`_
v1.3.0
======
diff --git a/main/_sources/plugins/keycloak_client.rst.txt b/main/_sources/plugins/keycloak_client.rst.txt
index 8e0ddb2..f021d88 100644
--- a/main/_sources/plugins/keycloak_client.rst.txt
+++ b/main/_sources/plugins/keycloak_client.rst.txt
@@ -67,3425 +67,1328 @@ Synopsis
Parameters
----------
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
+.. raw:: html
+
+
+
+
+ Parameter |
+ Comments |
+
+
+
+
+
+
+
+ admin_url
+
+ aliases: adminUrl
+
+ string
+
+ |
+
+ URL to the admin interface of the client. This is 'adminUrl' in the Keycloak REST API.
+ |
+
+
+
+
+
+ always_display_in_console
+
+ aliases: alwaysDisplayInConsole
+
+ boolean
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ Whether or not to display this client in account console, even if the user does not have an active session.
+ Choices:
+
+
+ |
+
+
+
+
+ attributes
+
+
+ dictionary
+
+ |
+
+ A dict of further attributes for this client. This can contain various configuration settings; an example is given in the examples section. While an exhaustive list of permissible options is not available; possible options as of Keycloak 3.4 are listed below. The Keycloak API does not validate whether a given option is appropriate for the protocol used; if specified anyway, Keycloak will simply not use it.
+ |
+
+
+
+
+ jwks.url
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, URL where client keys in JWK are stored.
+ |
+
+
+
+
+ jwt.credential.certificate
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, client certificate for validating JWT issued by client and signed by its key, base64-encoded.
+ |
+
+
+
+
+ request.object.signature.alg
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, JWA algorithm which the client needs to use when sending OIDC request object. One of any, none, RS256.
+ |
+
+
+
+
+ saml.authnstatement
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether or not a statement containing method and timestamp should be included in the login response.
+ |
+
+
+
+
+ saml.client.signature
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether a client signature is required and validated.
+ |
+
+
+
+
+ saml.encrypt
+
+
+ string
+
+ |
+
+ Boolean specifying whether SAML assertions should be encrypted with the client's public key.
+ |
+
+
+
+
+ saml.force.post.binding
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether always to use POST binding for responses.
+ |
+
+
+
+
+ saml.onetimeuse.condition
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether a OneTimeUse condition should be included in login responses.
+ |
+
+
+
+
+ saml.server.signature
+
+
+ string
+
+ |
+
+ Boolean specifying whether SAML documents should be signed by the realm.
+ |
+
+
+
+
+ saml.server.signature.keyinfo.ext
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether REDIRECT signing key lookup should be optimized through inclusion of the signing key id in the SAML Extensions element.
+ |
+
+
+
+
+ saml.signature.algorithm
+
+
+ string
+
+ |
+
+ Signature algorithm used to sign SAML documents. One of RSA_SHA256, RSA_SHA1, RSA_SHA512, or DSA_SHA1.
+ |
+
+
+
+
+ saml.signing.certificate
+
+
+ string
+
+ |
+
+ SAML signing key certificate, base64-encoded.
+ |
+
+
+
+
+ saml.signing.private.key
+
+
+ string
+
+ |
+
+ SAML signing key private key, base64-encoded.
+ |
+
+
+
+
+ saml_assertion_consumer_url_post
+
+
+ string
+
+ |
+
+ SAML POST Binding URL for the client's assertion consumer service (login responses).
+ |
+
+
+
+
+ saml_assertion_consumer_url_redirect
+
+
+ string
+
+ |
+
+ SAML Redirect Binding URL for the client's assertion consumer service (login responses).
+ |
+
+
+
+
+ saml_force_name_id_format
+
+
+ string
+
+ |
+
+ For SAML clients, Boolean specifying whether to ignore requested NameID subject format and using the configured one instead.
+ |
+
+
+
+
+ saml_name_id_format
+
+
+ string
+
+ |
+
+ For SAML clients, the NameID format to use (one of username, email, transient, or persistent)
+ |
+
+
+
+
+ saml_signature_canonicalization_method
+
+
+ string
+
+ |
+
+ SAML signature canonicalization method. This is one of four values, namely http://www.w3.org/2001/10/xml-exc-c14n# for EXCLUSIVE, http://www.w3.org/2001/10/xml-exc-c14n#WithComments for EXCLUSIVE_WITH_COMMENTS, http://www.w3.org/TR/2001/REC-xml-c14n-20010315 for INCLUSIVE, and http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments for INCLUSIVE_WITH_COMMENTS.
+ |
+
+
+
+
+ saml_single_logout_service_url_post
+
+
+ string
+
+ |
+
+ SAML POST binding url for the client's single logout service.
+ |
+
+
+
+
+ saml_single_logout_service_url_redirect
+
+
+ string
+
+ |
+
+ SAML redirect binding url for the client's single logout service.
+ |
+
+
+
+
+ use.jwks.url
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, boolean specifying whether to use a JWKS URL to obtain client public keys.
+ |
+
+
+
+
+ user.info.response.signature.alg
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of RS256 or unsigned.
+ |
+
+
+
+
+
+ auth_client_id
+
+
+ string
+
+ |
+
+ OpenID Connect client_id to authenticate to the API with.
+ Default: "admin-cli"
+ |
+
+
+
+
+ auth_client_secret
+
+
+ string
+
+ |
+
+ Client Secret to use in conjunction with auth_client_id (if required).
+ |
+
+
+
+
+
+ auth_keycloak_url
+
+ aliases: url
+
+ string
+ / required
+
+ |
+
+ URL to the Keycloak instance.
+ |
+
+
+
+
+
+ auth_password
+
+ aliases: password
+
+ string
+
+ |
+
+ Password to authenticate for API access with.
+ |
+
+
+
+
+ auth_realm
+
+
+ string
+
+ |
+
+ Keycloak realm name to authenticate to for API access.
+ |
+
+
+
+
+
+ auth_username
+
+ aliases: username
+
+ string
+
+ |
+
+ Username to authenticate for API access with.
+ |
+
+
+
+
+
+ authentication_flow_binding_overrides
+
+ aliases: authenticationFlowBindingOverrides
+
+ dictionary
+
+ added in middleware_automation.keycloak 3.4.0
+ |
+
+ Override realm authentication flow bindings.
+ |
+
+
+
+
+
+ authorization_services_enabled
+
+ aliases: authorizationServicesEnabled
+
+ boolean
+
+ |
+
+ Are authorization services enabled for this client or not (OpenID connect). This is 'authorizationServicesEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ authorization_settings
+
+ aliases: authorizationSettings
+
+ dictionary
+
+ |
+ |
+
+
+
+
+
+ base_url
+
+ aliases: baseUrl
+
+ string
+
+ |
+
+ Default URL to use when the auth server needs to redirect or link back to the client This is 'baseUrl' in the Keycloak REST API.
+ |
+
+
+
+
+
+ bearer_only
+
+ aliases: bearerOnly
+
+ boolean
+
+ |
+
+ The access type of this client is bearer-only. This is 'bearerOnly' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ client_authenticator_type
+
+ aliases: clientAuthenticatorType
+
+ string
+
+ |
+
+ How do clients authenticate with the auth server? Either client-secret or client-jwt can be chosen. When using client-secret, the module parameter secret can set it, while for client-jwt, you can use the keys use.jwks.url, jwks.url, and jwt.credential.certificate in the attributes module parameter to configure its behavior. This is 'clientAuthenticatorType' in the Keycloak REST API.
+ Choices:
+
+ "client-secret"
"client-jwt"
+
+ |
+
+
+
+
+
+ client_id
+
+ aliases: clientId
+
+ string
+
+ |
+
+ Client id of client to be worked on. This is usually an alphanumeric name chosen by you. Either this or id is required. If you specify both, id takes precedence. This is 'clientId' in the Keycloak REST API.
+ |
+
+
+
+
+
+ client_template
+
+ aliases: clientTemplate
+
+ string
+
+ |
+
+ Client template to use for this client. If it does not exist this field will silently be dropped. This is 'clientTemplate' in the Keycloak REST API.
+ |
+
+
+
+
+ connection_timeout
+
+
+ integer
+
+ added in middleware_automation.keycloak 4.5.0
+ |
+
+ Controls the HTTP connections timeout period (in seconds) to Keycloak API.
+ Default: 10
+ |
+
+
+
+
+
+ consent_required
+
+ aliases: consentRequired
+
+ boolean
+
+ |
+
+ If enabled, users have to consent to client access. This is 'consentRequired' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ default_client_scopes
+
+ aliases: defaultClientScopes
+
+ list
+ / elements=string
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ List of default client scopes.
+ |
+
+
+
+
+
+ default_roles
+
+ aliases: defaultRoles
+
+ list
+ / elements=string
+
+ |
+
+ list of default roles for this client. If the client roles referenced do not exist yet, they will be created. This is 'defaultRoles' in the Keycloak REST API.
+ |
+
+
+
+
+ description
+
+
+ string
+
+ |
+
+ Description of the client in Keycloak.
+ |
+
+
+
+
+
+ direct_access_grants_enabled
+
+ aliases: directAccessGrantsEnabled
+
+ boolean
+
+ |
+
+ Are direct access grants enabled for this client or not (OpenID connect). This is 'directAccessGrantsEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ enabled
+
+
+ boolean
+
+ |
+
+ Is this client enabled or not?
+ Choices:
+
+
+ |
+
+
+
+
+
+ frontchannel_logout
+
+ aliases: frontchannelLogout
+
+ boolean
+
+ |
+
+ Is frontchannel logout enabled for this client or not. This is 'frontchannelLogout' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ full_scope_allowed
+
+ aliases: fullScopeAllowed
+
+ boolean
+
+ |
+
+ Is the "Full Scope Allowed" feature set for this client or not. This is 'fullScopeAllowed' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ http_agent
+
+
+ string
+
+ added in middleware_automation.keycloak 5.4.0
+ |
+
+ Configures the HTTP User-Agent header.
+ Default: "Ansible"
+ |
+
+
+ |
+
+ Id of client to be worked on. This is usually an UUID. Either this or client_id is required. If you specify both, this takes precedence.
+ |
+
+
+
+
+
+ implicit_flow_enabled
+
+ aliases: implicitFlowEnabled
+
+ boolean
+
+ |
+
+ Enable implicit flow for this client or not (OpenID connect). This is 'implicitFlowEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ Name of the client (this is not the same as client_id).
+ |
+
+
+
+
+
+ node_re_registration_timeout
+
+ aliases: nodeReRegistrationTimeout
+
+ integer
+
+ |
+
+ Cluster node re-registration timeout for this client. This is 'nodeReRegistrationTimeout' in the Keycloak REST API.
+ |
+
+
+
+
+
+ not_before
+
+ aliases: notBefore
+
+ integer
+
+ |
+
+ Revoke any tokens issued before this date for this client (this is a UNIX timestamp). This is 'notBefore' in the Keycloak REST API.
+ |
+
+
+
+
+
+ optional_client_scopes
+
+ aliases: optionalClientScopes
+
+ list
+ / elements=string
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ List of optional client scopes.
+ |
+
+
+
+
+ protocol
+
+
+ string
+
+ |
+
+ Type of client (either openid-connect or saml.
+ Choices:
+
+ "openid-connect"
"saml"
+
+ |
+
+
+
+
+
+ protocol_mappers
+
+ aliases: protocolMappers
+
+ list
+ / elements=dictionary
+
+ |
+
+ a list of dicts defining protocol mappers for this client. This is 'protocolMappers' in the Keycloak REST API.
+ |
+
+
+
+
+
+ config
+
+
+ dictionary
+
+ |
+
+ Dict specifying the configuration options for the protocol mapper; the contents differ depending on the value of protocolMapper and are not documented other than by the source of the mappers and its parent class(es). An example is given below. It is easiest to obtain valid config values by dumping an already-existing protocol mapper configuration through check-mode in the existing field.
+ |
+
+
+
+
+
+ consentRequired
+
+
+ boolean
+
+ |
+
+ Specifies whether a user needs to provide consent to a client for this mapper to be active.
+ Choices:
+
+
+ |
+
+
+
+
+
+ consentText
+
+
+ string
+
+ |
+
+ The human-readable name of the consent the user is presented to accept.
+ |
+
+
+
+
+
+ id
+
+
+ string
+
+ |
+
+ Usually a UUID specifying the internal ID of this protocol mapper instance.
+ |
+
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ The name of this protocol mapper.
+ |
+
+
+
+
+
+ protocol
+
+
+ string
+
+ |
+
+ This is either openid-connect or saml, this specifies for which protocol this protocol mapper. is active.
+ Choices:
+
+ "openid-connect"
"saml"
+
+ |
+
+
+
+
+
+ protocolMapper
+
+
+ string
+
+ |
+
+ The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is impossible to provide since this may be extended through SPIs by the user of Keycloak, by default Keycloak as of 3.4 ships with at least
+ docker-v2-allow-all-mapper
+ oidc-address-mapper
+ oidc-full-name-mapper
+ oidc-group-membership-mapper
+ oidc-hardcoded-claim-mapper
+ oidc-hardcoded-role-mapper
+ oidc-role-name-mapper
+ oidc-script-based-protocol-mapper
+ oidc-sha256-pairwise-sub-mapper
+ oidc-usermodel-attribute-mapper
+ oidc-usermodel-client-role-mapper
+ oidc-usermodel-property-mapper
+ oidc-usermodel-realm-role-mapper
+ oidc-usersessionmodel-note-mapper
+ saml-group-membership-mapper
+ saml-hardcode-attribute-mapper
+ saml-hardcode-role-mapper
+ saml-role-list-mapper
+ saml-role-name-mapper
+ saml-user-attribute-mapper
+ saml-user-property-mapper
+ saml-user-session-note-mapper
+ An exhaustive list of available mappers on your installation can be obtained on the admin console by going to Server Info -> Providers and looking under 'protocol-mapper'.
+ |
+
+
+
+
+
+
+ public_client
+
+ aliases: publicClient
+
+ boolean
+
+ |
+
+ Is the access type for this client public or not. This is 'publicClient' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ realm
+
+
+ string
+
+ |
+
+ The realm to create the client in.
+ Default: "master"
+ |
+
+
+
+
+
+ redirect_uris
+
+ aliases: redirectUris
+
+ list
+ / elements=string
+
+ |
+
+ Acceptable redirect URIs for this client. This is 'redirectUris' in the Keycloak REST API.
+ |
+
+
+
+
+
+ registered_nodes
+
+ aliases: registeredNodes
+
+ dictionary
+
+ |
+
+ dict of registered cluster nodes (with nodename as the key and last registration time as the value). This is 'registeredNodes' in the Keycloak REST API.
+ |
+
+
+
+
+
+ registration_access_token
+
+ aliases: registrationAccessToken
+
+ string
+
+ |
+
+ The registration access token provides access for clients to the client registration service. This is 'registrationAccessToken' in the Keycloak REST API.
+ |
+
+
+
+
+
+ root_url
+
+ aliases: rootUrl
+
+ string
+
+ |
+
+ Root URL appended to relative URLs for this client. This is 'rootUrl' in the Keycloak REST API.
