mirror of
https://github.com/ansible-middleware/keycloak.git
synced 2025-07-31 00:51:34 -07:00
Update docs for 2.1.0
Signed-off-by: ansible-middleware-core <ansible-middleware-core@redhat.com>
This commit is contained in:
ansible-middleware-core
parent
9fcb4c948b
commit
50f527bf8d
72 changed files with 17882 additions and 0 deletions
313
2.1.0/_sources/CHANGELOG.rst.txt
Normal file
313
2.1.0/_sources/CHANGELOG.rst.txt
Normal file
|
|
@ -0,0 +1,313 @@
|
|||
=============================================
|
||||
middleware\_automation.keycloak Release Notes
|
||||
=============================================
|
||||
|
||||
.. contents:: Topics
|
||||
|
||||
This changelog describes changes after version 0.2.6.
|
||||
|
||||
v2.1.0
|
||||
======
|
||||
|
||||
Major Changes
|
||||
-------------
|
||||
|
||||
- Implement infinispan TCPPING discovery protocol `#159 <https://github.com/ansible-middleware/keycloak/pull/159>`_
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Set enable-recovery when xa transactions are enabled `#167 <https://github.com/ansible-middleware/keycloak/pull/167>`_
|
||||
- keycloak_quarkus: Allow configuring log rotate options in quarkus configuration `#161 <https://github.com/ansible-middleware/keycloak/pull/161>`_
|
||||
- keycloak_quarkus: ``sticky-session`` for infinispan routes `#163 <https://github.com/ansible-middleware/keycloak/pull/163>`_
|
||||
|
||||
Breaking Changes / Porting Guide
|
||||
--------------------------------
|
||||
|
||||
- keycloak_quarkus: renamed infinispan host list configuration `#157 <https://github.com/ansible-middleware/keycloak/pull/157>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: fix custom JAVA_HOME parameter name `#171 <https://github.com/ansible-middleware/keycloak/pull/171>`_
|
||||
|
||||
v2.0.2
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- keycloak_quarkus: Add support for sqlserver jdbc driver `#148 <https://github.com/ansible-middleware/keycloak/pull/148>`_
|
||||
- keycloak_quarkus: allow configuration of ``hostname-strict-backchannel`` `#152 <https://github.com/ansible-middleware/keycloak/pull/152>`_
|
||||
- keycloak_quarkus: systemd restart behavior `#145 <https://github.com/ansible-middleware/keycloak/pull/145>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: Use ``keycloak_quarkus_java_opts`` `#154 <https://github.com/ansible-middleware/keycloak/pull/154>`_
|
||||
- keycloak_quarkus: allow ports <1024 (e.g. :443) in systemd unit `#150 <https://github.com/ansible-middleware/keycloak/pull/150>`_
|
||||
|
||||
v2.0.1
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- keycloak_quarkus: add hostname-strict parameter `#139 <https://github.com/ansible-middleware/keycloak/pull/139>`_
|
||||
- keycloak_quarkus: update to version 23.0.1 `#133 <https://github.com/ansible-middleware/keycloak/pull/133>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: template requires lowercase boolean values `#138 <https://github.com/ansible-middleware/keycloak/pull/138>`_
|
||||
|
||||
v2.0.0
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Add new parameter for port offset configuration `#124 <https://github.com/ansible-middleware/keycloak/pull/124>`_
|
||||
- Update Keycloak to version 22.0.5 `#122 <https://github.com/ansible-middleware/keycloak/pull/122>`_
|
||||
|
||||
Breaking Changes / Porting Guide
|
||||
--------------------------------
|
||||
|
||||
- Add support for more http-related configs `#115 <https://github.com/ansible-middleware/keycloak/pull/115>`_
|
||||
- Update minimum ansible-core version > 2.14 `#119 <https://github.com/ansible-middleware/keycloak/pull/119>`_
|
||||
- keycloak_quarkus: enable config of key store and trust store `#116 <https://github.com/ansible-middleware/keycloak/pull/116>`_
|
||||
|
||||
v1.3.0
|
||||
======
|
||||
|
||||
Major Changes
|
||||
-------------
|
||||
|
||||
- Run service as ``keycloak_service_user`` `#106 <https://github.com/ansible-middleware/keycloak/pull/106>`_
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- keycloak_quarkus: Update Keycloak to version 22.0.3 `#112 <https://github.com/ansible-middleware/keycloak/pull/112>`_
|
||||
- keycloak_quarkus: fix admin console redirect when running locally `#111 <https://github.com/ansible-middleware/keycloak/pull/111>`_
|
||||
- keycloak_quarkus: skip proxy config if ``keycloak_quarkus_proxy_mode`` is ``none`` `#109 <https://github.com/ansible-middleware/keycloak/pull/109>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: fix validation failure upon port configuration change `#113 <https://github.com/ansible-middleware/keycloak/pull/113>`_
|
||||
|
||||
v1.2.8
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- keycloak_quarkus: set openjdk 17 as default `#103 <https://github.com/ansible-middleware/keycloak/pull/103>`_
|
||||
- keycloak_quarkus: update to version 22.0.1 `#107 <https://github.com/ansible-middleware/keycloak/pull/107>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Fix incorrect checks for ``keycloak_jgroups_subnet`` `#98 <https://github.com/ansible-middleware/keycloak/pull/98>`_
|
||||
- Undefine ``keycloak_db_valid_conn_sql`` default `#91 <https://github.com/ansible-middleware/keycloak/pull/91>`_
|
||||
- Update bindep.txt package python3-devel to support RHEL9 `#105 <https://github.com/ansible-middleware/keycloak/pull/105>`_
|
||||
|
||||
v1.2.7
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Allow to override jgroups subnet `#93 <https://github.com/ansible-middleware/keycloak/pull/93>`_
|
||||
- keycloak-quarkus: update keycloakx to v21.1.1 `#92 <https://github.com/ansible-middleware/keycloak/pull/92>`_
|
||||
|
||||
v1.2.6
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Add profile features enabling/disabling `#87 <https://github.com/ansible-middleware/keycloak/pull/87>`_
|
||||
- Improve service restart behavior configuration `#88 <https://github.com/ansible-middleware/keycloak/pull/88>`_
|
||||
- Update default xa_datasource_class value for mariadb jdbc configuration `#89 <https://github.com/ansible-middleware/keycloak/pull/89>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Handle WFLYCTL0117 when background validation millis is 0 `#90 <https://github.com/ansible-middleware/keycloak/pull/90>`_
|
||||
|
||||
v1.2.5
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Add configuration for database connection pool validation `#85 <https://github.com/ansible-middleware/keycloak/pull/85>`_
|
||||
- Allow to configure administration endpoint URL `#86 <https://github.com/ansible-middleware/keycloak/pull/86>`_
|
||||
- Allow to force backend URLs to frontend URLs `#84 <https://github.com/ansible-middleware/keycloak/pull/84>`_
|
||||
- Introduce systemd unit restart behavior `#81 <https://github.com/ansible-middleware/keycloak/pull/81>`_
|
||||
|
||||
v1.2.4
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Add ``sqlserver`` to keycloak role jdbc configurations `#78 <https://github.com/ansible-middleware/keycloak/pull/78>`_
|
||||
- Add configurability for XA transactions `#73 <https://github.com/ansible-middleware/keycloak/pull/73>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Fix deprecation warning for ``ipaddr`` `#77 <https://github.com/ansible-middleware/keycloak/pull/77>`_
|
||||
- Fix undefined facts when offline patching sso `#71 <https://github.com/ansible-middleware/keycloak/pull/71>`_
|
||||
|
||||
v1.2.1
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Allow to setup keycloak HA cluster without remote cache store `#68 <https://github.com/ansible-middleware/keycloak/pull/68>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Pass attributes to realm clients `#69 <https://github.com/ansible-middleware/keycloak/pull/69>`_
|
||||
|
||||
v1.2.0
|
||||
======
|
||||
|
||||
Major Changes
|
||||
-------------
|
||||
|
||||
