Keycloak admin only dashboard edit

[schmug]

Per this discussion, I can't figure out how to appconfig.disableConfiguration: true and use keycloak for auth.

I am breaking this post off of the previously solved discussion because it may have gotten lost.

How do I set type: admin in keycloak for dashy to recognize it?

in this example config I have role1 in keycloak attached to my user. I've tried being keycloak group and role admin, and keycloak attribute type: admin.

appConfig:
---
  auth:
    enableGuestAccess: true
    users: []
    enableKeycloak: true
    keycloak:
      serverUrl: keycloak.url
      realm: Dashy
      clientId: clientid
  showSplashScreen: false
  preventWriteToDisk: false
  preventLocalSave: false
  disableConfiguration: true
  allowConfigEdit: true
  enableServiceWorker: false
  disableContextMenu: false
  disableUpdateChecks: false
  disableSmartSort: false
  enableErrorReporting: false
pageInfo:
---
sections:
  - name: section1
    displayData:
      showForKeycloakUsers:
        roles:
          - role1
---
    items:

the docs show the example when using built-in auth only from what I could find

appConfig:
  auth:
    users:
    - user: alicia
      hash: 4D1E58C90B3B94BCAD9848ECCACD6D2A8C9FBC5CA913304BBA5CDEAB36FEEFA3
      type: admin
    - user: bob
      hash: 5E884898DA28047151D0E56F8DC6292773603D0D6AABBDD62A11EF721D1542D8

I don't pretend to know what I'm doing, but it seems like only preventWriteToDisk checks for admin.
https://github.com/Lissy93/dashy/blob/05f5d71801a765ab29816b5734342b9c9cd78e9d/src/store.js#L83-L96

and I can't find where keycloak users/groups/roles can have a type:
https://github.com/Lissy93/dashy/blob/c2559bc7310d42550f49115a8adc7b103af8fd19/src/utils/KeycloakAuth.js#L63-L69

[NotAFlightRisk]

You don't give Keycloak users a type - instead you tell Dashy which Keycloak role (or group) counts as admin, with adminRole or adminGroup. Then swap disableConfiguration for disableConfigurationForNonAdmin, because disableConfiguration: true switches the config UI off for everyone, admins included. allowConfigEdit can go too, it doesnt do anything.

appConfig:
  disableConfigurationForNonAdmin: true
  auth:
    enableGuestAccess: true
    enableKeycloak: true
    keycloak:
      serverUrl: https://keycloak.url
      realm: Dashy
      clientId: clientid
      adminRole: role1

Anyone with role1 then gets the config menu, and everyone else (guests included) doesn't. If you'd rather do it by group, use adminGroup: <group name> instead.

Saving to disk is checked on Dashy's server against the ID token, so the role needs to be in there too. Easiest with a realm role - add a "User Realm Role" mapper with "Add to ID token" switched on, as in the Keycloak docs. Then restart Dashy, and log out and back in so you get a fresh token.