mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-04-04 17:50:32 -07:00
af0118278b
* feat: begin refactor to support refresh token in keycloak modules * chore: add start of tests for shared token usage * feat: progress towards supporting refresh token; token introspection not yet working [8857] * chore: reset to main branch previous state; a different approach is needed [8857] * feat: add request methods to keycloak class, which will be expanded with retry logic [8857] * feat: all requests to keycloak use request methods instead of open_url [8857] * fix: data argument is optional in keycloak request methods [8857] * feat: add integration test for keycloak module authentication methods [8857] * chore: refactor get token logic to separate logic using username/pass credentials [8857] * chore: refactor token request logic further to isolate request logic [8857] * chore: fix minor lint issues [8857] * test: add (currently failing) test for request with invalid auth token, valid refresh token [8857] * chore: allow realm to be provided to role module with refresh_token, without username/pass [8857] * feat: add retry logic to requests in keycloak module utils [8857] * chore: rename keycloak module fail_open_url method to fail_request [8857] * chore: update all keycloak modules to support refresh token param [8857] * chore: add refresh_token param to keycloak doc_fragments [8857] * chore: restore dependency between auth_realm and auth_username,auth_password params [8857] * chore: rearrange module param checks to reduce future pr size [8857] * chore: remove extra comma [8857] * chore: update version added for refresh token param [8857] * chore: add changelog fragment [8857] * chore: re-add fail_open_url to keycloak module utils for backward compatability [8857] * fix: do not make a new request to keycloak without reauth when refresh token not provided (#8857) * fix: only make final auth attempt if username/pass provided, and return exception on failure (#8857) * fix: make re-auth and retry code more consistent, ensure final exceptions are thrown (#8857) * test: fix arguments for invalid token, valid refresh token test (#8857) * feat: catch invalid refresh token errors during re-auth attempt (#8857) Add test to verify this behaviour works. * test: improve test coverage, including some unhappy path tests for authentication failures (#8857) * chore: store auth errors from token request in backwards compatible way (#8857) * fix: ensure method is still specified for all requests (#8857) * chore: simplify token request logic (#8857) * chore: rename functions to request tokens using refresh token or username/password (#8857) To emphasize their difference from the `get_token` function, which either gets the token from the module params *or* makes a request for it. * doc: add docstrings for new or significantly modified functions (#8857) * test: repair unit test following change to exception message upon key error during auth request (#8857)
249 lines
6.8 KiB
YAML
249 lines
6.8 KiB
YAML
---
|
|
# Copyright (c) Ansible Project
|
|
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
- name: Create realm
|
|
community.general.keycloak_realm:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
id: "{{ realm }}"
|
|
realm: "{{ realm }}"
|
|
state: present
|
|
|
|
- name: Create client
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
register: client
|
|
|
|
- name: Create new realm role with username/password authentication
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Remove created realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Get Keycloak token
|
|
ansible.builtin.uri:
|
|
url: "{{ url }}/realms/{{ admin_realm }}/protocol/openid-connect/token"
|
|
method: POST
|
|
return_content: true
|
|
status_code: 200
|
|
body_format: form-urlencoded
|
|
body:
|
|
grant_type: "password"
|
|
client_id: "admin-cli"
|
|
username: "{{ admin_user }}"
|
|
password: "{{ admin_password }}"
|
|
register: token_response
|
|
|
|
- name: Extract tokens
|
|
ansible.builtin.set_fact:
|
|
access_token: "{{ token_response.json | json_query('access_token') }}"
|
|
refresh_token: "{{ token_response.json | json_query('refresh_token') }}"
|
|
|
|
- name: Create new realm role with provided token authentication
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
token: "{{ access_token }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Remove created realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Create new realm role with invalid auth token and valid refresh token
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
token: "invalidtoken!!!"
|
|
refresh_token: "{{ refresh_token }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Remove created realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Create new realm role with invalid auth token and valid username/password
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
token: "invalidtoken!!!"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Remove created realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Create new realm role with invalid auth token, invalid refresh token, and valid username/password
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
token: "invalidtoken!!!"
|
|
refresh_token: "invalidrefreshtoken!!!"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
- name: Remove created realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Debug
|
|
debug:
|
|
var: result
|
|
|
|
### Unhappy path tests
|
|
|
|
- name: Fail to create new realm role with invalid username/password
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "invalid_password"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
failed_when: >
|
|
(result.exception is not defined) or
|
|
("HTTP Error 401: Unauthorized" not in result.msg)
|
|
|
|
- name: Fail to create new realm role with invalid auth token
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
token: "invalidtoken!!!"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
failed_when: >
|
|
(result.exception is not defined) or
|
|
("HTTP Error 401: Unauthorized" not in result.msg)
|
|
|
|
- name: Fail to create new realm role with invalid auth and refresh tokens, and invalid username/password
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "invalid_password"
|
|
token: "invalidtoken!!!"
|
|
refresh_token: "invalidtoken!!!"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ keycloak_role_description }}"
|
|
state: present
|
|
register: result
|
|
failed_when: >
|
|
(result.exception is not defined) or
|
|
("HTTP Error 401: Unauthorized" not in result.msg)
|