[docker] add make test_keycloak_s3 for local develop and debug (#9719)

* add make test_keylock_s3 for local develop and debug

* fix typos

* add condition oidc:azp

* docker: reuse test/s3/iam realm and iam config for keycloak dev compose

Point the keycloak dev compose at the existing test/s3/iam configs instead
of a parallel realm/port/key/role set. Adds one declarative realm import
(seaweedfs-test-realm.json) as the single realm source and drops the
duplicated iam.json/s3.json.

---------

Co-authored-by: Chris Lu <chris.lu@gmail.com>

docker/Makefile

@@ -127,6 +127,9 @@ test_tarantool: tags = tarantool
 test_tarantool: build_tarantool_dev_env build
 	docker compose -f compose/test-tarantool-filer.yml -p seaweedfs up
 
+test_keycloak_s3: build
+	docker compose -f compose/test-keycloak-s3.yml -p seaweedfs up
+
 clean:
 	rm ./weed
 

docker/compose/test-keycloak-s3.yml

@@ -0,0 +1,46 @@
+services:
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.0.7
+    command: ["start-dev", "--import-realm"]
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+      KC_HTTP_ENABLED: "true"
+      KC_HOSTNAME: "http://keycloak:8080"
+      KC_HOSTNAME_STRICT: "false"
+    ports:
+      - "8080:8080"
+    volumes:
+      - ../../test/s3/iam/seaweedfs-test-realm.json:/opt/keycloak/data/import/seaweedfs-test-realm.json:ro
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+
+  s3:
+    image: chrislusf/seaweedfs:local
+    command:
+      - -v=9
+      - server
+      - -ip=s3
+      - -filer
+      - -master.volumeSizeLimitMB=16
+      - -volume
+      - -volume.max=0
+      - -volume.preStopSeconds=1
+      - -s3
+      - -s3.port=8333
+      - -s3.config=/etc/seaweedfs/s3_config.json
+      - -s3.iam.config=/etc/seaweedfs/iam_config.json
+    environment:
+      WEED_MASTER_VOLUME_GROWTH_COPY_OTHER: 1
+    volumes:
+      - ../../test/s3/iam/test_config.json:/etc/seaweedfs/s3_config.json:ro
+      - ../../test/s3/iam/iam_config_docker.json:/etc/seaweedfs/iam_config.json:ro
+    ports:
+      - "8333:8333"
+    depends_on:
+      keycloak:
+        condition: service_healthy

test/s3/iam/seaweedfs-test-realm.json

@@ -0,0 +1,107 @@
+{
+  "realm": "seaweedfs-test",
+  "enabled": true,
+  "roles": {
+    "realm": [
+      { "name": "s3-admin" },
+      { "name": "s3-read-only" },
+      { "name": "s3-write-only" },
+      { "name": "s3-read-write" }
+    ]
+  },
+  "clients": [
+    {
+      "clientId": "seaweedfs-s3",
+      "enabled": true,
+      "secret": "seaweedfs-s3-secret",
+      "publicClient": false,
+      "serviceAccountsEnabled": true,
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": true,
+      "fullScopeAllowed": true,
+      "redirectUris": ["*"],
+      "webOrigins": ["*"],
+      "protocol": "openid-connect",
+      "protocolMappers": [
+        {
+          "name": "realm-roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-realm-role-mapper",
+          "config": {
+            "claim.name": "roles",
+            "jsonType.label": "String",
+            "multivalued": "true",
+            "usermodel.realmRoleMapping.rolePrefix": "",
+            "access.token.claim": "true",
+            "id.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        },
+        {
+          "name": "audience-mapper",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "config": {
+            "included.client.audience": "seaweedfs-s3",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    }
+  ],
+  "users": [
+    {
+      "username": "admin-user",
+      "enabled": true,
+      "email": "admin-user@test.com",
+      "firstName": "Test",
+      "lastName": "User",
+      "emailVerified": true,
+      "requiredActions": [],
+      "realmRoles": ["s3-admin"],
+      "credentials": [
+        { "type": "password", "value": "adminuser123", "temporary": false }
+      ]
+    },
+    {
+      "username": "read-user",
+      "enabled": true,
+      "email": "read-user@test.com",
+      "firstName": "Test",
+      "lastName": "User",
+      "emailVerified": true,
+      "requiredActions": [],
+      "realmRoles": ["s3-read-only"],
+      "credentials": [
+        { "type": "password", "value": "readuser123", "temporary": false }
+      ]
+    },
+    {
+      "username": "write-user",
+      "enabled": true,
+      "email": "write-user@test.com",
+      "firstName": "Test",
+      "lastName": "User",
+      "emailVerified": true,
+      "requiredActions": [],
+      "realmRoles": ["s3-read-write"],
+      "credentials": [
+        { "type": "password", "value": "writeuser123", "temporary": false }
+      ]
+    },
+    {
+      "username": "write-only-user",
+      "enabled": true,
+      "email": "write-only-user@test.com",
+      "firstName": "Test",
+      "lastName": "User",
+      "emailVerified": true,
+      "requiredActions": [],
+      "realmRoles": ["s3-write-only"],
+      "credentials": [
+        { "type": "password", "value": "writeonlyuser123", "temporary": false }
+      ]
+    }
+  ]
+}