keycloak_userprofile: new module (#8651)

keycloak_userprofile: new keycloak module to manage user profiles (#8651)

tests/integration/targets/keycloak_group/tasks/main.yml

@@ -10,8 +10,8 @@
     command: start-dev
     env:
       KC_HTTP_RELATIVE_PATH: /auth
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: password
+      KEYCLOAK_ADMIN: "{{ admin_user }}"
+      KEYCLOAK_ADMIN_PASSWORD: "{{ admin_password }}"
     ports:
       - "8080:8080"
     detach: true

tests/integration/targets/keycloak_userprofile/aliases

@@ -0,0 +1,5 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+unsupported

tests/integration/targets/keycloak_userprofile/meta/main.yml

@@ -0,0 +1,7 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# dependencies:
+#   - setup_docker

tests/integration/targets/keycloak_userprofile/readme.adoc

@@ -0,0 +1,27 @@
+// Copyright (c) Ansible Project
+// GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+To be able to run these integration tests a keycloak server must be
+reachable under a specific url with a specific admin user and password.
+The exact values expected for these parameters can be found in
+'vars/main.yml' file. A simple way to do this is to use the official
+keycloak docker images like this:
+
+----
+docker run --name mykeycloak -p 8080:8080 -e KC_HTTP_RELATIVE_PATH=<url-path> -e KEYCLOAK_ADMIN=<admin_user> -e KEYCLOAK_ADMIN_PASSWORD=<admin_password> quay.io/keycloak/keycloak:24.0.5 start-dev
+----
+
+Example with concrete values inserted:
+
+----
+docker run --name mykeycloak -p 8080:8080 -e KC_HTTP_RELATIVE_PATH=/auth -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=password quay.io/keycloak/keycloak:24.0.5 start-dev
+----
+
+This test suite can run against a fresh unconfigured server instance
+(no preconfiguration required) and cleans up after itself (undoes all
+its config changes) as long as it runs through completely. While its active
+it changes the server configuration in the following ways:
+
+  * creating, modifying and deleting some keycloak userprofiles
+

tests/integration/targets/keycloak_userprofile/tasks/main.yml

@@ -0,0 +1,301 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+- name: Start container
+  community.docker.docker_container:
+    name: mykeycloak
+    image: "quay.io/keycloak/keycloak:24.0.5"
+    command: start-dev
+    env:
+      KC_HTTP_RELATIVE_PATH: /auth
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: password
+    ports:
+      - "8080:8080"
+    detach: true
+    auto_remove: true
+    memory: 2200M
+
+- name: Check default ports
+  ansible.builtin.wait_for:
+    host: "localhost"
+    port: "8080"
+    state: started         # Port should be open
+    delay: 30              # Wait before first check
+    timeout: 50            # Stop checking after timeout (sec)
+
+- name: Remove Keycloak test realm to avoid failures from previous failed runs
+  community.general.keycloak_realm:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    realm: "{{ realm }}"
+    id: "{{ realm }}"
+    state: absent
+
+- name: Create Keycloak test realm
+  community.general.keycloak_realm:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    realm: "{{ realm }}"
+    id: "{{ realm }}"
+    state: present
+
+- name: Create default User Profile (check mode)
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    parent_id: "{{ realm }}"
+    config: "{{ config_default }}"
+  check_mode: true
+  register: result
+
+- name: Assert that User Profile would be created
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg == "Userprofile declarative-user-profile would be created"
+
+- name: Create default User Profile
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_default }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile was created
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg == "Userprofile declarative-user-profile created"
+
+- name: Create default User Profile (test for idempotency)
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_default }}"
+  register: result
+
+- name: Assert that User Profile was in sync
+  assert:
+    that:
+      - result is not changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg == "Userprofile declarative-user-profile was in sync"
+
+- name: Update default User Profile (check mode)
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_updated }}"
+  check_mode: true
+  register: result
+
+- name: Assert that User Profile would be changed
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg.startswith("Userprofile declarative-user-profile would be changed:")
+
+- name: Update default User Profile
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_updated }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile changed
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg.startswith("Userprofile declarative-user-profile changed:")
+
+- name: Update default User Profile (test for idempotency)
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_updated }}"
+  register: result
+
+- name: Assert that User Profile was in sync
+  assert:
+    that:
+      - result is not changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg == "Userprofile declarative-user-profile was in sync"
+
+## No force implemented
+# - name: Force update default User Profile
+#   community.general.keycloak_userprofile:
+#     auth_keycloak_url: "{{ url }}"
+#     auth_realm: "{{ admin_realm }}"
+#     auth_username: "{{ admin_user }}"
+#     auth_password: "{{ admin_password }}"
+#     force: true
+#     state: present
+#     parent_id: "{{ realm }}"
+#     config: "{{ config_updated }}"
+#   register: result
+# 
+# - name: Assert that forced update ran correctly
+#   assert:
+#     that:
+#       - result is changed
+#       - result.end_state != {}
+#       - result.end_state.providerId == "declarative-user-profile"
+#       - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+#       - result.msg == "Userprofile declarative-user-profile was forcibly updated"
+
+- name: Remove default User Profile
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: absent
+    parent_id: "{{ realm }}"
+    config: "{{ config_default }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile was deleted
+  assert:
+    that:
+      - result is changed
+      - result.end_state == {}
+      - result.msg == "Userprofile declarative-user-profile deleted"
+
+- name: Remove default User Profile (test for idempotency)
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: absent
+    parent_id: "{{ realm }}"
+    config: "{{ config_default }}"
+  register: result
+
+- name: Assert that User Profile not present
+  assert:
+    that:
+      - result is not changed
+      - result.end_state == {}
+      - result.msg == "Userprofile declarative-user-profile not present"
+
+- name: Create User Profile with unmanaged attributes ENABLED
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_unmanaged_attributes_enabled }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile was created
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg == "Userprofile declarative-user-profile created"
+
+- name: Attempt to change the User Profile to unmanaged ADMIN_EDIT
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_unmanaged_attributes_admin_edit }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile was changed
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg.startswith("Userprofile declarative-user-profile changed:")
+
+- name: Attempt to change the User Profile to unmanaged ADMIN_VIEW
+  community.general.keycloak_userprofile:
+    auth_keycloak_url: "{{ url }}"
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    state: present
+    parent_id: "{{ realm }}"
+    config: "{{ config_unmanaged_attributes_admin_view }}"
+  diff: true
+  register: result
+
+- name: Assert that User Profile was changed
+  assert:
+    that:
+      - result is changed
+      - result.end_state != {}
+      - result.end_state.providerId == "declarative-user-profile"
+      - result.end_state.providerType == "org.keycloak.userprofile.UserProfileProvider"
+      - result.msg.startswith("Userprofile declarative-user-profile changed:")
+
+- name: Remove Keycloak test realm
+  community.general.keycloak_realm:
+    auth_keycloak_url: "{{ url }}" 
+    auth_realm: "{{ admin_realm }}"
+    auth_username: "{{ admin_user }}"
+    auth_password: "{{ admin_password }}"
+    realm: "{{ realm }}"
+    id: "{{ realm }}"
+    state: absent

