separate idp and other vault stores

initialize_idp.py

@@ -0,0 +1,23 @@
+import json
+import os
+from authx.auth import add_provider_to_opa, get_user_id
+import sys
+
+## Updates Vault's opa service store with the information for our IDP
+
+token = None
+try:
+    if os.path.isfile('/app/bearer.txt'):
+        with open('/app/bearer.txt') as f:
+            token = f.read().strip()
+    if token is not None:
+        response = add_provider_to_opa(token, os.getenv("KEYCLOAK_REALM_URL"))
+        os.remove('/app/bearer.txt')
+        if get_user_id(None, token=token) is None:
+            print("IDP is incorrect: verify that Keycloak is set up and clean/build/compose opa again")
+            sys.exit(2)
+except Exception as e:
+    raise Exception(f"failed to save idp keys: {str(e)} {status_code}")
+    sys.exit(1)
+
+sys.exit(0)

initialize_vault_store.py

@@ -1,29 +1,20 @@
 import json
 import os
-from authx.auth import get_service_store_secret, set_service_store_secret, add_provider_to_opa, add_program_to_opa, list_programs_in_opa
+from authx.auth import get_service_store_secret, set_service_store_secret, add_program_to_opa, list_programs_in_opa
 import sys
 
-## Initializes Vault's opa service store with the information for our IDP and the data in site_roles.json, paths.json, programs.json
+## Initializes Vault's opa service store with the data in site_roles.json, paths.json, programs.json
 
 results = []
 
 try:
-    with open('/app/bearer.txt') as f:
-        try:
-            token = f.read().strip()
-            response = add_provider_to_opa(token, os.getenv("KEYCLOAK_REALM_URL"))
-            results.append(response)
-        except Exception as e:
-            raise Exception(f"failed to save idp keys: {str(e)} {status_code}")
-            sys.exit(1)
-
     response, status_code = get_service_store_secret("opa", key="paths")
     if status_code != 200:
         with open('/app/defaults/paths.json') as f:
             data = f.read()
             response, status_code = set_service_store_secret("opa", key="paths", value=data)
             if status_code != 200:
-                raise Exception(f"failed to save paths: {str(e)} {status_code}")
+                raise Exception(f"failed to save paths: {response} {status_code}")
             results.append(response)
 
     response, status_code = get_service_store_secret("opa", key="site_roles")
@@ -32,7 +23,7 @@
             data = f.read()
             response, status_code = set_service_store_secret("opa", key="site_roles", value=data)
             if status_code != 200:
-                raise Exception(f"failed to save site roles: {str(e)} {status_code}")
+                raise Exception(f"failed to save site roles: {response} {status_code}")
             results.append(response)
 
     current_programs, status_code = list_programs_in_opa()
@@ -44,7 +35,7 @@
             if programs[program] not in current_programs:
                 response, status_code = add_program_to_opa(programs[program])
                 if status_code != 200:
-                    raise Exception(f"failed to save program authz: {str(e)} {status_code}")
+                    raise Exception(f"failed to save program authz: {response} {status_code}")
                 results.append(response)
 except Exception as e:
     print(str(e))