Restrict Grafana access to Arch Linux Staff group on Keycloak (fixes #151)

tf-stage2/keycloak.tf

@@ -415,7 +415,8 @@ resource "keycloak_group_roles" "staff" {
   realm_id = "archlinux"
   group_id = keycloak_group.staff.id
   role_ids = [
-    keycloak_role.staff.id
+    keycloak_role.staff.id,
+    keycloak_role.grafana_archlinux_staff.id
   ]
 }
 
@@ -761,3 +762,26 @@ resource "keycloak_openid_user_realm_role_protocol_mapper" "user_realm_role_mapp
   add_to_id_token     = false
   add_to_access_token = false
 }
+
+// All of the below is to restrict access to Grafana to members in the Arch Linux Staff group.
+resource "keycloak_role" "grafana_archlinux_staff" {
+  realm_id    = "archlinux"
+  client_id   = keycloak_openid_client.grafana_openid_client.id
+  name        = "Staff"
+  description = "Arch Linux Staff Grafana"
+}
+
+resource "keycloak_generic_client_role_mapper" "grafana_archlinux_staff_to_email" {
+  realm_id        = "archlinux"
+  role_id         = keycloak_role.grafana_archlinux_staff.id
+  client_scope_id = keycloak_openid_client_scope.email.id
+}
+
+// This needs to be imported from the default client scopes created by Keycloak.
+resource "keycloak_openid_client_scope" "email" {
+  realm_id               = "archlinux"
+  name                   = "email"
+  description            = "OpenID Connect built-in scope: email"
+  include_in_token_scope = true
+  consent_screen_text    = "$${emailScopeConsentText}"
+}