+ |
+
+
+
+
+ secret
+
+
+ string
+
+ |
+
+ When using client_authenticator_type client-secret (the default), you can specify a secret here (otherwise one will be generated if it does not exit). If changing this secret, the module will not register a change currently (but the changed secret will be saved).
+ |
+
+
+
+
+
+ service_accounts_enabled
+
+ aliases: serviceAccountsEnabled
+
+ boolean
+
+ |
+
+ Are service accounts enabled for this client or not (OpenID connect). This is 'serviceAccountsEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ standard_flow_enabled
+
+ aliases: standardFlowEnabled
+
+ boolean
+
+ |
+
+ Enable standard flow for this client or not (OpenID connect). This is 'standardFlowEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ state
+
+
+ string
+
+ |
+
+ State of the client
+ On present, the client will be created (or updated if it exists already).
+ On absent, the client will be removed if it exists
+ Choices:
+
+ "present" ← (default)
"absent"
+
+ |
+
+
+
+
+
+ surrogate_auth_required
+
+ aliases: surrogateAuthRequired
+
+ boolean
+
+ |
+
+ Whether or not surrogate auth is required. This is 'surrogateAuthRequired' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ token
+
+
+ string
+
+ added in middleware_automation.keycloak 3.0.0
+ |
+
+ Authentication token for Keycloak API.
+ |
+
+
+
+
+
+ use_template_config
+
+ aliases: useTemplateConfig
+
+ boolean
+
+ |
+
+ Whether or not to use configuration from the client_template. This is 'useTemplateConfig' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ use_template_mappers
+
+ aliases: useTemplateMappers
+
+ boolean
+
+ |
+
+ Whether or not to use mapper configuration from the client_template. This is 'useTemplateMappers' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ use_template_scope
+
+ aliases: useTemplateScope
+
+ boolean
+
+ |
+
+ Whether or not to use scope configuration from the client_template. This is 'useTemplateScope' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ validate_certs
+
+
+ boolean
+
+ |
+
+ Verify TLS certificates (do not disable this in production).
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+
+ web_origins
+
+ aliases: webOrigins
+
+ list
+ / elements=string
+
+ |
+
+ List of allowed CORS origins. This is 'webOrigins' in the Keycloak REST API.
+ |
+
+
+
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Parameter
- - Comments
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-admin_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-adminurl:
-
- .. rst-class:: ansible-option-title
-
- **admin_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: adminUrl`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- URL to the admin interface of the client. This is 'adminUrl' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-always_display_in_console:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-alwaysdisplayinconsole:
-
- .. rst-class:: ansible-option-title
-
- **always_display_in_console**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: alwaysDisplayInConsole`
-
- :ansible-option-type:`boolean`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.7.0`
-
-
- .. raw:: html
-
-
-
- Whether or not to display this client in account console, even if the user does not have an active session.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes:
-
- .. rst-class:: ansible-option-title
-
- **attributes**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- A dict of further attributes for this client. This can contain various configuration settings; an example is given in the examples section. While an exhaustive list of permissible options is not available; possible options as of Keycloak 3.4 are listed below. The Keycloak API does not validate whether a given option is appropriate for the protocol used; if specified anyway, Keycloak will simply not use it.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/jwks.url:
-
- .. rst-class:: ansible-option-title
-
- **jwks.url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For OpenID-Connect clients, URL where client keys in JWK are stored.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/jwt.credential.certificate:
-
- .. rst-class:: ansible-option-title
-
- **jwt.credential.certificate**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For OpenID-Connect clients, client certificate for validating JWT issued by client and signed by its key, base64-encoded.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/request.object.signature.alg:
-
- .. rst-class:: ansible-option-title
-
- **request.object.signature.alg**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For OpenID-Connect clients, JWA algorithm which the client needs to use when sending OIDC request object. One of \ :literal:`any`\ , \ :literal:`none`\ , \ :literal:`RS256`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.authnstatement:
-
- .. rst-class:: ansible-option-title
-
- **saml.authnstatement**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, boolean specifying whether or not a statement containing method and timestamp should be included in the login response.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.client.signature:
-
- .. rst-class:: ansible-option-title
-
- **saml.client.signature**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, boolean specifying whether a client signature is required and validated.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.encrypt:
-
- .. rst-class:: ansible-option-title
-
- **saml.encrypt**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Boolean specifying whether SAML assertions should be encrypted with the client's public key.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.force.post.binding:
-
- .. rst-class:: ansible-option-title
-
- **saml.force.post.binding**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, boolean specifying whether always to use POST binding for responses.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.onetimeuse.condition:
-
- .. rst-class:: ansible-option-title
-
- **saml.onetimeuse.condition**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, boolean specifying whether a OneTimeUse condition should be included in login responses.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.server.signature:
-
- .. rst-class:: ansible-option-title
-
- **saml.server.signature**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Boolean specifying whether SAML documents should be signed by the realm.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.server.signature.keyinfo.ext:
-
- .. rst-class:: ansible-option-title
-
- **saml.server.signature.keyinfo.ext**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, boolean specifying whether REDIRECT signing key lookup should be optimized through inclusion of the signing key id in the SAML Extensions element.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.signature.algorithm:
-
- .. rst-class:: ansible-option-title
-
- **saml.signature.algorithm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Signature algorithm used to sign SAML documents. One of \ :literal:`RSA\_SHA256`\ , \ :literal:`RSA\_SHA1`\ , \ :literal:`RSA\_SHA512`\ , or \ :literal:`DSA\_SHA1`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.signing.certificate:
-
- .. rst-class:: ansible-option-title
-
- **saml.signing.certificate**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML signing key certificate, base64-encoded.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml.signing.private.key:
-
- .. rst-class:: ansible-option-title
-
- **saml.signing.private.key**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML signing key private key, base64-encoded.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_assertion_consumer_url_post:
-
- .. rst-class:: ansible-option-title
-
- **saml_assertion_consumer_url_post**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML POST Binding URL for the client's assertion consumer service (login responses).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_assertion_consumer_url_redirect:
-
- .. rst-class:: ansible-option-title
-
- **saml_assertion_consumer_url_redirect**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML Redirect Binding URL for the client's assertion consumer service (login responses).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_force_name_id_format:
-
- .. rst-class:: ansible-option-title
-
- **saml_force_name_id_format**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, Boolean specifying whether to ignore requested NameID subject format and using the configured one instead.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_name_id_format:
-
- .. rst-class:: ansible-option-title
-
- **saml_name_id_format**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For SAML clients, the NameID format to use (one of \ :literal:`username`\ , \ :literal:`email`\ , \ :literal:`transient`\ , or \ :literal:`persistent`\ )
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_signature_canonicalization_method:
-
- .. rst-class:: ansible-option-title
-
- **saml_signature_canonicalization_method**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML signature canonicalization method. This is one of four values, namely \ :literal:`http://www.w3.org/2001/10/xml-exc-c14n#`\ for EXCLUSIVE, \ :literal:`http://www.w3.org/2001/10/xml-exc-c14n#WithComments`\ for EXCLUSIVE\_WITH\_COMMENTS, \ :literal:`http://www.w3.org/TR/2001/REC-xml-c14n-20010315`\ for INCLUSIVE, and \ :literal:`http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments`\ for INCLUSIVE\_WITH\_COMMENTS.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_single_logout_service_url_post:
-
- .. rst-class:: ansible-option-title
-
- **saml_single_logout_service_url_post**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML POST binding url for the client's single logout service.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/saml_single_logout_service_url_redirect:
-
- .. rst-class:: ansible-option-title
-
- **saml_single_logout_service_url_redirect**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- SAML redirect binding url for the client's single logout service.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/use.jwks.url:
-
- .. rst-class:: ansible-option-title
-
- **use.jwks.url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For OpenID-Connect clients, boolean specifying whether to use a JWKS URL to obtain client public keys.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-attributes/user.info.response.signature.alg:
-
- .. rst-class:: ansible-option-title
-
- **user.info.response.signature.alg**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of \ :literal:`RS256`\ or \ :literal:`unsigned`\ .
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_client_id:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- OpenID Connect \ :emphasis:`client\_id`\ to authenticate to the API with.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"admin-cli"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_client_secret:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_secret**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Client Secret to use in conjunction with \ :emphasis:`auth\_client\_id`\ (if required).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_keycloak_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-url:
-
- .. rst-class:: ansible-option-title
-
- **auth_keycloak_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: url`
-
- :ansible-option-type:`string` / :ansible-option-required:`required`
-
- .. raw:: html
-
-
-
- URL to the Keycloak instance.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_password:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-password:
-
- .. rst-class:: ansible-option-title
-
- **auth_password**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: password`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Password to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_realm:
-
- .. rst-class:: ansible-option-title
-
- **auth_realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Keycloak realm name to authenticate to for API access.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-auth_username:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-username:
-
- .. rst-class:: ansible-option-title
-
- **auth_username**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: username`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Username to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authentication_flow_binding_overrides:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authenticationflowbindingoverrides:
-
- .. rst-class:: ansible-option-title
-
- **authentication_flow_binding_overrides**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: authenticationFlowBindingOverrides`
-
- :ansible-option-type:`dictionary`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 3.4.0`
-
-
- .. raw:: html
-
-
-
- Override realm authentication flow bindings.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authorization_services_enabled:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authorizationservicesenabled:
-
- .. rst-class:: ansible-option-title
-
- **authorization_services_enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: authorizationServicesEnabled`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Are authorization services enabled for this client or not (OpenID connect). This is 'authorizationServicesEnabled' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authorization_settings:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-authorizationsettings:
-
- .. rst-class:: ansible-option-title
-
- **authorization_settings**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: authorizationSettings`
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- a data structure defining the authorization settings for this client. For reference, please see the Keycloak API docs at \ https://www.keycloak.org/docs-api/8.0/rest-api/index.html#_resourceserverrepresentation\ . This is 'authorizationSettings' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-base_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-baseurl:
-
- .. rst-class:: ansible-option-title
-
- **base_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: baseUrl`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Default URL to use when the auth server needs to redirect or link back to the client This is 'baseUrl' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-bearer_only:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-beareronly:
-
- .. rst-class:: ansible-option-title
-
- **bearer_only**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: bearerOnly`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- The access type of this client is bearer-only. This is 'bearerOnly' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-client_authenticator_type:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-clientauthenticatortype:
-
- .. rst-class:: ansible-option-title
-
- **client_authenticator_type**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: clientAuthenticatorType`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- How do clients authenticate with the auth server? Either \ :literal:`client-secret`\ or \ :literal:`client-jwt`\ can be chosen. When using \ :literal:`client-secret`\ , the module parameter \ :emphasis:`secret`\ can set it, while for \ :literal:`client-jwt`\ , you can use the keys \ :literal:`use.jwks.url`\ , \ :literal:`jwks.url`\ , and \ :literal:`jwt.credential.certificate`\ in the \ :emphasis:`attributes`\ module parameter to configure its behavior. This is 'clientAuthenticatorType' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"client-secret"`
- - :ansible-option-choices-entry:`"client-jwt"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-client_id:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-clientid:
-
- .. rst-class:: ansible-option-title
-
- **client_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: clientId`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Client id of client to be worked on. This is usually an alphanumeric name chosen by you. Either this or \ :emphasis:`id`\ is required. If you specify both, \ :emphasis:`id`\ takes precedence. This is 'clientId' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-client_template:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-clienttemplate:
-
- .. rst-class:: ansible-option-title
-
- **client_template**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: clientTemplate`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Client template to use for this client. If it does not exist this field will silently be dropped. This is 'clientTemplate' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-connection_timeout:
-
- .. rst-class:: ansible-option-title
-
- **connection_timeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.5.0`
-
-
- .. raw:: html
-
-
-
- Controls the HTTP connections timeout period (in seconds) to Keycloak API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`10`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-consent_required:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-consentrequired:
-
- .. rst-class:: ansible-option-title
-
- **consent_required**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: consentRequired`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- If enabled, users have to consent to client access. This is 'consentRequired' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-default_client_scopes:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-defaultclientscopes:
-
- .. rst-class:: ansible-option-title
-
- **default_client_scopes**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: defaultClientScopes`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.7.0`
-
-
- .. raw:: html
-
-
-
- List of default client scopes.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-default_roles:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-defaultroles:
-
- .. rst-class:: ansible-option-title
-
- **default_roles**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: defaultRoles`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=string`
-
- .. raw:: html
-
-
-
- list of default roles for this client. If the client roles referenced do not exist yet, they will be created. This is 'defaultRoles' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-description:
-
- .. rst-class:: ansible-option-title
-
- **description**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Description of the client in Keycloak.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-direct_access_grants_enabled:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-directaccessgrantsenabled:
-
- .. rst-class:: ansible-option-title
-
- **direct_access_grants_enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: directAccessGrantsEnabled`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Are direct access grants enabled for this client or not (OpenID connect). This is 'directAccessGrantsEnabled' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-enabled:
-
- .. rst-class:: ansible-option-title
-
- **enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Is this client enabled or not?
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-frontchannel_logout:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-frontchannellogout:
-
- .. rst-class:: ansible-option-title
-
- **frontchannel_logout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: frontchannelLogout`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Is frontchannel logout enabled for this client or not. This is 'frontchannelLogout' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-full_scope_allowed:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-fullscopeallowed:
-
- .. rst-class:: ansible-option-title
-
- **full_scope_allowed**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: fullScopeAllowed`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Is the "Full Scope Allowed" feature set for this client or not. This is 'fullScopeAllowed' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-http_agent:
-
- .. rst-class:: ansible-option-title
-
- **http_agent**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 5.4.0`
-
-
- .. raw:: html
-
-
-
- Configures the HTTP User-Agent header.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"Ansible"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-id:
-
- .. rst-class:: ansible-option-title
-
- **id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Id of client to be worked on. This is usually an UUID. Either this or \ :emphasis:`client\_id`\ is required. If you specify both, this takes precedence.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-implicit_flow_enabled:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-implicitflowenabled:
-
- .. rst-class:: ansible-option-title
-
- **implicit_flow_enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: implicitFlowEnabled`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable implicit flow for this client or not (OpenID connect). This is 'implicitFlowEnabled' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-name:
-
- .. rst-class:: ansible-option-title
-
- **name**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of the client (this is not the same as \ :emphasis:`client\_id`\ ).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-node_re_registration_timeout:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-nodereregistrationtimeout:
-
- .. rst-class:: ansible-option-title
-
- **node_re_registration_timeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: nodeReRegistrationTimeout`
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Cluster node re-registration timeout for this client. This is 'nodeReRegistrationTimeout' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-not_before:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-notbefore:
-
- .. rst-class:: ansible-option-title
-
- **not_before**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: notBefore`
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Revoke any tokens issued before this date for this client (this is a UNIX timestamp). This is 'notBefore' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-optional_client_scopes:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-optionalclientscopes:
-
- .. rst-class:: ansible-option-title
-
- **optional_client_scopes**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: optionalClientScopes`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.7.0`
-
-
- .. raw:: html
-
-
-
- List of optional client scopes.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol:
-
- .. rst-class:: ansible-option-title
-
- **protocol**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Type of client (either \ :literal:`openid-connect`\ or \ :literal:`saml`\ .
