Revert "Revert "UHF-9531: Add separate client for edu users""

conf/cmi/openid_connect.client.keycloak.yml

@@ -0,0 +1,21 @@
+uuid: 734bd97e-6964-42d0-80ad-2b641885ae6b
+langcode: en
+status: true
+dependencies:
+  module:
+    - helfi_tunnistamo
+_core:
+  default_config_hash: nGpk9fP8YMhP_c3Sz_aCQFVhAJyN6eJI6E4Qpnqna-A
+id: keycloak
+label: Tunnistamo
+plugin: tunnistamo
+settings:
+  client_id: placeholder
+  client_secret: placeholder
+  iss_allowed_domains: ''
+  is_production: 0
+  auto_login: 0
+  environment_url: ''
+  client_scopes: 'openid,email'
+  client_roles: {  }
+

conf/cmi/openid_connect.client.tunnistamo.yml

@@ -7,7 +7,7 @@ dependencies:
 _core:
   default_config_hash: nGpk9fP8YMhP_c3Sz_aCQFVhAJyN6eJI6E4Qpnqna-A
 id: tunnistamo
-label: Tunnistamo
+label: Teacher sign in
 plugin: tunnistamo
 settings:
   client_id: placeholder

public/modules/custom/helfi_kasko_content/helfi_kasko_content.module

@@ -8,11 +8,14 @@
 use Drupal\Core\Access\AccessResult;
 use Drupal\Core\Entity\ContentEntityInterface;
 use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Language\LanguageInterface;
 use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\helfi_kasko_content\UnitCategoryUtility;
 use Drupal\helfi_platform_config\DTO\ParagraphTypeCollection;
 use Drupal\paragraphs\ParagraphInterface;
+use Drupal\user\UserInterface;
 
 /**
  * Implements hook_ENTITY_TYPE_access().
@@ -336,3 +339,53 @@ function helfi_kasko_content_views_data_alter(array &$data) {
     ],
   ];
 }
+
+/**
+ * Implements hook_openid_connect_pre_authorize().
+ */
+function helfi_kasko_content_openid_connect_pre_authorize(UserInterface|bool $account, array $context) : bool {
+  $pluginId = $context['plugin_id'];
+  $userinfo = $context['userinfo'] ?? NULL;
+  $email = $userinfo['email'] ?? NULL;
+
+  // Helsinki-profiili has issues with edu.hel.fi users:
+  // https://helsinkisolutionoffice.atlassian.net/browse/HP-2147.
+  // As a workaround, kasko has a separate client that still uses old
+  // Tunnistamo. This prevents non edu.hel.fi users from using tunnistamo.
+  // @todo remove when edu.hel.fi clients work with Helsinki-profiili.
+  $allowLogin = match ($pluginId) {
+    'tunnistamo' => $email === helfi_tunnistamo_create_email($userinfo),
+    'keycloak' => $email !== helfi_tunnistamo_create_email($userinfo),
+    default => TRUE,
+  };
+
+  if (!$allowLogin && $pluginId === 'tunnistamo') {
+    \Drupal::messenger()
+      ->addError(new TranslatableMarkup("Only teachers are allowed to log in with this method."));
+  }
+
+  return $allowLogin;
+}
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function helfi_kasko_content_form_openid_connect_login_form_alter(&$form, FormStateInterface $form_state) : void {
+  // UHF-9531: Add help text to teacher login button.
+  // @todo remove once separate login is no longer needed for edu users.
+  if (isset($form['openid_connect_client_tunnistamo_login'])) {
+    $build['button'] = $form['openid_connect_client_tunnistamo_login'];
+    $build['button']['#value'] = new TranslatableMarkup('Teacher sign in', [], [
+      'context' => 'Kasko teacher sign in',
+    ]);
+    $build['help'] = [
+      '#prefix' => '<p>',
+      '#suffix' => '</p>',
+      '#plain_text' => new TranslatableMarkup('Sign in like before using your Helsinki1 credentials.', [], [
+        'context' => 'Kasko teacher sign in',
+      ]),
+    ];
+
+    $form['openid_connect_client_tunnistamo_login'] = $build;
+  }
+}

public/modules/custom/helfi_kasko_content/translations/fi.po

@@ -177,3 +177,14 @@ msgstr "B2-kieli"
 msgctxt "TPR Ontologyword details schools"
 msgid "Language offering"
 msgstr "Kielitarjonta"
+
+msgid "Only teachers are allowed to log in with this method"
+msgstr "Vain opettajat voivat kirjautua tällä kirjautumistavalla."
+
+msgctxt "Kasko teacher sign in"
+msgid "Teacher sign in"
+msgstr "Opettajien kirjautuminen"
+
+msgctxt "Kasko teacher sign in"
+msgid "Sign in like before using your Helsinki1 credentials."
+msgstr "Kirjaudu kuten ennenkin, mutta käytä opettajien omaa kirjautumispainiketta."

public/modules/custom/helfi_kasko_content/translations/sv.po

@@ -177,3 +177,11 @@ msgstr "B2-språket"
 msgctxt "TPR Ontologyword details schools"
 msgid "Language offering"
 msgstr "Språkutbudet"
+
+msgctxt "Kasko teacher sign in"
+msgid "Teacher sign in"
+msgstr "Logga in (lärare)"
+
+msgctxt "Kasko teacher sign in"
+msgid "Sign in like before using your Helsinki1 credentials."
+msgstr "Logga in som förut med dina Helsinki1-uppgifter."

public/sites/default/all.settings.php

@@ -27,6 +27,13 @@
 // Sentry DSN for React.
 $config['react_search.settings']['sentry_dsn_react'] = getenv('SENTRY_DSN_REACT');
 
+// @todo remove separate client once edu.hel.fi users work with keycloak (UHF-9531).
+$config['openid_connect.client.keycloak']['settings']['client_id'] = getenv('KEYCLOAK_CLIENT_ID');
+$config['openid_connect.client.keycloak']['settings']['client_secret'] = getenv('KEYCLOAK_CLIENT_SECRET');
+if ($keycloak_environment_url = getenv('KEYCLOAK_ENVIRONMENT_URL')) {
+  $config['openid_connect.client.keycloak']['settings']['environment_url'] = $keycloak_environment_url;
+}
+
 $additionalEnvVars = [
   'AZURE_BLOB_STORAGE_SAS_TOKEN|BLOBSTORAGE_SAS_TOKEN',
   'AZURE_BLOB_STORAGE_NAME',
@@ -50,7 +57,11 @@
   'ELASTIC_USER',
   'ELASTIC_PASSWORD',
   'SENTRY_DSN_REACT',
+  'KEYCLOAK_CLIENT_ID',
+  'KEYCLOAK_CLIENT_SECRET',
+  'KEYCLOAK_ENVIRONMENT_URL',
 ];
+
 foreach ($additionalEnvVars as $var) {
   $preflight_checks['environmentVariables'][] = $var;
 }

public/sites/default/staging.settings.php

@@ -1,6 +1,5 @@
 <?php
 
-$config['helfi_proxy.settings']['tunnistamo_return_url'] = '/fi/staging-kasvatus-ja-koulutus/openid-connect/tunnistamo';
 $config['helfi_proxy.settings']['asset_path'] = 'staging-kasko-assets';
 $config['helfi_proxy.settings']['prefixes'] = [
   'en' => 'staging-childhood-and-education',