Revert "matrix: Integrate with Keycloak"

This reverts commit 8e4eac7d.

Revert this feature as its part of a keycloak change that must go
through review via a merge request.

README.md

@@ -207,12 +207,6 @@ The following steps should be used to update our managed servers:
 #### Services
   - quassel core
 
-### matrix.archlinux.org
-
-#### Services
-  - Matrix homeserver (Synapse)
-  - Matrix ↔ IRC bridge
-
 ### homedir.archlinux.org
 
 #### Services

roles/matrix/tasks/main.yml

@@ -52,7 +52,7 @@
 - name: install synapse
   pip:
     name:
-      - 'matrix-synapse[postgres,systemd,url_preview,redis,oidc]'
+      - 'matrix-synapse[postgres,systemd,url_preview,redis]'
       - pip
     state: latest
     extra_args: '-U --upgrade-strategy=eager'

roles/matrix/templates/homeserver.yaml.j2

@@ -1625,7 +1625,7 @@ oidc_config:
   # Uncomment the following to enable authorization against an OpenID Connect
   # server. Defaults to false.
   #
-  enabled: true
+  #enabled: true
 
   # Uncomment the following to disable use of the OIDC discovery mechanism to
   # discover endpoints. Defaults to true.
@@ -1637,19 +1637,19 @@ oidc_config:
   #
   # Required if 'enabled' is true.
   #
-  issuer: "https://accounts.archlinux.org/auth/realms/archlinux"
+  #issuer: "https://accounts.example.com/"
 
   # oauth2 client id to use.
   #
   # Required if 'enabled' is true.
   #
-  client_id: "openid_matrix"
+  #client_id: "provided-by-your-issuer"
 
   # oauth2 client secret to use.
   #
   # Required if 'enabled' is true.
   #
-  client_secret: "{{ vault_matrix_openid_client_secret }}"
+  #client_secret: "provided-by-your-issuer"
 
   # auth method to use when exchanging the token.
   # Valid values are 'client_secret_basic' (default), 'client_secret_post' and
@@ -1660,7 +1660,7 @@ oidc_config:
   # list of scopes to request. This should normally include the "openid" scope.
   # Defaults to ["openid"].
   #
-  scopes: ["openid", "profile"]
+  #scopes: ["openid", "profile"]
 
   # the oauth2 authorization endpoint. Required if provider discovery is disabled.
   #
@@ -1727,7 +1727,7 @@ oidc_config:
       #
       # If unset, no displayname will be set.
       #
-      display_name_template: "{{ '{{ user.given_name }} {{ user.last_name }}' }}"
+      #display_name_template: "{{ '{{ user.given_name }} {{ user.last_name }}' }}"
 
 
 

tf-stage2/keycloak.tf

@@ -27,12 +27,6 @@ data "external" "vault_github" {
     "--format", "json"]
 }
 
-data "external" "vault_matrix" {
-  program = ["${path.module}/../misc/get_key.py", "group_vars/all/vault_matrix.yml",
-    "vault_matrix_openid_client_secret",
-    "--format", "json"]
-}
-
 provider "keycloak" {
   client_id = "admin-cli"
   username = data.external.vault_keycloak.result.vault_keycloak_admin_user
@@ -176,21 +170,6 @@ resource "keycloak_openid_client" "openid_gitlab" {
   ]
 }
 
-resource "keycloak_openid_client" "openid_matrix" {
-  realm_id = "archlinux"
-  client_id = "openid_matrix"
-  client_secret = data.external.vault_matrix.result.vault_matrix_openid_client_secret
-
-  name = "Arch Linux Accounts"
-  enabled = true
-
-  access_type = "CONFIDENTIAL"
-  standard_flow_enabled = true
-  valid_redirect_uris = [
-    "https://matrix.archlinux.org/_synapse/oidc/callback"
-  ]
-}
-
 resource "keycloak_saml_user_property_protocol_mapper" "gitlab_saml_email" {
   realm_id = "archlinux"
   client_id = keycloak_saml_client.saml_gitlab.id