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"openid-connect"`
- - :ansible-option-choices-entry:`"saml"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers:
-
- .. rst-class:: ansible-option-title
-
- **protocol_mappers**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: protocolMappers`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=dictionary`
-
- .. raw:: html
-
-
-
- a list of dicts defining protocol mappers for this client. This is 'protocolMappers' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/config:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/config:
-
- .. rst-class:: ansible-option-title
-
- **config**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Dict specifying the configuration options for the protocol mapper; the contents differ depending on the value of \ :emphasis:`protocolMapper`\ and are not documented other than by the source of the mappers and its parent class(es). An example is given below. It is easiest to obtain valid config values by dumping an already-existing protocol mapper configuration through check-mode in the \ :emphasis:`existing`\ field.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/consentrequired:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/consentrequired:
-
- .. rst-class:: ansible-option-title
-
- **consentRequired**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Specifies whether a user needs to provide consent to a client for this mapper to be active.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/consenttext:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/consenttext:
-
- .. rst-class:: ansible-option-title
-
- **consentText**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The human-readable name of the consent the user is presented to accept.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/id:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/id:
-
- .. rst-class:: ansible-option-title
-
- **id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Usually a UUID specifying the internal ID of this protocol mapper instance.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/name:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/name:
-
- .. rst-class:: ansible-option-title
-
- **name**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The name of this protocol mapper.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/protocol:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/protocol:
-
- .. rst-class:: ansible-option-title
-
- **protocol**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- This is either \ :literal:`openid-connect`\ or \ :literal:`saml`\ , this specifies for which protocol this protocol mapper. is active.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"openid-connect"`
- - :ansible-option-choices-entry:`"saml"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocol_mappers/protocolmapper:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-protocolmappers/protocolmapper:
-
- .. rst-class:: ansible-option-title
-
- **protocolMapper**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is impossible to provide since this may be extended through SPIs by the user of Keycloak, by default Keycloak as of 3.4 ships with at least
-
- \ :literal:`docker-v2-allow-all-mapper`\
-
- \ :literal:`oidc-address-mapper`\
-
- \ :literal:`oidc-full-name-mapper`\
-
- \ :literal:`oidc-group-membership-mapper`\
-
- \ :literal:`oidc-hardcoded-claim-mapper`\
-
- \ :literal:`oidc-hardcoded-role-mapper`\
-
- \ :literal:`oidc-role-name-mapper`\
-
- \ :literal:`oidc-script-based-protocol-mapper`\
-
- \ :literal:`oidc-sha256-pairwise-sub-mapper`\
-
- \ :literal:`oidc-usermodel-attribute-mapper`\
-
- \ :literal:`oidc-usermodel-client-role-mapper`\
-
- \ :literal:`oidc-usermodel-property-mapper`\
-
- \ :literal:`oidc-usermodel-realm-role-mapper`\
-
- \ :literal:`oidc-usersessionmodel-note-mapper`\
-
- \ :literal:`saml-group-membership-mapper`\
-
- \ :literal:`saml-hardcode-attribute-mapper`\
-
- \ :literal:`saml-hardcode-role-mapper`\
-
- \ :literal:`saml-role-list-mapper`\
-
- \ :literal:`saml-role-name-mapper`\
-
- \ :literal:`saml-user-attribute-mapper`\
-
- \ :literal:`saml-user-property-mapper`\
-
- \ :literal:`saml-user-session-note-mapper`\
-
- An exhaustive list of available mappers on your installation can be obtained on the admin console by going to Server Info -\> Providers and looking under 'protocol-mapper'.
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-public_client:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-publicclient:
-
- .. rst-class:: ansible-option-title
-
- **public_client**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: publicClient`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Is the access type for this client public or not. This is 'publicClient' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-realm:
-
- .. rst-class:: ansible-option-title
-
- **realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The realm to create the client in.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"master"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-redirect_uris:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-redirecturis:
-
- .. rst-class:: ansible-option-title
-
- **redirect_uris**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: redirectUris`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=string`
-
- .. raw:: html
-
-
-
- Acceptable redirect URIs for this client. This is 'redirectUris' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-registered_nodes:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-registerednodes:
-
- .. rst-class:: ansible-option-title
-
- **registered_nodes**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: registeredNodes`
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- dict of registered cluster nodes (with \ :literal:`nodename`\ as the key and last registration time as the value). This is 'registeredNodes' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-registration_access_token:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-registrationaccesstoken:
-
- .. rst-class:: ansible-option-title
-
- **registration_access_token**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: registrationAccessToken`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The registration access token provides access for clients to the client registration service. This is 'registrationAccessToken' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-root_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-rooturl:
-
- .. rst-class:: ansible-option-title
-
- **root_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: rootUrl`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Root URL appended to relative URLs for this client. This is 'rootUrl' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-secret:
-
- .. rst-class:: ansible-option-title
-
- **secret**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- When using \ :emphasis:`client\_authenticator\_type`\ \ :literal:`client-secret`\ (the default), you can specify a secret here (otherwise one will be generated if it does not exit). If changing this secret, the module will not register a change currently (but the changed secret will be saved).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-service_accounts_enabled:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-serviceaccountsenabled:
-
- .. rst-class:: ansible-option-title
-
- **service_accounts_enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: serviceAccountsEnabled`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Are service accounts enabled for this client or not (OpenID connect). This is 'serviceAccountsEnabled' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-standard_flow_enabled:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-standardflowenabled:
-
- .. rst-class:: ansible-option-title
-
- **standard_flow_enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: standardFlowEnabled`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable standard flow for this client or not (OpenID connect). This is 'standardFlowEnabled' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-state:
-
- .. rst-class:: ansible-option-title
-
- **state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- State of the client
-
- On \ :literal:`present`\ , the client will be created (or updated if it exists already).
-
- On \ :literal:`absent`\ , the client will be removed if it exists
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"present"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"absent"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-surrogate_auth_required:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-surrogateauthrequired:
-
- .. rst-class:: ansible-option-title
-
- **surrogate_auth_required**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: surrogateAuthRequired`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Whether or not surrogate auth is required. This is 'surrogateAuthRequired' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-token:
-
- .. rst-class:: ansible-option-title
-
- **token**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 3.0.0`
-
-
- .. raw:: html
-
-
-
- Authentication token for Keycloak API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-use_template_config:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-usetemplateconfig:
-
- .. rst-class:: ansible-option-title
-
- **use_template_config**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: useTemplateConfig`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Whether or not to use configuration from the \ :emphasis:`client\_template`\ . This is 'useTemplateConfig' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-use_template_mappers:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-usetemplatemappers:
-
- .. rst-class:: ansible-option-title
-
- **use_template_mappers**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: useTemplateMappers`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Whether or not to use mapper configuration from the \ :emphasis:`client\_template`\ . This is 'useTemplateMappers' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-use_template_scope:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-usetemplatescope:
-
- .. rst-class:: ansible-option-title
-
- **use_template_scope**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: useTemplateScope`
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Whether or not to use scope configuration from the \ :emphasis:`client\_template`\ . This is 'useTemplateScope' in the Keycloak REST API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-validate_certs:
-
- .. rst-class:: ansible-option-title
-
- **validate_certs**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Verify TLS certificates (do not disable this in production).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-web_origins:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__parameter-weborigins:
-
- .. rst-class:: ansible-option-title
-
- **web_origins**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: webOrigins`
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=string`
-
- .. raw:: html
-
-
-
- List of allowed CORS origins. This is 'webOrigins' in the Keycloak REST API.
-
-
- .. raw:: html
-
-
.. Attributes
@@ -3741,195 +1644,78 @@ Return Values
-------------
Common return values are documented :ref:`here `, the following are the fields unique to this module:
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
-
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Key
- - Description
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__return-end_state:
-
- .. rst-class:: ansible-option-title
-
- **end_state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of client after module execution (sample is truncated).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` on success
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"adminUrl": "http://www.example.com/admin\_url", "attributes": {"request.object.signature.alg": "RS256"}}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__return-existing:
-
- .. rst-class:: ansible-option-title
-
- **existing**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of existing client (sample is truncated).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"adminUrl": "http://www.example.com/admin\_url", "attributes": {"request.object.signature.alg": "RS256"}}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__return-msg:
-
- .. rst-class:: ansible-option-title
-
- **msg**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Message as to what action was taken.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`"Client testclient has been updated"`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_client_module__return-proposed:
-
- .. rst-class:: ansible-option-title
-
- **proposed**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of proposed client.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"clientId": "test"}`
-
-
- .. raw:: html
-
-
+.. raw:: html
+
+
+
+
+ Key |
+ Description |
+
+
+
+
+
+
+ end_state
+
+
+ dictionary
+
+ |
+
+ Representation of client after module execution (sample is truncated).
+ Returned: on success
+ Sample: {"adminUrl": "http://www.example.com/admin_url", "attributes": {"request.object.signature.alg": "RS256"}}
+ |
+
+
+
+
+ existing
+
+
+ dictionary
+
+ |
+
+ Representation of existing client (sample is truncated).
+ Returned: always
+ Sample: {"adminUrl": "http://www.example.com/admin_url", "attributes": {"request.object.signature.alg": "RS256"}}
+ |
+
+
+ |
+
+ Message as to what action was taken.
+ Returned: always
+ Sample: "Client testclient has been updated"
+ |
+
+
+
+
+ proposed
+
+
+ dictionary
+
+ |
+
+ Representation of proposed client.
+ Returned: always
+ Sample: {"clientId": "test"}
+ |
+
+
+
diff --git a/main/_sources/plugins/keycloak_role.rst.txt b/main/_sources/plugins/keycloak_role.rst.txt
index d7e9016..dd3579d 100644
--- a/main/_sources/plugins/keycloak_role.rst.txt
+++ b/main/_sources/plugins/keycloak_role.rst.txt
@@ -70,623 +70,259 @@ Synopsis
Parameters
----------
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
+.. raw:: html
+
+
+
+
+ Parameter |
+ Comments |
+
+
+
+
+
+
+ attributes
+
+
+ dictionary
+
+ |
+
+ A dict of key/value pairs to set as custom attributes for the role.
+ Values may be single values (e.g. a string) or a list of strings.
+ |
+
+
+
+
+ auth_client_id
+
+
+ string
+
+ |
+
+ OpenID Connect client_id to authenticate to the API with.
+ Default: "admin-cli"
+ |
+
+
+
+
+ auth_client_secret
+
+
+ string
+
+ |
+
+ Client Secret to use in conjunction with auth_client_id (if required).
+ |
+
+
+
+
+
+ auth_keycloak_url
+
+ aliases: url
+
+ string
+ / required
+
+ |
+
+ URL to the Keycloak instance.
+ |
+
+
+
+
+
+ auth_password
+
+ aliases: password
+
+ string
+
+ |
+
+ Password to authenticate for API access with.
+ |
+
+
+
+
+ auth_realm
+
+
+ string
+
+ |
+
+ Keycloak realm name to authenticate to for API access.
+ |
+
+
+
+
+
+ auth_username
+
+ aliases: username
+
+ string
+
+ |
+
+ Username to authenticate for API access with.
+ |
+
+
+
+
+ client_id
+
+
+ string
+
+ |
+
+ If the role is a client role, the client id under which it resides.
+ If this parameter is absent, the role is considered a realm role.
+ |
+
+
+
+
+ connection_timeout
+
+
+ integer
+
+ added in middleware_automation.keycloak 4.5.0
+ |
+
+ Controls the HTTP connections timeout period (in seconds) to Keycloak API.
+ Default: 10
+ |
+
+
+
+
+ description
+
+
+ string
+
+ |
+
+ The role description.
+ |
+
+
+
+
+ http_agent
+
+
+ string
+
+ added in middleware_automation.keycloak 5.4.0
+ |
+
+ Configures the HTTP User-Agent header.
+ Default: "Ansible"
+ |
+
+
+
+
+ name
+
+
+ string
+ / required
+
+ |
+
+ Name of the role.
+ This parameter is required.
+ |
+
+
+
+
+ realm
+
+
+ string
+
+ |
+
+ The Keycloak realm under which this role resides.
+ Default: "master"
+ |
+
+
+
+
+ state
+
+
+ string
+
+ |
+
+ State of the role.
+ On present, the role will be created if it does not yet exist, or updated with the parameters you provide.
+ On absent, the role will be removed if it exists.
+ Choices:
+
+ "present" ← (default)
"absent"
+
+ |
+
+
+
+
+ token
+
+
+ string
+
+ added in middleware_automation.keycloak 3.0.0
+ |
+
+ Authentication token for Keycloak API.
+ |
+
+
+
+
+ validate_certs
+
+
+ boolean
+
+ |
+
+ Verify TLS certificates (do not disable this in production).
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Parameter
- - Comments
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-attributes:
-
- .. rst-class:: ansible-option-title
-
- **attributes**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- A dict of key/value pairs to set as custom attributes for the role.
-
- Values may be single values (e.g. a string) or a list of strings.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_client_id:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- OpenID Connect \ :emphasis:`client\_id`\ to authenticate to the API with.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"admin-cli"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_client_secret:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_secret**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Client Secret to use in conjunction with \ :emphasis:`auth\_client\_id`\ (if required).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_keycloak_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-url:
-
- .. rst-class:: ansible-option-title
-
- **auth_keycloak_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: url`
-
- :ansible-option-type:`string` / :ansible-option-required:`required`
-
- .. raw:: html
-
-
-
- URL to the Keycloak instance.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_password:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-password:
-
- .. rst-class:: ansible-option-title
-
- **auth_password**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: password`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Password to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_realm:
-
- .. rst-class:: ansible-option-title
-
- **auth_realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Keycloak realm name to authenticate to for API access.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-auth_username:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-username:
-
- .. rst-class:: ansible-option-title
-
- **auth_username**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: username`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Username to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-client_id:
-
- .. rst-class:: ansible-option-title
-
- **client_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- If the role is a client role, the client id under which it resides.
-
- If this parameter is absent, the role is considered a realm role.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-connection_timeout:
-
- .. rst-class:: ansible-option-title
-
- **connection_timeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.5.0`
-
-
- .. raw:: html
-
-
-
- Controls the HTTP connections timeout period (in seconds) to Keycloak API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`10`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-description:
-
- .. rst-class:: ansible-option-title
-
- **description**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The role description.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-http_agent:
-
- .. rst-class:: ansible-option-title
-
- **http_agent**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 5.4.0`
-
-
- .. raw:: html
-
-
-
- Configures the HTTP User-Agent header.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"Ansible"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-name:
-
- .. rst-class:: ansible-option-title
-
- **name**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string` / :ansible-option-required:`required`
-
- .. raw:: html
-
-
-
- Name of the role.
-
- This parameter is required.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-realm:
-
- .. rst-class:: ansible-option-title
-
- **realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The Keycloak realm under which this role resides.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"master"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-state:
-
- .. rst-class:: ansible-option-title
-
- **state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- State of the role.
-
- On \ :literal:`present`\ , the role will be created if it does not yet exist, or updated with the parameters you provide.