- Provide config for multiple modcluster proxies `#60 <https://github.com/ansible-middleware/keycloak/pull/60>`_
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Allow to configure TCPPING for cluster discovery `#62 <https://github.com/ansible-middleware/keycloak/pull/62>`_
|
||||
- Drop community.general from dependencies `#61 <https://github.com/ansible-middleware/keycloak/pull/61>`_
|
||||
- Switch middleware_automation.redhat_csp_download for middleware_automation.common `#63 <https://github.com/ansible-middleware/keycloak/pull/63>`_
|
||||
- Switch to middleware_automation.common for rh-sso patching `#64 <https://github.com/ansible-middleware/keycloak/pull/64>`_
|
||||
|
||||
v1.1.1
|
||||
======
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak-quarkus: fix ``cache-config-file`` path in keycloak.conf.j2 template `#53 <https://github.com/ansible-middleware/keycloak/pull/53>`_
|
||||
|
||||
v1.1.0
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Update keycloak to 18.0.2 - sso to 7.6.1 `#46 <https://github.com/ansible-middleware/keycloak/pull/46>`_
|
||||
- Variable ``keycloak_no_log`` controls ansible ``no_log`` parameter (for debugging purposes) `#47 <https://github.com/ansible-middleware/keycloak/pull/47>`_
|
||||
- Variables to override service start retries and delay `#51 <https://github.com/ansible-middleware/keycloak/pull/51>`_
|
||||
- keycloak_quarkus: variable to enable development mode `#45 <https://github.com/ansible-middleware/keycloak/pull/45>`_
|
||||
|
||||
Breaking Changes / Porting Guide
|
||||
--------------------------------
|
||||
|
||||
- Rename variables from ``infinispan_`` prefix to ``keycloak_infinispan_`` `#42 <https://github.com/ansible-middleware/keycloak/pull/42>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: fix /var/log/keycloak symlink to keycloak log directory `#44 <https://github.com/ansible-middleware/keycloak/pull/44>`_
|
||||
|
||||
v1.0.7
|
||||
======
|
||||
|
||||
Breaking Changes / Porting Guide
|
||||
--------------------------------
|
||||
|
||||
- keycloak_quarkus: use absolute path for certificate files `#39 <https://github.com/ansible-middleware/keycloak/pull/39>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: use become for tasks that will otherwise fail `#38 <https://github.com/ansible-middleware/keycloak/pull/38>`_
|
||||
|
||||
v1.0.6
|
||||
======
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- keycloak_quarkus: add selected java to PATH in systemd unit `#34 <https://github.com/ansible-middleware/keycloak/pull/34>`_
|
||||
- keycloak_quarkus: set logfile path correctly under keycloak home `#35 <https://github.com/ansible-middleware/keycloak/pull/35>`_
|
||||
|
||||
v1.0.5
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Update config options: keycloak and quarkus `#32 <https://github.com/ansible-middleware/keycloak/pull/32>`_
|
||||
|
||||
v1.0.4
|
||||
======
|
||||
|
||||
v1.0.3
|
||||
======
|
||||
|
||||
Major Changes
|
||||
-------------
|
||||
|
||||
- New role for installing keycloak >= 17.0.0 (quarkus) `#29 <https://github.com/ansible-middleware/keycloak/pull/29>`_
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Add ``keycloak_config_override_template`` parameter for passing a custom xml config template `#30 <https://github.com/ansible-middleware/keycloak/pull/30>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Make sure systemd unit starts with selected java JVM `#31 <https://github.com/ansible-middleware/keycloak/pull/31>`_
|
||||
|
||||
v1.0.2
|
||||
======
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Make ``keycloak_admin_password`` a default with assert (was: role variable) `#26 <https://github.com/ansible-middleware/keycloak/pull/26>`_
|
||||
- Simplify dependency install logic and reduce play execution time `#19 <https://github.com/ansible-middleware/keycloak/pull/19>`_
|
||||
|
||||
Bugfixes
|
||||
--------
|
||||
|
||||
- Set ``keycloak_frontend_url`` default according to other defaults `#25 <https://github.com/ansible-middleware/keycloak/pull/25>`_
|
||||
|
||||
v1.0.1
|
||||
======
|
||||
|
||||
Release Summary
|
||||
---------------
|
||||
|
||||
Minor enhancements, bug and documentation fixes.
|
||||
|
||||
Major Changes
|
||||
-------------
|
||||
|
||||
- Apply latest cumulative patch of RH-SSO automatically when new parameter ``keycloak_rhsso_apply_patches`` is ``true`` `#18 <https://github.com/ansible-middleware/keycloak/pull/18>`_
|
||||
|
||||
Minor Changes
|
||||
-------------
|
||||
|
||||
- Clustered installs now perform database initialization on first node to avoid locking issues `#17 <https://github.com/ansible-middleware/keycloak/pull/17>`_
|
||||
|
||||
v1.0.0
|
||||
======
|
||||
|
||||
Release Summary
|
||||
---------------
|
||||
|
||||
This is the first stable release of the ``middleware_automation.keycloak`` collection.
|
||||
144
2.1.0/_sources/README.md.txt
Normal file
144
2.1.0/_sources/README.md.txt
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
# Ansible Collection - middleware_automation.keycloak
|
||||
|
||||
<!--start build_status -->
|
||||
[](https://github.com/ansible-middleware/keycloak/actions/workflows/ci.yml)
|
||||
|
||||
> **_NOTE:_ If you are Red Hat customer, install `redhat.sso` (for Red Hat Single Sign-On) or `redhat.rhbk` (for Red Hat Build of Keycloak) from [Automation Hub](https://console.redhat.com/ansible/ansible-dashboard) as the certified version of this collection.**
|
||||
|
||||
<!--end build_status -->
|
||||
Collection to install and configure [Keycloak](https://www.keycloak.org/) or [Red Hat Single Sign-On](https://access.redhat.com/products/red-hat-single-sign-on) / [Red Hat Build of Keycloak](https://access.redhat.com/products/red-hat-build-of-keycloak).
|
||||
|
||||
<!--start requires_ansible-->
|
||||
## Ansible version compatibility
|
||||
|
||||
This collection has been tested against following Ansible versions: **>=2.14.0**.
|
||||
|
||||
Plugins and modules within a collection may be tested with only specific Ansible versions. A collection may contain metadata that identifies these versions.
|
||||
<!--end requires_ansible-->
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
<!--start galaxy_download -->
|
||||
### Installing the Collection from Ansible Galaxy
|
||||
|
||||
Before using the collection, you need to install it with the Ansible Galaxy CLI:
|
||||
|
||||
ansible-galaxy collection install middleware_automation.keycloak
|
||||
|
||||
<!--end galaxy_download -->
|
||||
|
||||
You can also include it in a `requirements.yml` file and install it via `ansible-galaxy collection install -r requirements.yml`, using the format:
|
||||
|
||||
```yaml
|
||||
---
|
||||
collections:
|
||||
- name: middleware_automation.keycloak
|
||||
```
|
||||
|
||||
The keycloak collection also depends on the following python packages to be present on the controller host:
|
||||
|
||||
* netaddr
|
||||
|
||||
A requirement file is provided to install:
|
||||
|
||||
pip install -r requirements.txt
|
||||
|
||||
<!--start roles_paths -->
|
||||
### Included roles
|
||||
|
||||
* [`keycloak`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak/README.md): role for installing the service (keycloak <= 19.0).
|
||||
* [`keycloak_realm`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_realm/README.md): role for configuring a realm, user federation(s), clients and users, in an installed service.
|
||||
* [`keycloak_quarkus`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_quarkus/README.md): role for installing the quarkus variant of keycloak (>= 17.0.0).
|
||||
<!--end roles_paths -->
|
||||
|
||||
## Usage
|
||||
|
||||
|
||||
### Install Playbook
|
||||
<!--start rhbk_playbook -->
|
||||
* [`playbooks/keycloak.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak.yml) installs keycloak legacy based on the defined variables (using most defaults).