tests/integration/targets/keycloak_userprofile/vars/main.yml

@@ -0,0 +1,111 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+url: http://localhost:8080/auth
+admin_realm: master
+admin_user: admin
+admin_password: password
+realm: realm_userprofile_test
+attributes_default:
+ - name: username
+   displayName: ${username}
+   validations:
+     length:
+       min: 3
+       max: 255
+     usernameProhibitedCharacters: {}
+     up_username_not_idn_homograph: {}
+   annotations: {}
+   permissions:
+     view:
+       - admin
+       - user
+     edit: []
+   multivalued: false
+ - name: email
+   displayName: ${email}
+   validations:
+     email: {}
+     length:
+       max: 255
+   annotations: {}
+   required:
+     roles:
+       - user
+   permissions:
+     view:
+       - admin
+       - user
+     edit: []
+   multivalued: false
+ - name: firstName
+   displayName: ${firstName}
+   validations:
+     length:
+       max: 255
+     personNameProhibitedCharacters: {}
+   annotations: {}
+   required:
+     roles:
+       - user
+   permissions:
+     view:
+       - admin
+       - user
+     edit: []
+   multivalued: false
+ - name: lastName
+   displayName: ${lastName}
+   validations:
+     length:
+       max: 255
+     person_name_prohibited_characters: {}
+   annotations: {}
+   required:
+     roles:
+       - user
+   permissions:
+     view:
+       - admin
+       - user
+     edit: []
+   multivalued: false
+attributes_additional:
+  - name: additionalAttribute
+    displayName: additionalAttribute
+    group: user-metadata
+    required:
+      roles:
+        - user
+    permissions:
+      view:
+        - admin
+        - user
+      edit: []
+    multivalued: false
+groups_default:
+  - name: user-metadata
+    displayHeader: User metadata
+    displayDescription: Attributes, which refer to user metadata
+config_default:
+  kc_user_profile_config:
+    - attributes: "{{ attributes_default }}"
+      groups: "{{ groups_default }}"
+config_updated:
+  kc_user_profile_config:
+    - attributes: "{{ attributes_default + attributes_additional }}"
+      groups: "{{ groups_default }}"
+config_unmanaged_attributes_enabled:
+  kc_user_profile_config:
+    - unmanagedAttributePolicy: ENABLED
+      attributes: "{{ attributes_default }}"
+config_unmanaged_attributes_admin_edit:
+  kc_user_profile_config:
+    - unmanagedAttributePolicy: ADMIN_EDIT
+      attributes: "{{ attributes_default }}"
+config_unmanaged_attributes_admin_view:
+  kc_user_profile_config:
+    - unmanagedAttributePolicy: ADMIN_VIEW
+      attributes: "{{ attributes_default }}"