-
- On \ :literal:`absent`\ , the role will be removed if it exists.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"present"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"absent"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-token:
-
- .. rst-class:: ansible-option-title
-
- **token**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 3.0.0`
-
-
- .. raw:: html
-
-
-
- Authentication token for Keycloak API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__parameter-validate_certs:
-
- .. rst-class:: ansible-option-title
-
- **validate_certs**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Verify TLS certificates (do not disable this in production).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
.. Attributes
@@ -883,195 +519,78 @@ Return Values
-------------
Common return values are documented :ref:`here `, the following are the fields unique to this module:
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
-
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Key
- - Description
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__return-end_state:
-
- .. rst-class:: ansible-option-title
-
- **end_state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of role after module execution (sample is truncated).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` on success
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My updated client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__return-existing:
-
- .. rst-class:: ansible-option-title
-
- **existing**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of existing role.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__return-msg:
-
- .. rst-class:: ansible-option-title
-
- **msg**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Message as to what action was taken.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`"Role myrole has been updated"`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__return-proposed:
-
- .. rst-class:: ansible-option-title
-
- **proposed**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of proposed role.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"description": "My updated test description"}`
-
-
- .. raw:: html
-
-
+.. raw:: html
+
+
+
+
+ Key |
+ Description |
+
+
+
+
+
+
+ end_state
+
+
+ dictionary
+
+ |
+
+ Representation of role after module execution (sample is truncated).
+ Returned: on success
+ Sample: {"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My updated client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}
+ |
+
+
+
+
+ existing
+
+
+ dictionary
+
+ |
+
+ Representation of existing role.
+ Returned: always
+ Sample: {"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}
+ |
+
+
+ |
+
+ Message as to what action was taken.
+ Returned: always
+ Sample: "Role myrole has been updated"
+ |
+
+
+
+
+ proposed
+
+
+ dictionary
+
+ |
+
+ Representation of proposed role.
+ Returned: always
+ Sample: {"description": "My updated test description"}
+ |
+
+
+
diff --git a/main/_sources/plugins/keycloak_user_federation.rst.txt b/main/_sources/plugins/keycloak_user_federation.rst.txt
index a52d0ae..55b959c 100644
--- a/main/_sources/plugins/keycloak_user_federation.rst.txt
+++ b/main/_sources/plugins/keycloak_user_federation.rst.txt
@@ -69,3246 +69,1159 @@ Synopsis
Parameters
----------
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
+.. raw:: html
+
+
+
+
+ Parameter |
+ Comments |
+
+
+
+
+
+
+ auth_client_id
+
+
+ string
+
+ |
+
+ OpenID Connect client_id to authenticate to the API with.
+ Default: "admin-cli"
+ |
+
+
+
+
+ auth_client_secret
+
+
+ string
+
+ |
+
+ Client Secret to use in conjunction with auth_client_id (if required).
+ |
+
+
+
+
+
+ auth_keycloak_url
+
+ aliases: url
+
+ string
+ / required
+
+ |
+
+ URL to the Keycloak instance.
+ |
+
+
+
+
+
+ auth_password
+
+ aliases: password
+
+ string
+
+ |
+
+ Password to authenticate for API access with.
+ |
+
+
+
+
+ auth_realm
+
+
+ string
+
+ |
+
+ Keycloak realm name to authenticate to for API access.
+ |
+
+
+
+
+
+ auth_username
+
+ aliases: username
+
+ string
+
+ |
+
+ Username to authenticate for API access with.
+ |
+
+
+
+
+ config
+
+
+ dictionary
+
+ |
+
+ Dict specifying the configuration options for the provider; the contents differ depending on the value of provider_id. Examples are given below for ldap, kerberos and sssd. It is easiest to obtain valid config values by dumping an already-existing user federation configuration through check-mode in the existing field.
+ The value sssd has been supported since middleware_automation.keycloak 1.0.0.
+ |
+
+
+
+
+ allowKerberosAuthentication
+
+
+ boolean
+
+ |
+
+ Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ allowPasswordAuthentication
+
+
+ boolean
+
+ |
+
+ Enable/disable possibility of username/password authentication against Kerberos database.
+ Choices:
+
+
+ |
+
+
+
+
+ authType
+
+
+ string
+
+ |
+
+ Type of the Authentication method used during LDAP Bind operation. It is used in most of the requests sent to the LDAP server.
+ Choices:
+
+ "none" ← (default)
"simple"
+
+ |
+
+
+
+
+ batchSizeForSync
+
+
+ integer
+
+ |
+
+ Count of LDAP users to be imported from LDAP to Keycloak within a single transaction.
+ Default: 1000
+ |
+
+
+
+
+ bindCredential
+
+
+ string
+
+ |
+
+ Password of LDAP admin.
+ |
+
+
+
+
+ bindDn
+
+
+ string
+
+ |
+
+ DN of LDAP user which will be used by Keycloak to access LDAP server.
+ |
+
+
+
+
+ cachePolicy
+
+
+ string
+
+ |
+
+ Cache Policy for this storage provider.
+ Choices:
+
+ "DEFAULT" ← (default)
"EVICT_DAILY"
"EVICT_WEEKLY"
"MAX_LIFESPAN"
"NO_CACHE"
+
+ |
+
+
+
+
+ changedSyncPeriod
+
+
+ integer
+
+ |
+
+ Period for synchronization of changed or newly created LDAP users in seconds.
+ Default: -1
+ |
+
+
+
+
+ connectionPooling
+
+
+ boolean
+
+ |
+
+ Determines if Keycloak should use connection pooling for accessing LDAP server.
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+ connectionPoolingAuthentication
+
+
+ string
+
+ |
+
+ A list of space-separated authentication types of connections that may be pooled.
+ Choices:
+
+ "none"
"simple"
"DIGEST-MD5"
+
+ |
+
+
+
+
+ connectionPoolingDebug
+
+
+ string
+
+ |
+
+ A string that indicates the level of debug output to produce. Example valid values are fine (trace connection creation and removal) and all (all debugging information).
+ |
+
+
+
+
+ connectionPoolingInitSize
+
+
+ integer
+
+ |
+
+ The number of connections per connection identity to create when initially creating a connection for the identity.
+ |
+
+
+
+
+ connectionPoolingMaxSize
+
+
+ integer
+
+ |
+
+ The maximum number of connections per connection identity that can be maintained concurrently.
+ |
+
+
+
+
+ connectionPoolingPrefSize
+
+
+ integer
+
+ |
+
+ The preferred number of connections per connection identity that should be maintained concurrently.
+ |
+
+
+
+
+ connectionPoolingProtocol
+
+
+ string
+
+ |
+
+ A list of space-separated protocol types of connections that may be pooled. Valid types are plain and ssl.
+ |
+
+
+
+
+ connectionPoolingTimeout
+
+
+ integer
+
+ |
+
+ The number of milliseconds that an idle connection may remain in the pool without being closed and removed from the pool.
+ |
+
+
+
+
+ connectionTimeout
+
+
+ integer
+
+ |
+
+ LDAP Connection Timeout in milliseconds.
+ |
+
+
+
+
+ connectionUrl
+
+
+ string
+
+ |
+
+ Connection URL to your LDAP server.
+ |
+
+
+
+
+ customUserSearchFilter
+
+
+ string
+
+ |
+
+ Additional LDAP Filter for filtering searched users. Leave this empty if you don't need additional filter.
+ |
+
+
+
+
+ debug
+
+
+ boolean
+
+ |
+
+ Enable/disable debug logging to standard output for Krb5LoginModule.
+ Choices:
+
+
+ |
+
+
+
+
+ editMode
+
+
+ string
+
+ |
+
+ READ_ONLY is a read-only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP.
+ Choices:
+
+ "READ_ONLY"
"WRITABLE"
"UNSYNCED"
+
+ |
+
+
+
+
+ enabled
+
+
+ boolean
+
+ |
+
+ Enable/disable this user federation.
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+ evictionDay
+
+
+ string
+
+ |
+
+ Day of the week the entry will become invalid on.
+ |
+
+
+
+
+ evictionHour
+
+
+ string
+
+ |
+
+ Hour of day the entry will become invalid on.
+ |
+
+
+
+
+ evictionMinute
+
+
+ string
+
+ |
+
+ Minute of day the entry will become invalid on.
+ |
+
+
+
+
+ fullSyncPeriod
+
+
+ integer
+
+ |
+
+ Period for full synchronization in seconds.
+ Default: -1
+ |
+
+
+
+
+ importEnabled
+
+
+ boolean
+
+ |
+
+ If true, LDAP users will be imported into Keycloak DB and synced by the configured sync policies.
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+ kerberosRealm
+
+
+ string
+
+ |
+
+ Name of kerberos realm.
+ |
+
+
+
+
+ keyTab
+
+
+ string
+
+ |
+
+ Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab.
+ |
+
+
+
+
+ maxLifespan
+
+
+ integer
+
+ |
+
+ Max lifespan of cache entry in milliseconds.
+ |
+
+
+
+
+ pagination
+
+
+ boolean
+
+ |
+
+ Does the LDAP server support pagination.
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+ priority
+
+
+ integer
+
+ |
+
+ Priority of provider when doing a user lookup. Lowest first.
+ Default: 0
+ |
+
+
+
+
+ rdnLDAPAttribute
+
+
+ string
+
+ |
+
+ Name of LDAP attribute, which is used as RDN (top attribute) of typical user DN. Usually it's the same as Username LDAP attribute, however it is not required. For example for Active directory, it is common to use cn as RDN attribute when username attribute might be sAMAccountName.
+ |
+
+
+
+
+ readTimeout
+
+
+ integer
+
+ |
+
+ LDAP Read Timeout in milliseconds. This timeout applies for LDAP read operations.
+ |
+
+
+
+
+ searchScope
+
+
+ string
+
+ |
+
+ For one level, the search applies only for users in the DNs specified by User DNs. For subtree, the search applies to the whole subtree. See LDAP documentation for more details.
+ Choices:
+
+ "1" ← (default)
"2"
+
+ |
+
+
+
+
+ serverPrincipal
+
+
+ string
+
+ |
+
+ Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG. Use * to accept any service principal in the KeyTab file.
+ |
+
+
+
+
+ startTls
+
+
+ boolean
+
+ |
+
+ Encrypts the connection to LDAP using STARTTLS, which will disable connection pooling.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ syncRegistrations
+
+
+ boolean
+
+ |
+
+ Should newly created users be created within LDAP store? Priority effects which provider is chosen to sync the new user.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ trustEmail
+
+
+ boolean
+
+ |
+
+ If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ updateProfileFirstLogin
+
+
+ boolean
+
+ |
+
+ Update profile on first login.
+ Choices:
+
+
+ |
+
+
+
+
+ useKerberosForPasswordAuthentication
+
+
+ boolean
+
+ |
+
+ Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ usePasswordModifyExtendedOp
+
+
+ boolean
+
+ |
+
+ Use the LDAPv3 Password Modify Extended Operation (RFC-3062). The password modify extended operation usually requires that LDAP user already has password in the LDAP server. So when this is used with 'Sync Registrations', it can be good to add also 'Hardcoded LDAP attribute mapper' with randomly generated initial password.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ usernameLDAPAttribute
+
+
+ string
+
+ |
+
+ Name of LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it can be uid. For Active directory it can be sAMAccountName or cn. The attribute should be filled for all LDAP user records you want to import from LDAP to Keycloak.
+ |
+
+
+
+
+ userObjectClasses
+
+
+ string
+
+ |
+
+ All values of LDAP objectClass attribute for users in LDAP divided by comma. For example inetOrgPerson, organizationalPerson. Newly created Keycloak users will be written to LDAP with all those object classes and existing LDAP user records are found just if they contain all those object classes.
+ |
+
+
+
+
+ usersDn
+
+
+ string
+
+ |
+
+ Full DN of LDAP tree where your users are. This DN is the parent of LDAP users.
+ |
+
+
+
+
+ useTruststoreSpi
+
+
+ string
+
+ |
+
+ Specifies whether LDAP connection will use the truststore SPI with the truststore configured in standalone.xml/domain.xml. Always means that it will always use it. Never means that it will not use it. Only for ldaps means that it will use if your connection URL use ldaps. Note even if standalone.xml/domain.xml is not configured, the default Java cacerts or certificate specified by javax.net.ssl.trustStore property will be used.
+ Choices:
+
+ "always"
"ldapsOnly" ← (default)
"never"
+
+ |
+
+
+
+
+ uuidLDAPAttribute
+
+
+ string
+
+ |
+
+ Name of LDAP attribute, which is used as unique object identifier (UUID) for objects in LDAP. For many LDAP server vendors, it is entryUUID; however some are different. For example for Active directory it should be objectGUID. If your LDAP server does not support the notion of UUID, you can use any other attribute that is supposed to be unique among LDAP users in tree.
+ |
+
+
+
+
+ validatePasswordPolicy
+
+
+ boolean
+
+ |
+
+ Determines if Keycloak should validate the password with the realm password policy before updating it.
+ Choices:
+
+ false ← (default)
true
+
+ |
+
+
+
+
+ vendor
+
+
+ string
+
+ |
+
+ LDAP vendor (provider).
+ Use short name. For instance, write rhds for "Red Hat Directory Server".
+ |
+
+
+
+
+
+ connection_timeout
+
+
+ integer
+
+ added in middleware_automation.keycloak 4.5.0
+ |
+
+ Controls the HTTP connections timeout period (in seconds) to Keycloak API.
+ Default: 10
+ |
+
+
+
+
+ http_agent
+
+
+ string
+
+ added in middleware_automation.keycloak 5.4.0
+ |
+
+ Configures the HTTP User-Agent header.
+ Default: "Ansible"
+ |
+
+
+ |
+
+ The unique ID for this user federation. If left empty, the user federation will be searched by its name.
+ |
+
+
+
+
+ mappers
+
+
+ list
+ / elements=dictionary
+
+ |
+
+ A list of dicts defining mappers associated with this Identity Provider.
+ |
+
+
+
+
+ config
+
+
+ dictionary
+
+ |
+
+ Dict specifying the configuration options for the mapper; the contents differ depending on the value of identityProviderMapper.
+ |
+
+
+ |
+
+ Unique ID of this mapper.
+ |
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ Name of the mapper. If no ID is given, the mapper will be searched by name.
+ |
+
+
+
+
+ parentId
+
+
+ string
+
+ |
+
+ Unique ID for the parent of this mapper. ID of the user federation will automatically be used if left blank.
+ |
+
+
+
+
+ providerId
+
+
+ string
+
+ |
+
+ The mapper type for this mapper (for instance user-attribute-ldap-mapper).
+ |
+
+
+
+
+ providerType
+
+
+ string
+
+ |
+
+ Component type for this mapper.
+ Default: "org.keycloak.storage.ldap.mappers.LDAPStorageMapper"
+ |
+
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ Display name of provider when linked in admin console.
+ |
+
+
+
+
+
+ parent_id
+
+ aliases: parentId
+
+ string
+
+ |
+
+ Unique ID for the parent of this user federation. Realm ID will be automatically used if left blank.
+ |
+
+
+
+
+
+ provider_id
+
+ aliases: providerId
+
+ string
+
+ |
+
+ Provider for this user federation.
+ Choices:
+
+ "ldap"
"kerberos"
"sssd"
+
+ |
+
+
+
+
+
+ provider_type
+
+ aliases: providerType
+
+ string
+
+ |
+
+ Component type for user federation (only supported value is org.keycloak.storage.UserStorageProvider).