|
||||
* [`playbooks/keycloak_quarkus.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak_quarkus.yml) installs keycloak >= 17 based on the defined variables (using most defaults).
|
||||
|
||||
Both playbooks include the `keycloak` role, with different settings, as described in the following sections.
|
||||
|
||||
For full service configuration details, refer to the [keycloak role README](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak/README.md).
|
||||
<!--end rhbk_playbook -->
|
||||
|
||||
#### Install from controller node (offline)
|
||||
|
||||
Making the keycloak zip archive available to the playbook working directory, and setting `keycloak_offline_install` to `true`, allows to skip
|
||||
the download tasks. The local path for the archive does match the downloaded archive path, so that it is also used as a cache when multiple hosts are provisioned in a cluster.
|
||||
|
||||
```yaml
|
||||
keycloak_offline_install: true
|
||||
```
|
||||
|
||||
|
||||
<!--start rhn_credentials -->
|
||||
<!--end rhn_credentials -->
|
||||
|
||||
|
||||
#### Install from alternate sources (like corporate Nexus, artifactory, proxy, etc)
|
||||
|
||||
It is possible to perform downloads from alternate sources, using the `keycloak_download_url` variable; make sure the final downloaded filename matches with the source filename (ie. keycloak-legacy-x.y.zip or rh-sso-x.y.z-server-dist.zip).
|
||||
|
||||
|
||||
### Example installation command
|
||||
|
||||
Execute the following command from the source root directory
|
||||
|
||||
```
|
||||
ansible-playbook -i <ansible_hosts> -e @rhn-creds.yml playbooks/keycloak.yml -e keycloak_admin_password=<changeme>
|
||||
```
|
||||
|
||||
- `keycloak_admin_password` Password for the administration console user account.
|
||||
- `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost
|
||||
|
||||
```
|
||||
[keycloak]
|
||||
localhost ansible_connection=local
|
||||
```
|
||||
|
||||
Note: when deploying clustered configurations, all hosts belonging to the cluster must be present in ansible_play_batch; ie. they must be targeted by the same ansible-playbook execution.
|
||||
|
||||
|
||||
## Configuration
|
||||
|
||||
|
||||
### Config Playbook
|
||||
<!--start rhbk_realm_playbook -->
|
||||
[`playbooks/keycloak_realm.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak_realm.yml) creates or updates provided realm, user federation(s), client(s), client role(s) and client user(s).
|
||||
<!--end rhbk_realm_playbook -->
|
||||
|
||||
### Example configuration command
|
||||
|
||||
Execute the following command from the source root directory:
|
||||
|
||||
```bash
|
||||
ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_admin_password=<changeme> -e keycloak_realm=test
|
||||
```
|
||||
|
||||
- `keycloak_admin_password` password for the administration console user account.
|
||||
- `keycloak_realm` name of the realm to be created/used.
|
||||
- `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost
|
||||
|
||||
```
|
||||
[keycloak]
|
||||
localhost ansible_connection=local
|
||||
```
|
||||
<!--start rhbk_realm_readme -->
|
||||
For full configuration details, refer to the [keycloak_realm role README](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_realm/README.md).
|
||||
<!--end rhbk_realm_readme -->
|
||||
|
||||
<!--start support -->
|
||||
<!--end support -->
|
||||
|
||||
|
||||
## License
|
||||
|
||||
Apache License v2.0 or later
|
||||
<!--start license -->
|
||||
See [LICENSE](LICENSE) to view the full text.
|
||||
<!--end license -->
|
||||
|
||||
14
2.1.0/_sources/developing.md.txt
Normal file
14
2.1.0/_sources/developing.md.txt
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
|
||||
## Contributor's Guidelines
|
||||
|
||||
- All YAML files named with `.yml` extension
|
||||
- Use spaces around jinja variables. `{{ var }}` over `{{var}}`
|
||||
- Variables that are internal to the role should be lowercase and start with the role name
|
||||
- Keep roles self contained - Roles should avoid including tasks from other roles when possible
|
||||
- Plays should do nothing more than include a list of roles, except where `pre_tasks` and `post_tasks` are required, when possible
|
||||
- Separators - Use valid names, ie. underscores (e.g. `my_role` `my_playbook`) not dashes (`my-role`)
|
||||
- Paths - When defining paths, do not include trailing slashes (e.g. `my_path: /foo` not `my_path: /foo/`); when concatenating paths, follow the same convention (e.g. `{{ my_path }}/bar` not `{{ my_path }}bar`)
|
||||
- Indentation - Use 2 spaces for each indent
|
||||
- `vars/` vs `defaults/` - internal or interpolated variables that don't need to change or be overridden by user go in `vars/`, those that a user would likely override, go under `defaults/` directory
|
||||
- All role arguments have a specification in `meta/argument_specs.yml`
|
||||
- All playbooks/roles should be focused on compatibility with Ansible Automation Platform
|
||||
39
2.1.0/_sources/index.rst.txt
Normal file
39
2.1.0/_sources/index.rst.txt
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
.. Red Hat middleware_automation Keycloak Ansible Collection documentation main file
|
||||
|
||||
Welcome to Keycloak Collection documentation
|
||||
============================================
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: User documentation
|
||||
|
||||
README
|
||||
plugins/index
|
||||
roles/index
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: Developer documentation
|
||||
|
||||
testing
|
||||
developing
|
||||
releasing
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: General
|
||||
|
||||
Changelog <CHANGELOG>
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: Middleware collections
|
||||
|
||||
Infinispan / Red Hat Data Grid <https://ansible-middleware.github.io/infinispan/>
|
||||
Keycloak / Red Hat Single Sign-On <https://ansible-middleware.github.io/keycloak/>
|
||||
Wildfly / Red Hat JBoss EAP <https://ansible-middleware.github.io/wildfly/>
|
||||
Tomcat / Red Hat JWS <https://ansible-middleware.github.io/jws/>
|
||||
ActiveMQ / Red Hat AMQ Broker <https://ansible-middleware.github.io/amq/>
|
||||
Kafka / Red Hat AMQ Streams <https://ansible-middleware.github.io/amq_streams/>
|
||||
Red Hat CSP Download <https://ansible-middleware.github.io/redhat-csp-download/>
|
||||
JCliff <https://ansible-middleware.github.io/ansible_collections_jcliff/>
|
||||
11
2.1.0/_sources/plugins/index.rst.txt
Normal file
11
2.1.0/_sources/plugins/index.rst.txt
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
Plugin Index
|
||||
============
|
||||
|
||||
.. toctree::
|
||||
:caption: modules plugins
|
||||
:maxdepth: 0
|
||||
|
||||
keycloak_client
|
||||
keycloak_role
|
||||
keycloak_user_federation
|
||||
|
||||
1738
2.1.0/_sources/plugins/keycloak_client.rst.txt
Normal file
1738
2.1.0/_sources/plugins/keycloak_client.rst.txt
Normal file
File diff suppressed because it is too large
Load diff
613
2.1.0/_sources/plugins/keycloak_role.rst.txt
Normal file
613
2.1.0/_sources/plugins/keycloak_role.rst.txt
Normal file
|
|
@ -0,0 +1,613 @@
|
|||
|
||||
.. Document meta
|
||||
|
||||
:orphan:
|
||||
|
||||
.. |antsibull-internal-nbsp| unicode:: 0xA0
|
||||
:trim:
|
||||
|
||||
.. meta::
|
||||
:antsibull-docs: 2.10.0
|
||||
|
||||
.. Anchors
|
||||
|
||||
.. _ansible_collections.middleware_automation.keycloak.keycloak_role_module:
|
||||
|
||||
.. Anchors: short name for ansible.builtin
|
||||
|
||||
.. Title
|
||||
|
||||
keycloak_role -- Allows administration of Keycloak roles via Keycloak API
|
||||
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
|
||||
.. Collection note
|
||||
|
||||
.. note::
|
||||
This module is part of the `middleware_automation.keycloak collection <https://galaxy.ansible.com/ui/repo/published/middleware_automation/keycloak/>`_.
