uh oh!

knikolla commented Mar 20, 2026

Uh oh!

Uh oh!

Uh oh!

knikolla left a comment

Choose a reason for hiding this comment

Uh oh!

knikolla commented Mar 23, 2026

Uh oh!

QuanMPhm commented Mar 24, 2026

Uh oh!

knikolla commented Mar 25, 2026

Uh oh!

QuanMPhm commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

knikolla commented Apr 6, 2026

Uh oh!

QuanMPhm commented Apr 7, 2026

Uh oh!

Uh oh!

Uh oh!

knikolla left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

knikolla left a comment

Choose a reason for hiding this comment

Uh oh!

knikolla Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

knikolla commented Apr 7, 2026

Uh oh!

QuanMPhm commented Apr 8, 2026

Uh oh!

knikolla commented Apr 8, 2026

Uh oh!

knikolla left a comment

Choose a reason for hiding this comment

Uh oh!

knikolla Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

knikolla Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

QuanMPhm commented Oct 6, 2025 •

edited

Loading

QuanMPhm commented Apr 6, 2026 •

edited

Loading