+ Default: "org.keycloak.storage.UserStorageProvider"
+ |
+
+
+
+
+ realm
+
+
+ string
+
+ |
+
+ The Keycloak realm under which this user federation resides.
+ Default: "master"
+ |
+
+
+
+
+ state
+
+
+ string
+
+ |
+
+ State of the user federation.
+ On present, the user federation will be created if it does not yet exist, or updated with the parameters you provide.
+ On absent, the user federation will be removed if it exists.
+ Choices:
+
+ "present" ← (default)
"absent"
+
+ |
+
+
+
+
+ token
+
+
+ string
+
+ added in middleware_automation.keycloak 3.0.0
+ |
+
+ Authentication token for Keycloak API.
+ |
+
+
+
+
+ validate_certs
+
+
+ boolean
+
+ |
+
+ Verify TLS certificates (do not disable this in production).
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Parameter
- - Comments
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_client_id:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- OpenID Connect \ :emphasis:`client\_id`\ to authenticate to the API with.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"admin-cli"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_client_secret:
-
- .. rst-class:: ansible-option-title
-
- **auth_client_secret**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Client Secret to use in conjunction with \ :emphasis:`auth\_client\_id`\ (if required).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_keycloak_url:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-url:
-
- .. rst-class:: ansible-option-title
-
- **auth_keycloak_url**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: url`
-
- :ansible-option-type:`string` / :ansible-option-required:`required`
-
- .. raw:: html
-
-
-
- URL to the Keycloak instance.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_password:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-password:
-
- .. rst-class:: ansible-option-title
-
- **auth_password**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: password`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Password to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_realm:
-
- .. rst-class:: ansible-option-title
-
- **auth_realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Keycloak realm name to authenticate to for API access.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-auth_username:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-username:
-
- .. rst-class:: ansible-option-title
-
- **auth_username**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: username`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Username to authenticate for API access with.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config:
-
- .. rst-class:: ansible-option-title
-
- **config**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Dict specifying the configuration options for the provider; the contents differ depending on the value of \ :emphasis:`provider\_id`\ . Examples are given below for \ :literal:`ldap`\ , \ :literal:`kerberos`\ and \ :literal:`sssd`\ . It is easiest to obtain valid config values by dumping an already-existing user federation configuration through check-mode in the \ :emphasis:`existing`\ field.
-
- The value \ :literal:`sssd`\ has been supported since middleware\_automation.keycloak 1.0.0.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/allowkerberosauthentication:
-
- .. rst-class:: ansible-option-title
-
- **allowKerberosAuthentication**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/allowpasswordauthentication:
-
- .. rst-class:: ansible-option-title
-
- **allowPasswordAuthentication**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable/disable possibility of username/password authentication against Kerberos database.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/authtype:
-
- .. rst-class:: ansible-option-title
-
- **authType**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Type of the Authentication method used during LDAP Bind operation. It is used in most of the requests sent to the LDAP server.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"none"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"simple"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/batchsizeforsync:
-
- .. rst-class:: ansible-option-title
-
- **batchSizeForSync**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Count of LDAP users to be imported from LDAP to Keycloak within a single transaction.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`1000`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/bindcredential:
-
- .. rst-class:: ansible-option-title
-
- **bindCredential**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Password of LDAP admin.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/binddn:
-
- .. rst-class:: ansible-option-title
-
- **bindDn**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- DN of LDAP user which will be used by Keycloak to access LDAP server.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/cachepolicy:
-
- .. rst-class:: ansible-option-title
-
- **cachePolicy**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Cache Policy for this storage provider.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"DEFAULT"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"EVICT\_DAILY"`
- - :ansible-option-choices-entry:`"EVICT\_WEEKLY"`
- - :ansible-option-choices-entry:`"MAX\_LIFESPAN"`
- - :ansible-option-choices-entry:`"NO\_CACHE"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/changedsyncperiod:
-
- .. rst-class:: ansible-option-title
-
- **changedSyncPeriod**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Period for synchronization of changed or newly created LDAP users in seconds.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`-1`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpooling:
-
- .. rst-class:: ansible-option-title
-
- **connectionPooling**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Determines if Keycloak should use connection pooling for accessing LDAP server.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingauthentication:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingAuthentication**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- A list of space-separated authentication types of connections that may be pooled.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"none"`
- - :ansible-option-choices-entry:`"simple"`
- - :ansible-option-choices-entry:`"DIGEST-MD5"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingdebug:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingDebug**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- A string that indicates the level of debug output to produce. Example valid values are \ :literal:`fine`\ (trace connection creation and removal) and \ :literal:`all`\ (all debugging information).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolinginitsize:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingInitSize**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- The number of connections per connection identity to create when initially creating a connection for the identity.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingmaxsize:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingMaxSize**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- The maximum number of connections per connection identity that can be maintained concurrently.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingprefsize:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingPrefSize**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- The preferred number of connections per connection identity that should be maintained concurrently.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingprotocol:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingProtocol**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- A list of space-separated protocol types of connections that may be pooled. Valid types are \ :literal:`plain`\ and \ :literal:`ssl`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionpoolingtimeout:
-
- .. rst-class:: ansible-option-title
-
- **connectionPoolingTimeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- The number of milliseconds that an idle connection may remain in the pool without being closed and removed from the pool.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectiontimeout:
-
- .. rst-class:: ansible-option-title
-
- **connectionTimeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- LDAP Connection Timeout in milliseconds.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/connectionurl:
-
- .. rst-class:: ansible-option-title
-
- **connectionUrl**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Connection URL to your LDAP server.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/customusersearchfilter:
-
- .. rst-class:: ansible-option-title
-
- **customUserSearchFilter**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Additional LDAP Filter for filtering searched users. Leave this empty if you don't need additional filter.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/debug:
-
- .. rst-class:: ansible-option-title
-
- **debug**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable/disable debug logging to standard output for Krb5LoginModule.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/editmode:
-
- .. rst-class:: ansible-option-title
-
- **editMode**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- \ :literal:`READ\_ONLY`\ is a read-only LDAP store. \ :literal:`WRITABLE`\ means data will be synced back to LDAP on demand. \ :literal:`UNSYNCED`\ means user data will be imported, but not synced back to LDAP.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"READ\_ONLY"`
- - :ansible-option-choices-entry:`"WRITABLE"`
- - :ansible-option-choices-entry:`"UNSYNCED"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/enabled:
-
- .. rst-class:: ansible-option-title
-
- **enabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Enable/disable this user federation.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/evictionday:
-
- .. rst-class:: ansible-option-title
-
- **evictionDay**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Day of the week the entry will become invalid on.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/evictionhour:
-
- .. rst-class:: ansible-option-title
-
- **evictionHour**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Hour of day the entry will become invalid on.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/evictionminute:
-
- .. rst-class:: ansible-option-title
-
- **evictionMinute**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Minute of day the entry will become invalid on.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/fullsyncperiod:
-
- .. rst-class:: ansible-option-title
-
- **fullSyncPeriod**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Period for full synchronization in seconds.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`-1`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/importenabled:
-
- .. rst-class:: ansible-option-title
-
- **importEnabled**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- If \ :literal:`true`\ , LDAP users will be imported into Keycloak DB and synced by the configured sync policies.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/kerberosrealm:
-
- .. rst-class:: ansible-option-title
-
- **kerberosRealm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of kerberos realm.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/keytab:
-
- .. rst-class:: ansible-option-title
-
- **keyTab**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Location of Kerberos KeyTab file containing the credentials of server principal. For example \ :literal:`/etc/krb5.keytab`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/maxlifespan:
-
- .. rst-class:: ansible-option-title
-
- **maxLifespan**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Max lifespan of cache entry in milliseconds.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/pagination:
-
- .. rst-class:: ansible-option-title
-
- **pagination**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Does the LDAP server support pagination.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/priority:
-
- .. rst-class:: ansible-option-title
-
- **priority**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- Priority of provider when doing a user lookup. Lowest first.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`0`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/rdnldapattribute:
-
- .. rst-class:: ansible-option-title
-
- **rdnLDAPAttribute**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of LDAP attribute, which is used as RDN (top attribute) of typical user DN. Usually it's the same as Username LDAP attribute, however it is not required. For example for Active directory, it is common to use \ :literal:`cn`\ as RDN attribute when username attribute might be \ :literal:`sAMAccountName`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/readtimeout:
-
- .. rst-class:: ansible-option-title
-
- **readTimeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- .. raw:: html
-
-
-
- LDAP Read Timeout in milliseconds. This timeout applies for LDAP read operations.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/searchscope:
-
- .. rst-class:: ansible-option-title
-
- **searchScope**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- For one level, the search applies only for users in the DNs specified by User DNs. For subtree, the search applies to the whole subtree. See LDAP documentation for more details.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"1"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"2"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/serverprincipal:
-
- .. rst-class:: ansible-option-title
-
- **serverPrincipal**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Full name of server principal for HTTP service including server and domain name. For example \ :literal:`HTTP/host.foo.org@FOO.ORG`\ . Use \ :literal:`\*`\ to accept any service principal in the KeyTab file.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/starttls:
-
- .. rst-class:: ansible-option-title
-
- **startTls**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Encrypts the connection to LDAP using STARTTLS, which will disable connection pooling.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/syncregistrations:
-
- .. rst-class:: ansible-option-title
-
- **syncRegistrations**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Should newly created users be created within LDAP store? Priority effects which provider is chosen to sync the new user.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/trustemail:
-
- .. rst-class:: ansible-option-title
-
- **trustEmail**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/updateprofilefirstlogin:
-
- .. rst-class:: ansible-option-title
-
- **updateProfileFirstLogin**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Update profile on first login.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/usekerberosforpasswordauthentication:
-
- .. rst-class:: ansible-option-title
-
- **useKerberosForPasswordAuthentication**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/usepasswordmodifyextendedop:
-
- .. rst-class:: ansible-option-title
-
- **usePasswordModifyExtendedOp**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Use the LDAPv3 Password Modify Extended Operation (RFC-3062). The password modify extended operation usually requires that LDAP user already has password in the LDAP server. So when this is used with 'Sync Registrations', it can be good to add also 'Hardcoded LDAP attribute mapper' with randomly generated initial password.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/usernameldapattribute:
-
- .. rst-class:: ansible-option-title
-
- **usernameLDAPAttribute**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it can be \ :literal:`uid`\ . For Active directory it can be \ :literal:`sAMAccountName`\ or \ :literal:`cn`\ . The attribute should be filled for all LDAP user records you want to import from LDAP to Keycloak.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/userobjectclasses:
-
- .. rst-class:: ansible-option-title
-
- **userObjectClasses**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- All values of LDAP objectClass attribute for users in LDAP divided by comma. For example \ :literal:`inetOrgPerson, organizationalPerson`\ . Newly created Keycloak users will be written to LDAP with all those object classes and existing LDAP user records are found just if they contain all those object classes.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/usersdn:
-
- .. rst-class:: ansible-option-title
-
- **usersDn**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Full DN of LDAP tree where your users are. This DN is the parent of LDAP users.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/usetruststorespi:
-
- .. rst-class:: ansible-option-title
-
- **useTruststoreSpi**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Specifies whether LDAP connection will use the truststore SPI with the truststore configured in standalone.xml/domain.xml. \ :literal:`Always`\ means that it will always use it. \ :literal:`Never`\ means that it will not use it. \ :literal:`Only for ldaps`\ means that it will use if your connection URL use ldaps. Note even if standalone.xml/domain.xml is not configured, the default Java cacerts or certificate specified by \ :literal:`javax.net.ssl.trustStore`\ property will be used.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"always"`
- - :ansible-option-choices-entry-default:`"ldapsOnly"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"never"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/uuidldapattribute:
-
- .. rst-class:: ansible-option-title
-
- **uuidLDAPAttribute**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of LDAP attribute, which is used as unique object identifier (UUID) for objects in LDAP. For many LDAP server vendors, it is \ :literal:`entryUUID`\ ; however some are different. For example for Active directory it should be \ :literal:`objectGUID`\ . If your LDAP server does not support the notion of UUID, you can use any other attribute that is supposed to be unique among LDAP users in tree.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/validatepasswordpolicy:
-
- .. rst-class:: ansible-option-title
-
- **validatePasswordPolicy**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Determines if Keycloak should validate the password with the realm password policy before updating it.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`false` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`true`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-config/vendor:
-
- .. rst-class:: ansible-option-title
-
- **vendor**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- LDAP vendor (provider).
-
- Use short name. For instance, write \ :literal:`rhds`\ for "Red Hat Directory Server".
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-connection_timeout:
-
- .. rst-class:: ansible-option-title
-
- **connection_timeout**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`integer`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 4.5.0`
-
-
- .. raw:: html
-
-
-
- Controls the HTTP connections timeout period (in seconds) to Keycloak API.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`10`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-http_agent:
-
- .. rst-class:: ansible-option-title
-
- **http_agent**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 5.4.0`
-
-
- .. raw:: html
-
-
-
- Configures the HTTP User-Agent header.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"Ansible"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-id:
-
- .. rst-class:: ansible-option-title
-
- **id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The unique ID for this user federation. If left empty, the user federation will be searched by its \ :emphasis:`name`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers:
-
- .. rst-class:: ansible-option-title
-
- **mappers**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`list` / :ansible-option-elements:`elements=dictionary`
-
- .. raw:: html
-
-
-
- A list of dicts defining mappers associated with this Identity Provider.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/config:
-
- .. rst-class:: ansible-option-title
-
- **config**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Dict specifying the configuration options for the mapper; the contents differ depending on the value of \ :emphasis:`identityProviderMapper`\ .
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/id:
-
- .. rst-class:: ansible-option-title
-
- **id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Unique ID of this mapper.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/name:
-
- .. rst-class:: ansible-option-title
-
- **name**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Name of the mapper. If no ID is given, the mapper will be searched by name.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/parentid:
-
- .. rst-class:: ansible-option-title
-
- **parentId**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Unique ID for the parent of this mapper. ID of the user federation will automatically be used if left blank.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/providerid:
-
- .. rst-class:: ansible-option-title
-
- **providerId**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The mapper type for this mapper (for instance \ :literal:`user-attribute-ldap-mapper`\ ).
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. raw:: latex
-
- \hspace{0.02\textwidth}\begin{minipage}[t]{0.3\textwidth}
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-mappers/providertype:
-
- .. rst-class:: ansible-option-title
-
- **providerType**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Component type for this mapper.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"org.keycloak.storage.ldap.mappers.LDAPStorageMapper"`
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-name:
-
- .. rst-class:: ansible-option-title
-
- **name**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Display name of provider when linked in admin console.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-parent_id:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-parentid:
-
- .. rst-class:: ansible-option-title
-
- **parent_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: parentId`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Unique ID for the parent of this user federation. Realm ID will be automatically used if left blank.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-provider_id:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-providerid:
-
- .. rst-class:: ansible-option-title
-
- **provider_id**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: providerId`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Provider for this user federation.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`"ldap"`
- - :ansible-option-choices-entry:`"kerberos"`
- - :ansible-option-choices-entry:`"sssd"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-provider_type:
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-providertype:
-
- .. rst-class:: ansible-option-title
-
- **provider_type**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-aliases:`aliases: providerType`
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Component type for user federation (only supported value is \ :literal:`org.keycloak.storage.UserStorageProvider`\ ).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"org.keycloak.storage.UserStorageProvider"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-realm:
-
- .. rst-class:: ansible-option-title
-
- **realm**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- The Keycloak realm under which this user federation resides.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-default-bold:`Default:` :ansible-option-default:`"master"`
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-state:
-
- .. rst-class:: ansible-option-title
-
- **state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- State of the user federation.