|
||||
|
||||
It is not included in ``ansible-core``.
|
||||
To check whether it is installed, run :code:`ansible-galaxy collection list`.
|
||||
|
||||
To install it, use: :code:`ansible-galaxy collection install middleware\_automation.keycloak`.
|
||||
|
||||
To use it in a playbook, specify: :code:`middleware_automation.keycloak.keycloak_role`.
|
||||
|
||||
.. version_added
|
||||
|
||||
.. rst-class:: ansible-version-added
|
||||
|
||||
New in middleware\_automation.keycloak 3.4.0
|
||||
|
||||
.. contents::
|
||||
:local:
|
||||
:depth: 1
|
||||
|
||||
.. Deprecated
|
||||
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
.. Description
|
||||
|
||||
- This module allows you to add, remove or modify Keycloak roles via the Keycloak REST API. It requires access to the REST API via OpenID Connect; the user connecting and the client being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate client definition with the scope tailored to your needs and a user having the expected roles.
|
||||
- The names of module options are snake\_cased versions of the camelCase ones found in the Keycloak API and its documentation at \ https://www.keycloak.org/docs-api/8.0/rest-api/index.html\ .
|
||||
- Attributes are multi-valued in the Keycloak API. All attributes are lists of individual values and will be returned that way by this module. You may pass single values for attributes when calling the module, and this will be translated into a list suitable for the API.
|
||||
|
||||
|
||||
.. Aliases
|
||||
|
||||
|
||||
.. Requirements
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
.. Options
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<table class="colwidths-auto ansible-option-table docutils align-default" style="width: 100%">
|
||||
<thead>
|
||||
<tr class="row-odd">
|
||||
<th class="head"><p>Parameter</p></th>
|
||||
<th class="head"><p>Comments</p></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-attributes"></div>
|
||||
<p class="ansible-option-title"><strong>attributes</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-attributes" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">dictionary</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>A dict of key/value pairs to set as custom attributes for the role.</p>
|
||||
<p>Values may be single values (e.g. a string) or a list of strings.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_client_id"></div>
|
||||
<p class="ansible-option-title"><strong>auth_client_id</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_client_id" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>OpenID Connect <em>client_id</em> to authenticate to the API with.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-default-bold">Default:</strong> <code class="ansible-value literal notranslate ansible-option-default">"admin-cli"</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_client_secret"></div>
|
||||
<p class="ansible-option-title"><strong>auth_client_secret</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_client_secret" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Client Secret to use in conjunction with <em>auth_client_id</em> (if required).</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_keycloak_url"></div>
|
||||
<div class="ansibleOptionAnchor" id="parameter-url"></div>
|
||||
<p class="ansible-option-title"><strong>auth_keycloak_url</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_keycloak_url" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line"><span class="ansible-option-aliases">aliases: url</span></p>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
/ <span class="ansible-option-required">required</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>URL to the Keycloak instance.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_password"></div>
|
||||
<div class="ansibleOptionAnchor" id="parameter-password"></div>
|
||||
<p class="ansible-option-title"><strong>auth_password</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_password" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line"><span class="ansible-option-aliases">aliases: password</span></p>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Password to authenticate for API access with.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_realm"></div>
|
||||
<p class="ansible-option-title"><strong>auth_realm</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_realm" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Keycloak realm name to authenticate to for API access.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-auth_username"></div>
|
||||
<div class="ansibleOptionAnchor" id="parameter-username"></div>
|
||||
<p class="ansible-option-title"><strong>auth_username</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-auth_username" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line"><span class="ansible-option-aliases">aliases: username</span></p>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Username to authenticate for API access with.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-client_id"></div>
|
||||
<p class="ansible-option-title"><strong>client_id</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-client_id" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>If the role is a client role, the client id under which it resides.</p>
|
||||
<p>If this parameter is absent, the role is considered a realm role.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-connection_timeout"></div>
|
||||
<p class="ansible-option-title"><strong>connection_timeout</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-connection_timeout" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">integer</span>
|
||||
</p>
|
||||
<p><em class="ansible-option-versionadded">added in middleware_automation.keycloak 4.5.0</em></p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Controls the HTTP connections timeout period (in seconds) to Keycloak API.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-default-bold">Default:</strong> <code class="ansible-value literal notranslate ansible-option-default">10</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-description"></div>
|
||||
<p class="ansible-option-title"><strong>description</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-description" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>The role description.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-http_agent"></div>
|
||||
<p class="ansible-option-title"><strong>http_agent</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-http_agent" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
<p><em class="ansible-option-versionadded">added in middleware_automation.keycloak 5.4.0</em></p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Configures the HTTP User-Agent header.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-default-bold">Default:</strong> <code class="ansible-value literal notranslate ansible-option-default">"Ansible"</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-name"></div>
|
||||
<p class="ansible-option-title"><strong>name</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-name" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
/ <span class="ansible-option-required">required</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Name of the role.</p>
|
||||
<p>This parameter is required.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-realm"></div>
|
||||
<p class="ansible-option-title"><strong>realm</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-realm" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>The Keycloak realm under which this role resides.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-default-bold">Default:</strong> <code class="ansible-value literal notranslate ansible-option-default">"master"</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-state"></div>
|
||||
<p class="ansible-option-title"><strong>state</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-state" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>State of the role.</p>
|
||||
<p>On <code class='docutils literal notranslate'>present</code>, the role will be created if it does not yet exist, or updated with the parameters you provide.</p>
|
||||
<p>On <code class='docutils literal notranslate'>absent</code>, the role will be removed if it exists.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-choices">Choices:</strong></p>
|
||||
<ul class="simple">
|
||||
<li><p><code class="ansible-value literal notranslate ansible-option-default-bold"><strong>"present"</strong></code> <span class="ansible-option-choices-default-mark">← (default)</span></p></li>
|
||||
<li><p><code class="ansible-value literal notranslate ansible-option-choices-entry">"absent"</code></p></li>
|
||||
</ul>
|
||||
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-token"></div>
|
||||
<p class="ansible-option-title"><strong>token</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-token" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
<p><em class="ansible-option-versionadded">added in middleware_automation.keycloak 3.0.0</em></p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Authentication token for Keycloak API.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="parameter-validate_certs"></div>
|
||||
<p class="ansible-option-title"><strong>validate_certs</strong></p>
|
||||
<a class="ansibleOptionLink" href="#parameter-validate_certs" title="Permalink to this option"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">boolean</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Verify TLS certificates (do not disable this in production).</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-choices">Choices:</strong></p>
|
||||
<ul class="simple">
|
||||
<li><p><code class="ansible-value literal notranslate ansible-option-choices-entry">false</code></p></li>
|
||||
<li><p><code class="ansible-value literal notranslate ansible-option-default-bold"><strong>true</strong></code> <span class="ansible-option-choices-default-mark">← (default)</span></p></li>
|
||||
</ul>
|
||||
|
||||
</div></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
.. Attributes
|
||||
|
||||
|
||||
Attributes
|
||||
----------
|
||||
|
||||
.. tabularcolumns:: \X{2}{10}\X{3}{10}\X{5}{10}
|
||||
|
||||
.. list-table::
|
||||
:width: 100%
|
||||
:widths: auto
|
||||
:header-rows: 1
|
||||
:class: longtable ansible-option-table
|
||||
|
||||
* - Attribute
|
||||
- Support
|
||||
- Description
|
||||
|
||||
* - .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="attribute-check_mode"></div>
|
||||
|
||||
.. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__attribute-check_mode:
|
||||
|
||||
.. rst-class:: ansible-option-title
|
||||
|
||||
**check_mode**
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<a class="ansibleOptionLink" href="#attribute-check_mode" title="Permalink to this attribute"></a>
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
- .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
|
||||
:ansible-attribute-support-label:`Support: \ `\ :ansible-attribute-support-full:`full`
|
||||
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
- .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
|
||||
Can run in \ :literal:`check\_mode`\ and return changed status prediction without modifying target.
