[stigman-orchestration] Community Solutions repo is moved

[jeremytourville]

@cd-rite @csmig

https://github.com/jeremyatourville/stigman-orchestration

is now

https://github.com/jeremytourville/stigman-orchestration

[cd-rite]

Hi @jeremytourville
Thanks for letting us know!
However, before I update the link, I would suggest you remove the note saying this orchestration could be used in production environments, and make the change below.
Your realm file includes the certificate and private key keycloak uses to sign the tokens it generates for that realm. Since this is now public in your repo, it could be used by anyone else to generate valid tokens for any instance using this realm file. (This is part of why we note our orchestration should not be used in production as well.)
You should be able to just remove this line and the one below it from your realm file, and keycloak should generate new signing material when it imports the realm.
https://github.com/jeremytourville/stigman-orchestration/blob/2807e4ba935e5ee6e02580dd131ccc5b5c488769/kc/stigman_realm.json#L1432-1433

If you are using this realm in production yourself, you should definitely have keycloak regenerate its signing material and mark that key as disabled or revoked.
https://www.keycloak.org/docs/latest/server_admin/index.html#realm_keys

[csmig]

To elaborate on what @cd-rite posted, a thorough realm file scrub would include all items of the array "org.keycloak.keys.KeyProvider". You may find HMAC, AES, EC, or RSA artifacts in that array and once they are publicly published they are no longer secure for production use. That said, by default Keycloak signs JWTs with RSA and that is the only option supported by STIG Manager at this time.

Also, that realm file contains client secrets for several privileged clients, including realm-management and security-admin-console. In general, if we share a complete realm file dump we must strongly discourage its use in production. Might be better to generate partial realm files from the Keycloak web app (Configuration -> Realm Settings -> Action -> Partial export) where all the secrets are replaced with **********.

[jeremytourville]

Those keys and certs were rotated out long ago. Thanks just the same! I updated the .json file to make note that the realm file is unique to your installation with certs and .key files.