-
- On \ :literal:`present`\ , the user federation will be created if it does not yet exist, or updated with the parameters you provide.
-
- On \ :literal:`absent`\ , the user federation will be removed if it exists.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry-default:`"present"` :ansible-option-choices-default-mark:`← (default)`
- - :ansible-option-choices-entry:`"absent"`
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-token:
-
- .. rst-class:: ansible-option-title
-
- **token**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- :ansible-option-versionadded:`added in middleware\_automation.keycloak 3.0.0`
-
-
- .. raw:: html
-
-
-
- Authentication token for Keycloak API.
-
-
- .. raw:: html
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__parameter-validate_certs:
-
- .. rst-class:: ansible-option-title
-
- **validate_certs**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`boolean`
-
- .. raw:: html
-
-
-
- Verify TLS certificates (do not disable this in production).
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-choices:`Choices:`
-
- - :ansible-option-choices-entry:`false`
- - :ansible-option-choices-entry-default:`true` :ansible-option-choices-default-mark:`← (default)`
-
-
- .. raw:: html
-
-
.. Attributes
@@ -3534,195 +1447,78 @@ Return Values
-------------
Common return values are documented :ref:`here `, the following are the fields unique to this module:
-.. tabularcolumns:: \X{1}{3}\X{2}{3}
-
-.. list-table::
- :width: 100%
- :widths: auto
- :header-rows: 1
- :class: longtable ansible-option-table
-
- * - Key
- - Description
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__return-end_state:
-
- .. rst-class:: ansible-option-title
-
- **end_state**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of user federation after module execution.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` on success
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"config": {"allowPasswordAuthentication": "false", "cachePolicy": "DEFAULT", "enabled": "true", "kerberosRealm": "EXAMPLE.COM", "keyTab": "/etc/krb5.keytab", "priority": "0", "serverPrincipal": "HTTP/host.example.com@EXAMPLE.COM", "updateProfileFirstLogin": "false"}, "id": "cf52ae4f-4471-4435-a0cf-bb620cadc122", "mappers": [], "name": "kerberos", "parentId": "myrealm", "providerId": "kerberos", "providerType": "org.keycloak.storage.UserStorageProvider"}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__return-existing:
-
- .. rst-class:: ansible-option-title
-
- **existing**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of existing user federation.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"config": {"allowKerberosAuthentication": "false", "authType": "simple", "batchSizeForSync": "1000", "bindCredential": "\*\*\*\*\*\*\*\*\*\*", "bindDn": "cn=directory reader", "cachePolicy": "DEFAULT", "changedSyncPeriod": "-1", "connectionPooling": "true", "connectionUrl": "ldaps://ldap.example.com:636", "debug": "false", "editMode": "READ\_ONLY", "enabled": "true", "fullSyncPeriod": "-1", "importEnabled": "true", "pagination": "true", "priority": "0", "rdnLDAPAttribute": "uid", "searchScope": "1", "syncRegistrations": "false", "trustEmail": "false", "useKerberosForPasswordAuthentication": "false", "useTruststoreSpi": "ldapsOnly", "userObjectClasses": "inetOrgPerson, organizationalPerson", "usernameLDAPAttribute": "uid", "usersDn": "ou=Users,dc=example,dc=com", "uuidLDAPAttribute": "entryUUID", "validatePasswordPolicy": "false", "vendor": "other"}, "id": "01122837-9047-4ae4-8ca0-6e2e891a765f", "mappers": [{"config": {"always.read.value.from.ldap": "false", "is.mandatory.in.ldap": "false", "ldap.attribute": "mail", "read.only": "true", "user.model.attribute": "email"}, "id": "17d60ce2-2d44-4c2c-8b1f-1fba601b9a9f", "name": "email", "parentId": "01122837-9047-4ae4-8ca0-6e2e891a765f", "providerId": "user-attribute-ldap-mapper", "providerType": "org.keycloak.storage.ldap.mappers.LDAPStorageMapper"}], "name": "myfed", "parentId": "myrealm", "providerId": "ldap", "providerType": "org.keycloak.storage.UserStorageProvider"}`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__return-msg:
-
- .. rst-class:: ansible-option-title
-
- **msg**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`string`
-
- .. raw:: html
-
-
-
- Message as to what action was taken.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`"No changes required to user federation 164bb483-c613-482e-80fe-7f1431308799."`
-
-
- .. raw:: html
-
-
-
-
- * - .. raw:: html
-
-
-
-
- .. _ansible_collections.middleware_automation.keycloak.keycloak_user_federation_module__return-proposed:
-
- .. rst-class:: ansible-option-title
-
- **proposed**
-
- .. raw:: html
-
-
-
- .. ansible-option-type-line::
-
- :ansible-option-type:`dictionary`
-
- .. raw:: html
-
-
-
- Representation of proposed user federation.
-
-
- .. rst-class:: ansible-option-line
-
- :ansible-option-returned-bold:`Returned:` always
-
- .. rst-class:: ansible-option-line
- .. rst-class:: ansible-option-sample
-
- :ansible-option-sample-bold:`Sample:` :ansible-rv-sample-value:`{"config": {"allowKerberosAuthentication": "false", "authType": "simple", "batchSizeForSync": "1000", "bindCredential": "\*\*\*\*\*\*\*\*\*\*", "bindDn": "cn=directory reader", "cachePolicy": "DEFAULT", "connectionPooling": "true", "connectionUrl": "ldaps://ldap.example.com:636", "debug": "false", "editMode": "READ\_ONLY", "enabled": "true", "importEnabled": "true", "pagination": "true", "priority": "0", "rdnLDAPAttribute": "uid", "searchScope": "1", "syncRegistrations": "false", "trustEmail": "false", "useKerberosForPasswordAuthentication": "false", "useTruststoreSpi": "ldapsOnly", "userObjectClasses": "inetOrgPerson, organizationalPerson", "usernameLDAPAttribute": "uid", "usersDn": "ou=Users,dc=example,dc=com", "uuidLDAPAttribute": "entryUUID", "validatePasswordPolicy": "false", "vendor": "other"}, "name": "ldap", "providerId": "ldap", "providerType": "org.keycloak.storage.UserStorageProvider"}`
-
-
- .. raw:: html
-
-
+.. raw:: html
+
+
+
+
+ Key |
+ Description |
+
+
+
+
+
+
+ end_state
+
+
+ dictionary
+
+ |
+
+ Representation of user federation after module execution.
+ Returned: on success
+ Sample: {"config": {"allowPasswordAuthentication": "false", "cachePolicy": "DEFAULT", "enabled": "true", "kerberosRealm": "EXAMPLE.COM", "keyTab": "/etc/krb5.keytab", "priority": "0", "serverPrincipal": "HTTP/host.example.com@EXAMPLE.COM", "updateProfileFirstLogin": "false"}, "id": "cf52ae4f-4471-4435-a0cf-bb620cadc122", "mappers": [], "name": "kerberos", "parentId": "myrealm", "providerId": "kerberos", "providerType": "org.keycloak.storage.UserStorageProvider"}
+ |
+
+
+
+
+ existing
+
+
+ dictionary
+
+ |
+
+ Representation of existing user federation.
+ Returned: always
+ Sample: {"config": {"allowKerberosAuthentication": "false", "authType": "simple", "batchSizeForSync": "1000", "bindCredential": "**********", "bindDn": "cn=directory reader", "cachePolicy": "DEFAULT", "changedSyncPeriod": "-1", "connectionPooling": "true", "connectionUrl": "ldaps://ldap.example.com:636", "debug": "false", "editMode": "READ_ONLY", "enabled": "true", "fullSyncPeriod": "-1", "importEnabled": "true", "pagination": "true", "priority": "0", "rdnLDAPAttribute": "uid", "searchScope": "1", "syncRegistrations": "false", "trustEmail": "false", "useKerberosForPasswordAuthentication": "false", "useTruststoreSpi": "ldapsOnly", "userObjectClasses": "inetOrgPerson, organizationalPerson", "usernameLDAPAttribute": "uid", "usersDn": "ou=Users,dc=example,dc=com", "uuidLDAPAttribute": "entryUUID", "validatePasswordPolicy": "false", "vendor": "other"}, "id": "01122837-9047-4ae4-8ca0-6e2e891a765f", "mappers": [{"config": {"always.read.value.from.ldap": "false", "is.mandatory.in.ldap": "false", "ldap.attribute": "mail", "read.only": "true", "user.model.attribute": "email"}, "id": "17d60ce2-2d44-4c2c-8b1f-1fba601b9a9f", "name": "email", "parentId": "01122837-9047-4ae4-8ca0-6e2e891a765f", "providerId": "user-attribute-ldap-mapper", "providerType": "org.keycloak.storage.ldap.mappers.LDAPStorageMapper"}], "name": "myfed", "parentId": "myrealm", "providerId": "ldap", "providerType": "org.keycloak.storage.UserStorageProvider"}
+ |
+
+
+ |
+
+ Message as to what action was taken.
+ Returned: always
+ Sample: "No changes required to user federation 164bb483-c613-482e-80fe-7f1431308799."
+ |
+
+
+
+
+ proposed
+
+
+ dictionary
+
+ |
+
+ Representation of proposed user federation.
+ Returned: always
+ Sample: {"config": {"allowKerberosAuthentication": "false", "authType": "simple", "batchSizeForSync": "1000", "bindCredential": "**********", "bindDn": "cn=directory reader", "cachePolicy": "DEFAULT", "connectionPooling": "true", "connectionUrl": "ldaps://ldap.example.com:636", "debug": "false", "editMode": "READ_ONLY", "enabled": "true", "importEnabled": "true", "pagination": "true", "priority": "0", "rdnLDAPAttribute": "uid", "searchScope": "1", "syncRegistrations": "false", "trustEmail": "false", "useKerberosForPasswordAuthentication": "false", "useTruststoreSpi": "ldapsOnly", "userObjectClasses": "inetOrgPerson, organizationalPerson", "usernameLDAPAttribute": "uid", "usersDn": "ou=Users,dc=example,dc=com", "uuidLDAPAttribute": "entryUUID", "validatePasswordPolicy": "false", "vendor": "other"}, "name": "ldap", "providerId": "ldap", "providerType": "org.keycloak.storage.UserStorageProvider"}
+ |
+
+
+
diff --git a/main/_sources/roles/keycloak_quarkus.md.txt b/main/_sources/roles/keycloak_quarkus.md.txt
index 1a50a00..30e7cd8 100644
--- a/main/_sources/roles/keycloak_quarkus.md.txt
+++ b/main/_sources/roles/keycloak_quarkus.md.txt
@@ -24,6 +24,7 @@ Role Defaults
|`keycloak_quarkus_bind_address`| Address for binding service ports | `0.0.0.0` |
|`keycloak_quarkus_host`| Hostname for the Keycloak server | `localhost` |
|`keycloak_quarkus_port`| The port used by the proxy when exposing the hostname | `-1` |
+|`keycloak_quarkus_path`| This should be set if proxy uses a different context-path for Keycloak | |
|`keycloak_quarkus_http_port`| HTTP listening port | `8080` |
|`keycloak_quarkus_https_port`| TLS HTTP listening port | `8443` |
|`keycloak_quarkus_ajp_port`| AJP port | `8009` |
@@ -34,8 +35,9 @@ Role Defaults
|`keycloak_quarkus_jvm_package`| RHEL java package runtime | `java-17-openjdk-headless` |
|`keycloak_quarkus_java_home`| JAVA_HOME of installed JRE, leave empty for using specified keycloak_quarkus_jvm_package RPM path | `None` |
|`keycloak_quarkus_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` |
-|`keycloak_quarkus_frontend_url`| Service public URL | `http://localhost:8080/auth` |
-|`keycloak_quarkus_http_relative_path` | Service context path | `auth` |
+|`keycloak_quarkus_frontend_url`| Set the base URL for frontend URLs, including scheme, host, port and path | |
+|`keycloak_quarkus_admin_url`| Set the base URL for accessing the administration console, including scheme, host, port and path | |
+|`keycloak_quarkus_http_relative_path` | Set the path relative to / for serving resources. The path must start with a / | `/` |
|`keycloak_quarkus_http_enabled`| Enable listener on HTTP port | `True` |
|`keycloak_quarkus_https_enabled`| Enable listener on HTTPS port | `False` |
|`keycloak_quarkus_key_file`| The file path to a private key in PEM format | `{{ keycloak.home }}/conf/server.key.pem` |
diff --git a/main/objects.inv b/main/objects.inv
index 6fd80fd..0b1f5a2 100644
Binary files a/main/objects.inv and b/main/objects.inv differ
diff --git a/main/plugins/keycloak_client.html b/main/plugins/keycloak_client.html
index 3da2158..bac4b0b 100644
--- a/main/plugins/keycloak_client.html
+++ b/main/plugins/keycloak_client.html
@@ -142,808 +142,1325 @@ To check whether it is installed, run
-
+
-Parameter |
-Comments |
+
|---|
+ Parameter |
+ Comments |
-
-
- admin_url
- aliases: adminUrl
- string
- |
-URL to the admin interface of the client. This is ‘adminUrl’ in the Keycloak REST API.
- |
-
-
-
- always_display_in_console
- aliases: alwaysDisplayInConsole
- boolean
- added in middleware_automation.keycloak 4.7.0
- |
-Whether or not to display this client in account console, even if the user does not have an active session.
- Choices:
-
- |
-
-
- attributes
- dictionary
- |
-A dict of further attributes for this client. This can contain various configuration settings; an example is given in the examples section. While an exhaustive list of permissible options is not available; possible options as of Keycloak 3.4 are listed below. The Keycloak API does not validate whether a given option is appropriate for the protocol used; if specified anyway, Keycloak will simply not use it.
- |
-
- |
-For OpenID-Connect clients, URL where client keys in JWK are stored.
- |
-
-
- jwt.credential.certificate
- string
- |
-For OpenID-Connect clients, client certificate for validating JWT issued by client and signed by its key, base64-encoded.
- |
-
-
- request.object.signature.alg
- string
- |
-For OpenID-Connect clients, JWA algorithm which the client needs to use when sending OIDC request object. One of any, none, RS256.
- |
-
-
- saml.authnstatement
- string
- |
-For SAML clients, boolean specifying whether or not a statement containing method and timestamp should be included in the login response.
- |
-
-
- saml.client.signature
- string
- |
-For SAML clients, boolean specifying whether a client signature is required and validated.
- |
-
- |
-Boolean specifying whether SAML assertions should be encrypted with the client’s public key.
- |
-
-
- saml.force.post.binding
- string
- |
-For SAML clients, boolean specifying whether always to use POST binding for responses.