|
||||
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
* - .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="attribute-diff_mode"></div>
|
||||
|
||||
.. _ansible_collections.middleware_automation.keycloak.keycloak_role_module__attribute-diff_mode:
|
||||
|
||||
.. rst-class:: ansible-option-title
|
||||
|
||||
**diff_mode**
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<a class="ansibleOptionLink" href="#attribute-diff_mode" title="Permalink to this attribute"></a>
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
- .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
|
||||
:ansible-attribute-support-label:`Support: \ `\ :ansible-attribute-support-full:`full`
|
||||
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
- .. raw:: html
|
||||
|
||||
<div class="ansible-option-cell">
|
||||
|
||||
Will return details on what has changed (or possibly needs changing in \ :literal:`check\_mode`\ ), when in diff mode.
|
||||
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
.. Notes
|
||||
|
||||
|
||||
.. Seealso
|
||||
|
||||
|
||||
.. Examples
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
.. code-block:: yaml+jinja
|
||||
|
||||
|
||||
- name: Create a Keycloak realm role, authentication with credentials
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: my-new-kc-role
|
||||
realm: MyCustomRealm
|
||||
state: present
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Create a Keycloak realm role, authentication with token
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: my-new-kc-role
|
||||
realm: MyCustomRealm
|
||||
state: present
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
token: TOKEN
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Create a Keycloak client role
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: my-new-kc-role
|
||||
realm: MyCustomRealm
|
||||
client_id: MyClient
|
||||
state: present
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Delete a Keycloak role
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: my-role-for-deletion
|
||||
state: absent
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Create a keycloak role with some custom attributes
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
name: my-new-role
|
||||
attributes:
|
||||
attrib1: value1
|
||||
attrib2: value2
|
||||
attrib3:
|
||||
- with
|
||||
- numerous
|
||||
- individual
|
||||
- list
|
||||
- items
|
||||
delegate_to: localhost
|
||||
|
||||
|
||||
|
||||
|
||||
.. Facts
|
||||
|
||||
|
||||
.. Return values
|
||||
|
||||
Return Values
|
||||
-------------
|
||||
Common return values are documented :ref:`here <common_return_values>`, the following are the fields unique to this module:
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<table class="colwidths-auto ansible-option-table docutils align-default" style="width: 100%">
|
||||
<thead>
|
||||
<tr class="row-odd">
|
||||
<th class="head"><p>Key</p></th>
|
||||
<th class="head"><p>Description</p></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="return-end_state"></div>
|
||||
<p class="ansible-option-title"><strong>end_state</strong></p>
|
||||
<a class="ansibleOptionLink" href="#return-end_state" title="Permalink to this return value"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">dictionary</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Representation of role after module execution (sample is truncated).</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-returned-bold">Returned:</strong> on success</p>
|
||||
<p class="ansible-option-line ansible-option-sample"><strong class="ansible-option-sample-bold">Sample:</strong> <code class="ansible-value literal notranslate ansible-option-sample">{"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My updated client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="return-existing"></div>
|
||||
<p class="ansible-option-title"><strong>existing</strong></p>
|
||||
<a class="ansibleOptionLink" href="#return-existing" title="Permalink to this return value"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">dictionary</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Representation of existing role.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-returned-bold">Returned:</strong> always</p>
|
||||
<p class="ansible-option-line ansible-option-sample"><strong class="ansible-option-sample-bold">Sample:</strong> <code class="ansible-value literal notranslate ansible-option-sample">{"attributes": {}, "clientRole": true, "composite": false, "containerId": "9f03eb61-a826-4771-a9fd-930e06d2d36a", "description": "My client test role", "id": "561703dd-0f38-45ff-9a5a-0c978f794547", "name": "myrole"}</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-even">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="return-msg"></div>
|
||||
<p class="ansible-option-title"><strong>msg</strong></p>
|
||||
<a class="ansibleOptionLink" href="#return-msg" title="Permalink to this return value"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">string</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Message as to what action was taken.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-returned-bold">Returned:</strong> always</p>
|
||||
<p class="ansible-option-line ansible-option-sample"><strong class="ansible-option-sample-bold">Sample:</strong> <code class="ansible-value literal notranslate ansible-option-sample">"Role myrole has been updated"</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
<tr class="row-odd">
|
||||
<td><div class="ansible-option-cell">
|
||||
<div class="ansibleOptionAnchor" id="return-proposed"></div>
|
||||
<p class="ansible-option-title"><strong>proposed</strong></p>
|
||||
<a class="ansibleOptionLink" href="#return-proposed" title="Permalink to this return value"></a>
|
||||
<p class="ansible-option-type-line">
|
||||
<span class="ansible-option-type">dictionary</span>
|
||||
</p>
|
||||
</div></td>
|
||||
<td><div class="ansible-option-cell">
|
||||
<p>Representation of proposed role.</p>
|
||||
<p class="ansible-option-line"><strong class="ansible-option-returned-bold">Returned:</strong> always</p>
|
||||
<p class="ansible-option-line ansible-option-sample"><strong class="ansible-option-sample-bold">Sample:</strong> <code class="ansible-value literal notranslate ansible-option-sample">{"description": "My updated test description"}</code></p>
|
||||
</div></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
.. Status (Presently only deprecated)
|
||||
|
||||
|
||||
.. Authors
|
||||
|
||||
Authors
|
||||
~~~~~~~
|
||||
|
||||
- Laurent Paumier (@laurpaum)
|
||||
|
||||
|
||||
|
||||
.. Extra links
|
||||
|
||||
|
||||
.. Parsing errors
|
||||
|
||||
1541
2.1.0/_sources/plugins/keycloak_user_federation.rst.txt
Normal file
1541
2.1.0/_sources/plugins/keycloak_user_federation.rst.txt
Normal file
File diff suppressed because it is too large
Load diff
61
2.1.0/_sources/releasing.md.txt
Normal file
61
2.1.0/_sources/releasing.md.txt
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
# Collection Versioning Strategy
|
||||
|
||||
Each supported collection maintained by Ansible follows Semantic Versioning 2.0.0 (https://semver.org/), for example:
|
||||
Given a version number MAJOR.MINOR.PATCH, the following is incremented:
|
||||
|
||||
MAJOR version: when making incompatible API changes (see Feature Release scenarios below for examples)
|
||||
|
||||
MINOR version: when adding features or functionality in a backwards compatible manner, or updating testing matrix and/or metadata (deprecation)
|
||||
|
||||
PATCH version: when adding backwards compatible bug fixes or security fixes (strict).
|
||||
|
||||
Additional labels for pre-release and build metadata are available as extensions to the MAJOR.MINOR.PATCH format.
|
||||
|
||||
The first version of a generally available supported collection on Ansible Automation Hub shall be version 1.0.0. NOTE: By default, all newly created collections may begin with a smaller default version of 0.1.0, and therefore a version of 1.0.0 should be explicitly stated by the collection maintainer.
|
||||
|
||||
## New content is added to an existing collection
|
||||
|
||||
Assuming the current release is 1.0.0, and a new module is ready to be added to the collection, the minor version would be incremented to 1.1.0. The change in the MINOR version indicates an additive change was made while maintaining backward compatibility for existing content within the collection.
|
||||
|
||||
|
||||
## New feature to existing plugin or role within a collection (backwards compatible)
|
||||
|
||||
Assuming the current release is 1.0.0, and new features for an existing module are ready for release . We would increment the MINOR version to 1.1.0. The change in the MINOR version indicates an additive change was made while maintaining backward compatibility for existing content within the collection.
|
||||
|
||||
|
||||
## Bug fix or security fix to existing content within a collection
|
||||
|
||||
Assuming the current release is 1.0.0 and a bug is fixed prior to the next minor release, the PATCH version would be incremented to 1.0.1. The patch indicates only a bug was fixed within a current version. The PATCH release does not contain new content, nor was functionality removed. Bug fixes may be included in a MINOR or MAJOR feature release if the timing allows, eliminating the need for a PATCH dedicated to the fix.
