automate dataone realm import into keycloak

[mbjones]

WHen keycloak starts, it creates a master realm automatically, but no realms for managing users. We want to manage all users in our dataone realm, which can be described by a json file and automatically imported into keycloak on startup using the --import-realm flag. Any realms that are found in /opt/keycloak/data/import directory are imported, assuming they follow the naming convention <realmname>-realm.json. For us, this means using dataone-realm.json.

[mbjones]

I exported the dataone-realm.json file and edited it to remove sensitive data. The following sensitive data is templated to be retrieved from outside of the realm file:

• ORCID client-id: templated from .Values.global.orcid.clientId
• ORCID client-secret: from keycloak vault at ${vault.orcid-secret}
• DataONE LDAP admin password: from keycloak vault at ${vault.ldap}
• DataONE ogdc client-secret: from keycloak vault at ${vault.ogdc}

Realm imports for the dataone realm are now working, but are currently configured to only happen if the dataone realm doesn't already exist. This prevents overwriting the realm accidentally -- the realm must be deleted in keycloak manually before the automatic import will succeed, so this is really meant as a way to save and bootstrap the realm.