- |
-
-
- saml.onetimeuse.condition
- string
- |
-For SAML clients, boolean specifying whether a OneTimeUse condition should be included in login responses.
- |
-
-
- saml.server.signature
- string
- |
-Boolean specifying whether SAML documents should be signed by the realm.
- |
-
-
- saml.server.signature.keyinfo.ext
- string
- |
-For SAML clients, boolean specifying whether REDIRECT signing key lookup should be optimized through inclusion of the signing key id in the SAML Extensions element.
- |
-
-
- saml.signature.algorithm
- string
- |
-Signature algorithm used to sign SAML documents. One of RSA_SHA256, RSA_SHA1, RSA_SHA512, or DSA_SHA1.
- |
-
-
- saml.signing.certificate
- string
- |
-SAML signing key certificate, base64-encoded.
- |
-
-
- saml.signing.private.key
- string
- |
-SAML signing key private key, base64-encoded.
- |
-
-
- saml_assertion_consumer_url_post
- string
- |
-SAML POST Binding URL for the client’s assertion consumer service (login responses).
- |
-
-
- saml_assertion_consumer_url_redirect
- string
- |
-SAML Redirect Binding URL for the client’s assertion consumer service (login responses).
- |
-
-
- saml_force_name_id_format
- string
- |
-For SAML clients, Boolean specifying whether to ignore requested NameID subject format and using the configured one instead.
- |
-
-
- saml_name_id_format
- string
- |
-For SAML clients, the NameID format to use (one of username, email, transient, or persistent)
- |
-
-
- saml_signature_canonicalization_method
- string
- |
-SAML signature canonicalization method. This is one of four values, namely http://www.w3.org/2001/10/xml-exc-c14n# for EXCLUSIVE, http://www.w3.org/2001/10/xml-exc-c14n#WithComments for EXCLUSIVE_WITH_COMMENTS, http://www.w3.org/TR/2001/REC-xml-c14n-20010315 for INCLUSIVE, and http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments for INCLUSIVE_WITH_COMMENTS.
- |
-
-
- saml_single_logout_service_url_post
- string
- |
-SAML POST binding url for the client’s single logout service.
- |
-
-
- saml_single_logout_service_url_redirect
- string
- |
-SAML redirect binding url for the client’s single logout service.
- |
-
- |
-For OpenID-Connect clients, boolean specifying whether to use a JWKS URL to obtain client public keys.
- |
-
-
- user.info.response.signature.alg
- string
- |
-For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of RS256 or unsigned.
- |
-
-
- auth_client_id
- string
- |
-OpenID Connect client_id to authenticate to the API with.
- Default: "admin-cli"
- |
-
-
- auth_client_secret
- string
- |
-Client Secret to use in conjunction with auth_client_id (if required).
- |
-
-
-
- auth_keycloak_url
- aliases: url
- string / required
- |
-URL to the Keycloak instance.
- |
-
-
-
- auth_password
- aliases: password
- string
- |
-Password to authenticate for API access with.
- |
-
- |
-Keycloak realm name to authenticate to for API access.
- |
-
-
-
- auth_username
- aliases: username
- string
- |
-Username to authenticate for API access with.
- |
-
-
-
- authentication_flow_binding_overrides
- aliases: authenticationFlowBindingOverrides
- dictionary
- added in middleware_automation.keycloak 3.4.0
- |
-Override realm authentication flow bindings.
- |
-
-
-
- authorization_services_enabled
- aliases: authorizationServicesEnabled
- boolean
- |
-Are authorization services enabled for this client or not (OpenID connect). This is ‘authorizationServicesEnabled’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- authorization_settings
- aliases: authorizationSettings
- dictionary
- |
- |
-
-
-
- base_url
- aliases: baseUrl
- string
- |
-Default URL to use when the auth server needs to redirect or link back to the client This is ‘baseUrl’ in the Keycloak REST API.
- |
-
-
-
- bearer_only
- aliases: bearerOnly
- boolean
- |
-The access type of this client is bearer-only. This is ‘bearerOnly’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- client_authenticator_type
- aliases: clientAuthenticatorType
- string
- |
-How do clients authenticate with the auth server? Either client-secret or client-jwt can be chosen. When using client-secret, the module parameter secret can set it, while for client-jwt, you can use the keys use.jwks.url, jwks.url, and jwt.credential.certificate in the attributes module parameter to configure its behavior. This is ‘clientAuthenticatorType’ in the Keycloak REST API.
- Choices:
-
-"client-secret"
"client-jwt"
- |
-
-
-
- client_id
- aliases: clientId
- string
- |
-Client id of client to be worked on. This is usually an alphanumeric name chosen by you. Either this or id is required. If you specify both, id takes precedence. This is ‘clientId’ in the Keycloak REST API.
- |
-
-
-
- client_template
- aliases: clientTemplate
- string
- |
-Client template to use for this client. If it does not exist this field will silently be dropped. This is ‘clientTemplate’ in the Keycloak REST API.
- |
-
-
- connection_timeout
- integer
- added in middleware_automation.keycloak 4.5.0
- |
-Controls the HTTP connections timeout period (in seconds) to Keycloak API.
- Default: 10
- |
-
-
-
- consent_required
- aliases: consentRequired
- boolean
- |
-If enabled, users have to consent to client access. This is ‘consentRequired’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- default_client_scopes
- aliases: defaultClientScopes
- list / elements=string
- added in middleware_automation.keycloak 4.7.0
- |
-List of default client scopes.
- |
-
-
-
- default_roles
- aliases: defaultRoles
- list / elements=string
- |
-list of default roles for this client. If the client roles referenced do not exist yet, they will be created. This is ‘defaultRoles’ in the Keycloak REST API.
- |
-
- |
-Description of the client in Keycloak.
- |
-
-
-
- direct_access_grants_enabled
- aliases: directAccessGrantsEnabled
- boolean
- |
-Are direct access grants enabled for this client or not (OpenID connect). This is ‘directAccessGrantsEnabled’ in the Keycloak REST API.
- Choices:
-
- |
-
- |
-Is this client enabled or not?
- Choices:
-
- |
-
-
-
- frontchannel_logout
- aliases: frontchannelLogout
- boolean
- |
-Is frontchannel logout enabled for this client or not. This is ‘frontchannelLogout’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- full_scope_allowed
- aliases: fullScopeAllowed
- boolean
- |
-Is the “Full Scope Allowed” feature set for this client or not. This is ‘fullScopeAllowed’ in the Keycloak REST API.
- Choices:
-
- |
-
-
- http_agent
- string
- added in middleware_automation.keycloak 5.4.0
- |
-Configures the HTTP User-Agent header.
- Default: "Ansible"
- |
-
- |
-Id of client to be worked on. This is usually an UUID. Either this or client_id is required. If you specify both, this takes precedence.
- |
-
-
-
- implicit_flow_enabled
- aliases: implicitFlowEnabled
- boolean
- |
-Enable implicit flow for this client or not (OpenID connect). This is ‘implicitFlowEnabled’ in the Keycloak REST API.
- Choices:
-
- |
-
- |
-Name of the client (this is not the same as client_id).
- |
-
-
-
- node_re_registration_timeout
- aliases: nodeReRegistrationTimeout
- integer
- |
-Cluster node re-registration timeout for this client. This is ‘nodeReRegistrationTimeout’ in the Keycloak REST API.
- |
-
-
-
- not_before
- aliases: notBefore
- integer
- |
-Revoke any tokens issued before this date for this client (this is a UNIX timestamp). This is ‘notBefore’ in the Keycloak REST API.
- |
-
-
-
- optional_client_scopes
- aliases: optionalClientScopes
- list / elements=string
- added in middleware_automation.keycloak 4.7.0
- |
-List of optional client scopes.
- |
-
- |
-Type of client (either openid-connect or saml.
- Choices:
-
-"openid-connect"
"saml"
- |
-
-
-
- protocol_mappers
- aliases: protocolMappers
- list / elements=dictionary
- |
-a list of dicts defining protocol mappers for this client. This is ‘protocolMappers’ in the Keycloak REST API.
- |
-
- |
-Dict specifying the configuration options for the protocol mapper; the contents differ depending on the value of protocolMapper and are not documented other than by the source of the mappers and its parent class(es). An example is given below. It is easiest to obtain valid config values by dumping an already-existing protocol mapper configuration through check-mode in the existing field.
- |
-
-
-
- consentRequired
- boolean
- |
-Specifies whether a user needs to provide consent to a client for this mapper to be active.
- Choices:
-
- |
-
- |
-The human-readable name of the consent the user is presented to accept.
- |
-
- |
-Usually a UUID specifying the internal ID of this protocol mapper instance.
- |
-
- |
-The name of this protocol mapper.
- |
-
- |
-This is either openid-connect or saml, this specifies for which protocol this protocol mapper. is active.
- Choices:
-
-"openid-connect"
"saml"
- |
-
-
-
- protocolMapper
- string
- |
-The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is impossible to provide since this may be extended through SPIs by the user of Keycloak, by default Keycloak as of 3.4 ships with at least
- docker-v2-allow-all-mapper
- oidc-address-mapper
- oidc-full-name-mapper
- oidc-group-membership-mapper
- oidc-hardcoded-claim-mapper
- oidc-hardcoded-role-mapper
- oidc-role-name-mapper
- oidc-script-based-protocol-mapper
- oidc-sha256-pairwise-sub-mapper
- oidc-usermodel-attribute-mapper
- oidc-usermodel-client-role-mapper
- oidc-usermodel-property-mapper
- oidc-usermodel-realm-role-mapper
- oidc-usersessionmodel-note-mapper
- saml-group-membership-mapper
- saml-hardcode-attribute-mapper
- saml-hardcode-role-mapper
- saml-role-list-mapper
- saml-role-name-mapper
- saml-user-attribute-mapper
- saml-user-property-mapper
- saml-user-session-note-mapper
- An exhaustive list of available mappers on your installation can be obtained on the admin console by going to Server Info -> Providers and looking under ‘protocol-mapper’.
- |
-
-
-
- public_client
- aliases: publicClient
- boolean
- |
-Is the access type for this client public or not. This is ‘publicClient’ in the Keycloak REST API.
- Choices:
-
- |
-
- |
-The realm to create the client in.
- Default: "master"
- |
-
-
-
- redirect_uris
- aliases: redirectUris
- list / elements=string
- |
-Acceptable redirect URIs for this client. This is ‘redirectUris’ in the Keycloak REST API.
- |
-
-
-
- registered_nodes
- aliases: registeredNodes
- dictionary
- |
-dict of registered cluster nodes (with nodename as the key and last registration time as the value). This is ‘registeredNodes’ in the Keycloak REST API.
- |
-
-
-
- registration_access_token
- aliases: registrationAccessToken
- string
- |
-The registration access token provides access for clients to the client registration service. This is ‘registrationAccessToken’ in the Keycloak REST API.
- |
-
-
-
- root_url
- aliases: rootUrl
- string
- |
-Root URL appended to relative URLs for this client. This is ‘rootUrl’ in the Keycloak REST API.
- |
-
- |
-When using client_authenticator_type client-secret (the default), you can specify a secret here (otherwise one will be generated if it does not exit). If changing this secret, the module will not register a change currently (but the changed secret will be saved).
- |
-
-
-
- service_accounts_enabled
- aliases: serviceAccountsEnabled
- boolean
- |
-Are service accounts enabled for this client or not (OpenID connect). This is ‘serviceAccountsEnabled’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- standard_flow_enabled
- aliases: standardFlowEnabled
- boolean
- |
-Enable standard flow for this client or not (OpenID connect). This is ‘standardFlowEnabled’ in the Keycloak REST API.
- Choices:
-
- |
-
- |
-State of the client
- On present, the client will be created (or updated if it exists already).
- On absent, the client will be removed if it exists
- Choices:
-
-"present" ← (default)
"absent"
- |
-
-
-
- surrogate_auth_required
- aliases: surrogateAuthRequired
- boolean
- |
-Whether or not surrogate auth is required. This is ‘surrogateAuthRequired’ in the Keycloak REST API.
- Choices:
-
- |
-
-
- token
- string
- added in middleware_automation.keycloak 3.0.0
- |
-Authentication token for Keycloak API.
- |
-
-
-
- use_template_config
- aliases: useTemplateConfig
- boolean
- |
-Whether or not to use configuration from the client_template. This is ‘useTemplateConfig’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- use_template_mappers
- aliases: useTemplateMappers
- boolean
- |
-Whether or not to use mapper configuration from the client_template. This is ‘useTemplateMappers’ in the Keycloak REST API.
- Choices:
-
- |
-
-
-
- use_template_scope
- aliases: useTemplateScope
- boolean
- |
-Whether or not to use scope configuration from the client_template. This is ‘useTemplateScope’ in the Keycloak REST API.
- Choices:
-
- |
-
-
- validate_certs
- boolean
- |
-Verify TLS certificates (do not disable this in production).
- Choices:
-
-false
true ← (default)
- |
-
-
-
- web_origins
- aliases: webOrigins
- list / elements=string
- |
-List of allowed CORS origins. This is ‘webOrigins’ in the Keycloak REST API.
- |
+
+
+
+
+ admin_url
+
+ aliases: adminUrl
+
+ string
+
+ |
+
+ URL to the admin interface of the client. This is 'adminUrl' in the Keycloak REST API.
+ |
+
+
+
+
+
+ always_display_in_console
+
+ aliases: alwaysDisplayInConsole
+
+ boolean
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ Whether or not to display this client in account console, even if the user does not have an active session.
+ Choices:
+
+
+ |
+
+
+
+
+ attributes
+
+
+ dictionary
+
+ |
+
+ A dict of further attributes for this client. This can contain various configuration settings; an example is given in the examples section. While an exhaustive list of permissible options is not available; possible options as of Keycloak 3.4 are listed below. The Keycloak API does not validate whether a given option is appropriate for the protocol used; if specified anyway, Keycloak will simply not use it.
+ |
+
+
+
+
+ jwks.url
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, URL where client keys in JWK are stored.
+ |
+
+
+
+
+ jwt.credential.certificate
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, client certificate for validating JWT issued by client and signed by its key, base64-encoded.
+ |
+
+
+
+
+ request.object.signature.alg
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, JWA algorithm which the client needs to use when sending OIDC request object. One of any, none, RS256.
+ |
+
+
+
+
+ saml.authnstatement
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether or not a statement containing method and timestamp should be included in the login response.
+ |
+
+
+
+
+ saml.client.signature
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether a client signature is required and validated.
+ |
+
+
+
+
+ saml.encrypt
+
+
+ string
+
+ |
+
+ Boolean specifying whether SAML assertions should be encrypted with the client's public key.
+ |
+
+
+
+
+ saml.force.post.binding
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether always to use POST binding for responses.
+ |
+
+
+
+
+ saml.onetimeuse.condition
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether a OneTimeUse condition should be included in login responses.
+ |
+
+
+
+
+ saml.server.signature
+
+
+ string
+
+ |
+
+ Boolean specifying whether SAML documents should be signed by the realm.
+ |
+
+
+
+
+ saml.server.signature.keyinfo.ext
+
+
+ string
+
+ |
+
+ For SAML clients, boolean specifying whether REDIRECT signing key lookup should be optimized through inclusion of the signing key id in the SAML Extensions element.