|
||||
|
||||
|
||||
## Breaking change to any content within a collection
|
||||
|
||||
Assuming the current release is 1.0.0, and a breaking change (API or module) is introduced for a user or developer. The MAJOR version would be incremented to 2.0.0.
|
||||
|
||||
Examples of breaking changes within a collection may include but are not limited to:
|
||||
|
||||
- Argspec changes for a module that require either inventory structure or playbook changes.
|
||||
- A change in the shape of either the inbound or returned payload of a filter plugin.
|
||||
- Changes to a connection plugin that require additional inventory parameters or ansible.cfg entries.
|
||||
- New functionality added to a module that changes the outcome of that module as released in previous versions.
|
||||
- The removal of plugins from a collection.
|
||||
|
||||
|
||||
## Content removed from a collection
|
||||
|
||||
Deleting a module or API is a breaking change. Please see the 'Breaking change' section for how to version this.
|
||||
|
||||
|
||||
## A typographical error was fixed in the documentation for a collection
|
||||
|
||||
A correction to the README would be considered a bug fix and the PATCH incremented. See 'Bug fix' above.
|
||||
|
||||
|
||||
## Documentation added/removed/modified within a collection
|
||||
|
||||
Only the PATCH version should be increased for a release that contains changes limited to revised documentation.
|
||||
|
||||
|
||||
## Release automation
|
||||
|
||||
New releases are triggered by annotated git tags named after semantic versioning. The automation publishes the built artifacts to ansible-galaxy and github releases page.
|
||||
7
2.1.0/_sources/roles/index.rst.txt
Normal file
7
2.1.0/_sources/roles/index.rst.txt
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
Role Index
|
||||
==========
|
||||
|
||||
.. toctree::
|
||||
keycloak
|
||||
keycloak_quarkus
|
||||
keycloak_realm
|
||||
214
2.1.0/_sources/roles/keycloak.md.txt
Normal file
214
2.1.0/_sources/roles/keycloak.md.txt
Normal file
|
|
@ -0,0 +1,214 @@
|
|||
keycloak
|
||||
========
|
||||
|
||||
Install [keycloak](https://keycloak.org/) or [Red Hat Single Sign-On](https://access.redhat.com/products/red-hat-single-sign-on) server configurations.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
This role requires the `python3-netaddr` library installed on the controller node.
|
||||
|
||||
* to install via yum/dnf: `dnf install python3-netaddr`
|
||||
* or via pip: `pip install netaddr==0.8.0`
|
||||
* or via the collection: `pip install -r requirements.txt`
|
||||
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
The roles depends on:
|
||||
|
||||
* [middleware_automation.common](https://github.com/ansible-middleware/common)
|
||||
* [ansible-posix](https://docs.ansible.com/ansible/latest/collections/ansible/posix/index.html)
|
||||
|
||||
To install all the dependencies via galaxy:
|
||||
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
|
||||
|
||||
Versions
|
||||
--------
|
||||
|
||||
| RH-SSO VERSION | Release Date | Keycloak Version | EAP Version | Notes |
|
||||
|:---------------|:------------------|:-----------------|:------------|:----------------|
|
||||
|`7.5.0 GA` |September 20, 2021 |`15.0.2` | `7.4.6` |[Release Notes](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index)|
|
||||
|`7.6.0 GA` |June 30, 2022 |`18.0.3` | `7.4.6` |[Release Notes](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.6/html-single/release_notes/index)|
|
||||
|
||||
|
||||
Patching
|
||||
--------
|
||||
|
||||
When variable `keycloak_rhsso_apply_patches` is `true` (default: `false`), the role will automatically apply the latest cumulative patch for the selected base version.
|
||||
|
||||
| RH-SSO VERSION | Release Date | RH-SSO LATEST CP | Notes |
|
||||
|:---------------|:------------------|:-----------------|:----------------|
|
||||
|`7.5.0 GA` |January 20, 2022 |`7.5.3 GA` |[Release Notes](https://access.redhat.com/articles/6646321)|
|
||||
|`7.6.0 GA` |November 11, 2022 |`7.6.1 GA` |[Release Notes](https://access.redhat.com/articles/6982711)|
|
||||
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
* Service configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_ha_enabled`| Enable auto configuration for database backend, clustering and remote caches on infinispan | `False` |
|
||||
|`keycloak_ha_discovery`| Discovery protocol for HA cluster members | `JDBC_PING` if `keycloak_db_enabled` else `TCPPING` |
|
||||
|`keycloak_db_enabled`| Enable auto configuration for database backend | `True` if `keycloak_ha_enabled` is True, else `False` |
|
||||
|`keycloak_remote_cache_enabled`| Enable remote cache store when in clustered ha configurations | `True` if `keycloak_ha_enabled` else `False` |
|
||||
|`keycloak_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_bind_address`| Address for binding service ports | `0.0.0.0` |
|
||||
|`keycloak_management_port_bind_address`| Address for binding management ports | `127.0.0.1` |
|
||||
|`keycloak_host`| hostname | `localhost` |
|
||||
|`keycloak_http_port`| HTTP port | `8080` |
|
||||
|`keycloak_https_port`| TLS HTTP port | `8443` |
|
||||
|`keycloak_ajp_port`| AJP port | `8009` |
|
||||
|`keycloak_jgroups_port`| jgroups cluster tcp port | `7600` |
|
||||
|`keycloak_management_http_port`| Management port | `9990` |
|
||||
|`keycloak_management_https_port`| TLS management port | `9993` |
|
||||
|`keycloak_prefer_ipv4`| Prefer IPv4 stack and addresses for port binding | `true` |
|
||||
|`keycloak_config_standalone_xml`| filename for configuration | `keycloak.xml` |
|
||||
|`keycloak_service_user`| posix account username | `keycloak` |
|
||||
|`keycloak_service_group`| posix account group | `keycloak` |
|
||||
|`keycloak_service_restart_always`| systemd restart always behavior activation | `False` |
|
||||
|`keycloak_service_restart_on_failure`| systemd restart on-failure behavior activation | `False` |
|
||||
|`keycloak_service_startlimitintervalsec`| systemd StartLimitIntervalSec | `300` |
|
||||
|`keycloak_service_startlimitburst`| systemd StartLimitBurst | `5` |
|
||||
|`keycloak_service_restartsec`| systemd RestartSec | `10s` |
|
||||
|`keycloak_service_pidfile`| pid file path for service | `/run/keycloak/keycloak.pid` |
|
||||
|`keycloak_features` | List of `name`/`status` pairs of features (also known as profiles on RH-SSO) to `enable` or `disable`, example: `[ { name: 'docker', status: 'enabled' } ]` | `[]`
|
||||
|`keycloak_jvm_package`| RHEL java package runtime | `java-1.8.0-openjdk-headless` |
|
||||
|`keycloak_java_home`| `JAVA_HOME` of installed JRE, leave empty for using RPM path at `keycloak_jvm_package` | `None` |
|
||||
|`keycloak_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` |
|
||||
|
||||
|
||||
* Install options
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_offline_install` | perform an offline install | `false`|
|
||||
|`keycloak_download_url`| Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/<version>/<archive>`|
|
||||
|`keycloak_version`| keycloak.org package version | `18.0.2` |
|
||||
|`keycloak_dest`| Installation root path | `/opt/keycloak` |
|
||||
|`keycloak_download_url` | Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/{{ keycloak_archive }}` |
|
||||
|`keycloak_configure_firewalld` | Ensure firewalld is running and configure keycloak ports | `false` |
|
||||
|
||||
|
||||
* Miscellaneous configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_archive` | keycloak install archive filename | `keycloak-legacy-{{ keycloak_version }}.zip` |
|
||||
|`keycloak_download_url_9x` | Download URL for keycloak (deprecated) | `https://downloads.jboss.org/keycloak/{{ keycloak_version }}/{{ keycloak_archive }}` |
|
||||
|`keycloak_installdir` | Installation path | `{{ keycloak_dest }}/keycloak-{{ keycloak_version }}` |
|
||||
|`keycloak_jboss_home` | Installation work directory | `{{ keycloak_rhsso_installdir }}` |
|
||||
|`keycloak_jboss_port_offset` | Port offset for the JBoss socket binding | `0` |
|
||||
|`keycloak_config_dir` | Path for configuration | `{{ keycloak_jboss_home }}/standalone/configuration` |
|
||||
|`keycloak_config_path_to_standalone_xml` | Custom path for configuration | `{{ keycloak_jboss_home }}/standalone/configuration/{{ keycloak_config_standalone_xml }}` |
|
||||
|`keycloak_config_override_template` | Path to custom template for standalone.xml configuration | `''` |
|
||||
|`keycloak_auth_realm` | Name for rest authentication realm | `master` |
|
||||
|`keycloak_auth_client` | Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_force_install` | Remove pre-existing versions of service | `false` |
|
||||
|`keycloak_url` | URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port + keycloak_jboss_port_offset }}` |
|
||||
|`keycloak_management_url` | URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port + keycloak_jboss_port_offset }}` |
|
||||
|`keycloak_frontend_url_force` | Force backend requests to use the frontend URL | `false` |
|
||||
|`keycloak_db_background_validation` | Enable background validation of database connection | `false` |
|
||||
|`keycloak_db_background_validation_millis`| How frequenly the connection pool is validated in the background | `10000` if background validation enabled |
|
||||
|`keycloak_db_background_validate_on_match` | Enable validate on match for database connections | `false` |
|
||||
|`keycloak_frontend_url` | frontend URL for keycloak endpoint | `http://localhost:8080/auth/` |
|
||||
|`keycloak_log_target`| Set the destination of the keycloak log folder link | `/var/log/keycloak` |
|
||||
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
The following are a set of _required_ variables for the role:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_admin_password`| Password for the administration console user account (minimum 12 characters) |
|
||||
|`keycloak_frontend_url` | frontend URL for keycloak endpoint | `http://localhost:8080/auth/` |
|
||||
|
||||
|
||||
The following parameters are _required_ only when `keycloak_ha_enabled` is true:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_modcluster_enabled`| Enable configuration for modcluster subsystem | `True` if `keycloak_ha_enabled` is True, else `False` |
|
||||
|`keycloak_modcluster_url` | _deprecated_ Host for the modcluster reverse proxy | `localhost` |
|
||||
|`keycloak_modcluster_port` | _deprecated_ Port for the modcluster reverse proxy | `6666` |
|
||||
|`keycloak_modcluster_urls` | List of {host,port} dicts for the modcluster reverse proxies | `[ { localhost:6666 } ]` |
|
||||
|`keycloak_jdbc_engine` | backend database engine when db is enabled: [ postgres, mariadb, sqlserver ] | `postgres` |
|
||||
|`keycloak_infinispan_url` | URL for the infinispan remote-cache server | `localhost:11122` |
|
||||
|`keycloak_infinispan_user` | username for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_infinispan_pass` | password for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_infinispan_sasl_mechanism`| Authentication type | `SCRAM-SHA-512` |
|
||||
|`keycloak_infinispan_use_ssl`| Enable hotrod TLS communication | `False` |
|
||||
|`keycloak_infinispan_trust_store_path`| Path to truststore with infinispan server certificate | `/etc/pki/java/cacerts` |
|
||||
|`keycloak_infinispan_trust_store_password`| Password for opening truststore | `changeit` |
|
||||
|
||||
|
||||
The following parameters are _required_ only when `keycloak_db_enabled` is true:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_jdbc_url` | URL for the postgres backend database | `jdbc:postgresql://localhost:5432/keycloak` |
|
||||
|`keycloak_jdbc_driver_version`| Version for the JDBC driver to download | `9.4.1212` |
|
||||
|`keycloak_db_user` | username for connecting to postgres | `keycloak-user` |
|
||||
|`keycloak_db_pass` | password for connecting to postgres | `keycloak-pass` |
|
||||
|
||||
|
||||
The following variables are _optional_:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_db_valid_conn_sql` | Override the default database connection validation query sql |
|
||||
|`keycloak_admin_url` | Override the default administration endpoint URL |
|
||||
|`keycloak_jgroups_subnet`| Override the subnet match for jgroups cluster formation; if not defined, it will be inferred from local machine route configuration |
|
||||
|
||||
Example Playbook
|
||||
-----------------
|
||||
|
||||
* The following is an example playbook that makes use of the role to install keycloak from remote:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
```
|
||||
|
||||
|
||||
* The following example playbook makes use of the role to install keycloak from the controller node:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
collections:
|
||||
- middleware_automation.keycloak
|
||||
tasks:
|
||||
- name: Include keycloak role
|
||||
include_role:
|
||||
name: keycloak
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_offline_install: true
|
||||
# This should be the filename of keycloak archive on Ansible node: keycloak-16.1.0.zip
|
||||
```
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
* [Romain Pelisse](https://github.com/rpelisse)
|
||||
* [Pavan Kumar Motaparthi](https://github.com/motaparthipavankumar)
|
||||
147
2.1.0/_sources/roles/keycloak_quarkus.md.txt
Normal file
147
2.1.0/_sources/roles/keycloak_quarkus.md.txt
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
keycloak_quarkus
|
||||
================
|
||||
|
||||
Install [keycloak](https://keycloak.org/) >= 20.0.0 (quarkus) server configurations.