+ |
+
+
+
+
+ saml.signature.algorithm
+
+
+ string
+
+ |
+
+ Signature algorithm used to sign SAML documents. One of RSA_SHA256, RSA_SHA1, RSA_SHA512, or DSA_SHA1.
+ |
+
+
+
+
+ saml.signing.certificate
+
+
+ string
+
+ |
+
+ SAML signing key certificate, base64-encoded.
+ |
+
+
+
+
+ saml.signing.private.key
+
+
+ string
+
+ |
+
+ SAML signing key private key, base64-encoded.
+ |
+
+
+
+
+ saml_assertion_consumer_url_post
+
+
+ string
+
+ |
+
+ SAML POST Binding URL for the client's assertion consumer service (login responses).
+ |
+
+
+
+
+ saml_assertion_consumer_url_redirect
+
+
+ string
+
+ |
+
+ SAML Redirect Binding URL for the client's assertion consumer service (login responses).
+ |
+
+
+
+
+ saml_force_name_id_format
+
+
+ string
+
+ |
+
+ For SAML clients, Boolean specifying whether to ignore requested NameID subject format and using the configured one instead.
+ |
+
+
+
+
+ saml_name_id_format
+
+
+ string
+
+ |
+
+ For SAML clients, the NameID format to use (one of username, email, transient, or persistent)
+ |
+
+
+
+
+ saml_signature_canonicalization_method
+
+
+ string
+
+ |
+
+ SAML signature canonicalization method. This is one of four values, namely http://www.w3.org/2001/10/xml-exc-c14n# for EXCLUSIVE, http://www.w3.org/2001/10/xml-exc-c14n#WithComments for EXCLUSIVE_WITH_COMMENTS, http://www.w3.org/TR/2001/REC-xml-c14n-20010315 for INCLUSIVE, and http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments for INCLUSIVE_WITH_COMMENTS.
+ |
+
+
+
+
+ saml_single_logout_service_url_post
+
+
+ string
+
+ |
+
+ SAML POST binding url for the client's single logout service.
+ |
+
+
+
+
+ saml_single_logout_service_url_redirect
+
+
+ string
+
+ |
+
+ SAML redirect binding url for the client's single logout service.
+ |
+
+
+
+
+ use.jwks.url
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, boolean specifying whether to use a JWKS URL to obtain client public keys.
+ |
+
+
+
+
+ user.info.response.signature.alg
+
+
+ string
+
+ |
+
+ For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of RS256 or unsigned.
+ |
+
+
+
+
+
+ auth_client_id
+
+
+ string
+
+ |
+
+ OpenID Connect client_id to authenticate to the API with.
+ Default: "admin-cli"
+ |
+
+
+
+
+ auth_client_secret
+
+
+ string
+
+ |
+
+ Client Secret to use in conjunction with auth_client_id (if required).
+ |
+
+
+
+
+
+ auth_keycloak_url
+
+ aliases: url
+
+ string
+ / required
+
+ |
+
+ URL to the Keycloak instance.
+ |
+
+
+
+
+
+ auth_password
+
+ aliases: password
+
+ string
+
+ |
+
+ Password to authenticate for API access with.
+ |
+
+
+
+
+ auth_realm
+
+
+ string
+
+ |
+
+ Keycloak realm name to authenticate to for API access.
+ |
+
+
+
+
+
+ auth_username
+
+ aliases: username
+
+ string
+
+ |
+
+ Username to authenticate for API access with.
+ |
+
+
+
+
+
+ authentication_flow_binding_overrides
+
+ aliases: authenticationFlowBindingOverrides
+
+ dictionary
+
+ added in middleware_automation.keycloak 3.4.0
+ |
+
+ Override realm authentication flow bindings.
+ |
+
+
+
+
+
+ authorization_services_enabled
+
+ aliases: authorizationServicesEnabled
+
+ boolean
+
+ |
+
+ Are authorization services enabled for this client or not (OpenID connect). This is 'authorizationServicesEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ authorization_settings
+
+ aliases: authorizationSettings
+
+ dictionary
+
+ |
+ |
+
+
+
+
+
+ base_url
+
+ aliases: baseUrl
+
+ string
+
+ |
+
+ Default URL to use when the auth server needs to redirect or link back to the client This is 'baseUrl' in the Keycloak REST API.
+ |
+
+
+
+
+
+ bearer_only
+
+ aliases: bearerOnly
+
+ boolean
+
+ |
+
+ The access type of this client is bearer-only. This is 'bearerOnly' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ client_authenticator_type
+
+ aliases: clientAuthenticatorType
+
+ string
+
+ |
+
+ How do clients authenticate with the auth server? Either client-secret or client-jwt can be chosen. When using client-secret, the module parameter secret can set it, while for client-jwt, you can use the keys use.jwks.url, jwks.url, and jwt.credential.certificate in the attributes module parameter to configure its behavior. This is 'clientAuthenticatorType' in the Keycloak REST API.
+ Choices:
+
+ "client-secret"
"client-jwt"
+
+ |
+
+
+
+
+
+ client_id
+
+ aliases: clientId
+
+ string
+
+ |
+
+ Client id of client to be worked on. This is usually an alphanumeric name chosen by you. Either this or id is required. If you specify both, id takes precedence. This is 'clientId' in the Keycloak REST API.
+ |
+
+
+
+
+
+ client_template
+
+ aliases: clientTemplate
+
+ string
+
+ |
+
+ Client template to use for this client. If it does not exist this field will silently be dropped. This is 'clientTemplate' in the Keycloak REST API.
+ |
+
+
+
+
+ connection_timeout
+
+
+ integer
+
+ added in middleware_automation.keycloak 4.5.0
+ |
+
+ Controls the HTTP connections timeout period (in seconds) to Keycloak API.
+ Default: 10
+ |
+
+
+
+
+
+ consent_required
+
+ aliases: consentRequired
+
+ boolean
+
+ |
+
+ If enabled, users have to consent to client access. This is 'consentRequired' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ default_client_scopes
+
+ aliases: defaultClientScopes
+
+ list
+ / elements=string
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ List of default client scopes.
+ |
+
+
+
+
+
+ default_roles
+
+ aliases: defaultRoles
+
+ list
+ / elements=string
+
+ |
+
+ list of default roles for this client. If the client roles referenced do not exist yet, they will be created. This is 'defaultRoles' in the Keycloak REST API.
+ |
+
+
+
+
+ description
+
+
+ string
+
+ |
+
+ Description of the client in Keycloak.
+ |
+
+
+
+
+
+ direct_access_grants_enabled
+
+ aliases: directAccessGrantsEnabled
+
+ boolean
+
+ |
+
+ Are direct access grants enabled for this client or not (OpenID connect). This is 'directAccessGrantsEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ enabled
+
+
+ boolean
+
+ |
+
+ Is this client enabled or not?
+ Choices:
+
+
+ |
+
+
+
+
+
+ frontchannel_logout
+
+ aliases: frontchannelLogout
+
+ boolean
+
+ |
+
+ Is frontchannel logout enabled for this client or not. This is 'frontchannelLogout' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ full_scope_allowed
+
+ aliases: fullScopeAllowed
+
+ boolean
+
+ |
+
+ Is the "Full Scope Allowed" feature set for this client or not. This is 'fullScopeAllowed' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ http_agent
+
+
+ string
+
+ added in middleware_automation.keycloak 5.4.0
+ |
+
+ Configures the HTTP User-Agent header.
+ Default: "Ansible"
+ |
+
+
+ |
+
+ Id of client to be worked on. This is usually an UUID. Either this or client_id is required. If you specify both, this takes precedence.
+ |
+
+
+
+
+
+ implicit_flow_enabled
+
+ aliases: implicitFlowEnabled
+
+ boolean
+
+ |
+
+ Enable implicit flow for this client or not (OpenID connect). This is 'implicitFlowEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ Name of the client (this is not the same as client_id).
+ |
+
+
+
+
+
+ node_re_registration_timeout
+
+ aliases: nodeReRegistrationTimeout
+
+ integer
+
+ |
+
+ Cluster node re-registration timeout for this client. This is 'nodeReRegistrationTimeout' in the Keycloak REST API.
+ |
+
+
+
+
+
+ not_before
+
+ aliases: notBefore
+
+ integer
+
+ |
+
+ Revoke any tokens issued before this date for this client (this is a UNIX timestamp). This is 'notBefore' in the Keycloak REST API.
+ |
+
+
+
+
+
+ optional_client_scopes
+
+ aliases: optionalClientScopes
+
+ list
+ / elements=string
+
+ added in middleware_automation.keycloak 4.7.0
+ |
+
+ List of optional client scopes.
+ |
+
+
+
+
+ protocol
+
+
+ string
+
+ |
+
+ Type of client (either openid-connect or saml.
+ Choices:
+
+ "openid-connect"
"saml"
+
+ |
+
+
+
+
+
+ protocol_mappers
+
+ aliases: protocolMappers
+
+ list
+ / elements=dictionary
+
+ |
+
+ a list of dicts defining protocol mappers for this client. This is 'protocolMappers' in the Keycloak REST API.
+ |
+
+
+
+
+
+ config
+
+
+ dictionary
+
+ |
+
+ Dict specifying the configuration options for the protocol mapper; the contents differ depending on the value of protocolMapper and are not documented other than by the source of the mappers and its parent class(es). An example is given below. It is easiest to obtain valid config values by dumping an already-existing protocol mapper configuration through check-mode in the existing field.
+ |
+
+
+
+
+
+ consentRequired
+
+
+ boolean
+
+ |
+
+ Specifies whether a user needs to provide consent to a client for this mapper to be active.
+ Choices:
+
+
+ |
+
+
+
+
+
+ consentText
+
+
+ string
+
+ |
+
+ The human-readable name of the consent the user is presented to accept.
+ |
+
+
+
+
+
+ id
+
+
+ string
+
+ |
+
+ Usually a UUID specifying the internal ID of this protocol mapper instance.
+ |
+
+
+
+
+
+ name
+
+
+ string
+
+ |
+
+ The name of this protocol mapper.
+ |
+
+
+
+
+
+ protocol
+
+
+ string
+
+ |
+
+ This is either openid-connect or saml, this specifies for which protocol this protocol mapper. is active.
+ Choices:
+
+ "openid-connect"
"saml"
+
+ |
+
+
+
+
+
+ protocolMapper
+
+
+ string
+
+ |
+
+ The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is impossible to provide since this may be extended through SPIs by the user of Keycloak, by default Keycloak as of 3.4 ships with at least
+ docker-v2-allow-all-mapper
+ oidc-address-mapper
+ oidc-full-name-mapper
+ oidc-group-membership-mapper
+ oidc-hardcoded-claim-mapper
+ oidc-hardcoded-role-mapper
+ oidc-role-name-mapper
+ oidc-script-based-protocol-mapper
+ oidc-sha256-pairwise-sub-mapper
+ oidc-usermodel-attribute-mapper
+ oidc-usermodel-client-role-mapper
+ oidc-usermodel-property-mapper
+ oidc-usermodel-realm-role-mapper
+ oidc-usersessionmodel-note-mapper
+ saml-group-membership-mapper
+ saml-hardcode-attribute-mapper
+ saml-hardcode-role-mapper
+ saml-role-list-mapper
+ saml-role-name-mapper
+ saml-user-attribute-mapper
+ saml-user-property-mapper
+ saml-user-session-note-mapper
+ An exhaustive list of available mappers on your installation can be obtained on the admin console by going to Server Info -> Providers and looking under 'protocol-mapper'.
+ |
+
+
+
+
+
+
+ public_client
+
+ aliases: publicClient
+
+ boolean
+
+ |
+
+ Is the access type for this client public or not. This is 'publicClient' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ realm
+
+
+ string
+
+ |
+
+ The realm to create the client in.
+ Default: "master"
+ |
+
+
+
+
+
+ redirect_uris
+
+ aliases: redirectUris
+
+ list
+ / elements=string
+
+ |
+
+ Acceptable redirect URIs for this client. This is 'redirectUris' in the Keycloak REST API.
+ |
+
+
+
+
+
+ registered_nodes
+
+ aliases: registeredNodes
+
+ dictionary
+
+ |
+
+ dict of registered cluster nodes (with nodename as the key and last registration time as the value). This is 'registeredNodes' in the Keycloak REST API.
+ |
+
+
+
+
+
+ registration_access_token
+
+ aliases: registrationAccessToken
+
+ string
+
+ |
+
+ The registration access token provides access for clients to the client registration service. This is 'registrationAccessToken' in the Keycloak REST API.
+ |
+
+
+
+
+
+ root_url
+
+ aliases: rootUrl
+
+ string
+
+ |
+
+ Root URL appended to relative URLs for this client. This is 'rootUrl' in the Keycloak REST API.
+ |
+
+
+
+
+ secret
+
+
+ string
+
+ |
+
+ When using client_authenticator_type client-secret (the default), you can specify a secret here (otherwise one will be generated if it does not exit). If changing this secret, the module will not register a change currently (but the changed secret will be saved).
+ |
+
+
+
+
+
+ service_accounts_enabled
+
+ aliases: serviceAccountsEnabled
+
+ boolean
+
+ |
+
+ Are service accounts enabled for this client or not (OpenID connect). This is 'serviceAccountsEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ standard_flow_enabled
+
+ aliases: standardFlowEnabled
+
+ boolean
+
+ |
+
+ Enable standard flow for this client or not (OpenID connect). This is 'standardFlowEnabled' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ state
+
+
+ string
+
+ |
+
+ State of the client
+ On present, the client will be created (or updated if it exists already).
+ On absent, the client will be removed if it exists
+ Choices:
+
+ "present" ← (default)
"absent"
+
+ |
+
+
+
+
+
+ surrogate_auth_required
+
+ aliases: surrogateAuthRequired
+
+ boolean
+
+ |
+
+ Whether or not surrogate auth is required. This is 'surrogateAuthRequired' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ token
+
+
+ string
+
+ added in middleware_automation.keycloak 3.0.0
+ |
+
+ Authentication token for Keycloak API.
+ |
+
+
+
+
+
+ use_template_config
+
+ aliases: useTemplateConfig
+
+ boolean
+
+ |
+
+ Whether or not to use configuration from the client_template. This is 'useTemplateConfig' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ use_template_mappers
+
+ aliases: useTemplateMappers
+
+ boolean
+
+ |
+
+ Whether or not to use mapper configuration from the client_template. This is 'useTemplateMappers' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+
+ use_template_scope
+
+ aliases: useTemplateScope
+
+ boolean
+
+ |
+
+ Whether or not to use scope configuration from the client_template. This is 'useTemplateScope' in the Keycloak REST API.
+ Choices:
+
+
+ |
+
+
+
+
+ validate_certs
+
+
+ boolean
+
+ |
+
+ Verify TLS certificates (do not disable this in production).
+ Choices:
+
+ false
true ← (default)
+
+ |
+
+
+
+
+
+ web_origins
+
+ aliases: webOrigins
+
+ list
+ / elements=string
+
+ |
+
+ List of allowed CORS origins. This is 'webOrigins' in the Keycloak REST API.
+ |
-
-
+