|
||||
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
* Installation options
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_version`| keycloak.org package version | `23.0.7` |
|
||||
|
||||
|
||||
* Service configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_ha_enabled`| Enable auto configuration for database backend, clustering and remote caches on infinispan | `False` |
|
||||
|`keycloak_quarkus_ha_discovery`| Discovery protocol for HA cluster members | `TCPPING` |
|
||||
|`keycloak_quarkus_db_enabled`| Enable auto configuration for database backend | `True` if `keycloak_quarkus_ha_enabled` is True, else `False` |
|
||||
|`keycloak_quarkus_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_quarkus_bind_address`| Address for binding service ports | `0.0.0.0` |
|
||||
|`keycloak_quarkus_host`| Hostname for the Keycloak server | `localhost` |
|
||||
|`keycloak_quarkus_port`| The port used by the proxy when exposing the hostname | `-1` |
|
||||
|`keycloak_quarkus_path`| This should be set if proxy uses a different context-path for Keycloak | |
|
||||
|`keycloak_quarkus_http_port`| HTTP listening port | `8080` |
|
||||
|`keycloak_quarkus_https_port`| TLS HTTP listening port | `8443` |
|
||||
|`keycloak_quarkus_ajp_port`| AJP port | `8009` |
|
||||
|`keycloak_quarkus_jgroups_port`| jgroups cluster tcp port | `7800` |
|
||||
|`keycloak_quarkus_service_user`| Posix account username | `keycloak` |
|
||||
|`keycloak_quarkus_service_group`| Posix account group | `keycloak` |
|
||||
|`keycloak_quarkus_service_restart_always`| systemd restart always behavior activation | `False` |
|
||||
|`keycloak_quarkus_service_restart_on_failure`| systemd restart on-failure behavior activation | `False` |
|
||||
|`keycloak_quarkus_service_restartsec`| systemd RestartSec | `10s` |
|
||||
|`keycloak_quarkus_service_pidfile`| Pid file path for service | `/run/keycloak.pid` |
|
||||
|`keycloak_quarkus_jvm_package`| RHEL java package runtime | `java-17-openjdk-headless` |
|
||||
|`keycloak_quarkus_java_home`| JAVA_HOME of installed JRE, leave empty for using specified keycloak_quarkus_jvm_package RPM path | `None` |
|
||||
|`keycloak_quarkus_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` |
|
||||
|`keycloak_quarkus_frontend_url`| Set the base URL for frontend URLs, including scheme, host, port and path | |
|
||||
|`keycloak_quarkus_admin_url`| Set the base URL for accessing the administration console, including scheme, host, port and path | |
|
||||
|`keycloak_quarkus_http_relative_path` | Set the path relative to / for serving resources. The path must start with a / | `/` |
|
||||
|`keycloak_quarkus_http_enabled`| Enable listener on HTTP port | `True` |
|
||||
|`keycloak_quarkus_https_key_file_enabled`| Enable listener on HTTPS port | `False` |
|
||||
|`keycloak_quarkus_key_file`| The file path to a private key in PEM format | `{{ keycloak.home }}/conf/server.key.pem` |
|
||||
|`keycloak_quarkus_cert_file`| The file path to a server certificate or certificate chain in PEM format | `{{ keycloak.home }}/conf/server.crt.pem` |
|
||||
|`keycloak_quarkus_https_key_store_enabled`| Enable configuration of HTTPS via a key store | `False` |
|
||||
|`keycloak_quarkus_key_store_file`| The file pat to the key store | `{{ keycloak.home }}/conf/key_store.p12` |
|
||||
|`keycloak_quarkus_key_store_password`| Password for the key store | `""` |
|
||||
|`keycloak_quarkus_https_trust_store_enabled`| Enalbe confiugration of a trust store | `False` |
|
||||
|`keycloak_quarkus_trust_store_file`| The file pat to the trust store | `{{ keycloak.home }}/conf/trust_store.p12` |
|
||||
|`keycloak_quarkus_trust_store_password`| Password for the trust store | `""` |
|
||||
|
||||
|
||||
* Hostname configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_http_relative_path`| Set the path relative to / for serving resources. The path must start with a / | `/` |
|
||||
|`keycloak_quarkus_hostname_strict`| Disables dynamically resolving the hostname from request headers | `true` |
|
||||
|`keycloak_quarkus_hostname_strict_backchannel`| By default backchannel URLs are dynamically resolved from request headers to allow internal and external applications. If all applications use the public URL this option should be enabled. | `false` |
|
||||
|
||||
|
||||
* Database configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_jdbc_engine` | Database engine [mariadb,postres,mssql] | `postgres` |
|
||||
|`keycloak_quarkus_db_user` | User for database connection | `keycloak-user` |
|
||||
|`keycloak_quarkus_db_pass` | Password for database connection | `keycloak-pass` |
|
||||
|`keycloak_quarkus_jdbc_url` | JDBC URL for connecting to database | `jdbc:postgresql://localhost:5432/keycloak` |
|
||||
|`keycloak_quarkus_jdbc_driver_version` | Version for JDBC driver | `9.4.1212` |
|
||||
|
||||
|
||||
* Remote caches configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_ispn_user` | Username for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_quarkus_ispn_pass` | Password for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_quarkus_ispn_hosts` | host name/port for connecting to infinispan, eg. host1:11222;host2:11222 | `localhost:11222` |
|
||||
|`keycloak_quarkus_ispn_sasl_mechanism` | Infinispan auth mechanism | `SCRAM-SHA-512` |
|
||||
|`keycloak_quarkus_ispn_use_ssl` | Whether infinispan uses TLS connection | `false` |
|
||||
|`keycloak_quarkus_ispn_trust_store_path` | Path to infinispan server trust certificate | `/etc/pki/java/cacerts` |
|
||||
|`keycloak_quarkus_ispn_trust_store_password` | Password for infinispan certificate keystore | `changeit` |
|
||||
|
||||
|
||||
* Install options
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_quarkus_offline_install` | Perform an offline install | `False`|
|
||||
|`keycloak_quarkus_version`| keycloak.org package version | `23.0.7` |
|
||||
|`keycloak_quarkus_dest`| Installation root path | `/opt/keycloak` |
|
||||
|`keycloak_quarkus_download_url` | Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/{{ keycloak_quarkus_version }}/{{ keycloak_quarkus_archive }}` |
|
||||
|`keycloak_quarkus_configure_firewalld` | Ensure firewalld is running and configure keycloak ports | `False` |
|
||||
|
||||
|
||||
* Miscellaneous configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_metrics_enabled`| Whether to enable metrics | `False` |
|
||||
|`keycloak_quarkus_health_enabled`| If the server should expose health check endpoints | `True` |
|
||||
|`keycloak_quarkus_archive` | keycloak install archive filename | `keycloak-{{ keycloak_quarkus_version }}.zip` |
|
||||
|`keycloak_quarkus_installdir` | Installation path | `{{ keycloak_quarkus_dest }}/keycloak-{{ keycloak_quarkus_version }}` |
|
||||
|`keycloak_quarkus_home` | Installation work directory | `{{ keycloak_quarkus_installdir }}` |
|
||||
|`keycloak_quarkus_config_dir` | Path for configuration | `{{ keycloak_quarkus_home }}/conf` |
|
||||
|`keycloak_quarkus_master_realm` | Name for rest authentication realm | `master` |
|
||||
|`keycloak_auth_client` | Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_force_install` | Remove pre-existing versions of service | `False` |
|
||||
|`keycloak_url` | URL for configuration rest calls | `http://{{ keycloak_quarkus_host }}:{{ keycloak_http_port }}` |
|
||||
|`keycloak_quarkus_log`| Enable one or more log handlers in a comma-separated list | `file` |
|
||||
|`keycloak_quarkus_log_level`| The log level of the root category or a comma-separated list of individual categories and their levels | `info` |
|
||||
|`keycloak_quarkus_log_file`| Set the log file path and filename relative to keycloak home | `data/log/keycloak.log` |
|
||||
|`keycloak_quarkus_log_format`| Set a format specific to file log entries | `%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n` |
|
||||
|`keycloak_quarkus_log_target`| Set the destination of the keycloak log folder link | `/var/log/keycloak` |
|
||||
|`keycloak_quarkus_log_max_file_size`| Set the maximum log file size before a log rotation happens; A size configuration option recognises string in this format (shown as a regular expression): `[0-9]+[KkMmGgTtPpEeZzYy]?`. If no suffix is given, assume bytes. | `10M` |
|
||||
|`keycloak_quarkus_log_max_backup_index`| Set the maximum number of archived log files to keep" | `10` |
|
||||
|`keycloak_quarkus_log_file_suffix`| Set the log file handler rotation file suffix. When used, the file will be rotated based on its suffix; Note: If the suffix ends with `.zip` or `.gz`, the rotation file will also be compressed. | `.yyyy-MM-dd.zip` |
|
||||
|`keycloak_quarkus_proxy_mode`| The proxy address forwarding mode if the server is behind a reverse proxy | `edge` |
|
||||
|`keycloak_quarkus_start_dev`| Whether to start the service in development mode (start-dev) | `False` |
|
||||
|`keycloak_quarkus_transaction_xa_enabled`| Whether to use XA transactions | `True` |
|
||||
|`keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route`| If the route should be attached to cookies to reflect the node that owns a particular session. If false, route is not attached to cookies and we rely on the session affinity capabilities from reverse proxy | `True` |
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
| Variable | Description | Required |
|
||||
|:---------|:------------|----------|
|
||||
|`keycloak_quarkus_admin_pass`| Password of console admin account | `yes` |
|
||||
|`keycloak_quarkus_frontend_url`| Base URL for frontend URLs, including scheme, host, port and path | `no` |
|
||||
|`keycloak_quarkus_admin_url`| Base URL for accessing the administration console, including scheme, host, port and path | `no` |
|
||||
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
139
2.1.0/_sources/roles/keycloak_realm.md.txt
Normal file
139
2.1.0/_sources/roles/keycloak_realm.md.txt
Normal file
|
|
@ -0,0 +1,139 @@
|
|||
keycloak_realm
|
||||
==============
|
||||
|
||||
Create realms and clients in [keycloak](https://keycloak.org/) or [Red Hat Single Sign-On](https://access.redhat.com/products/red-hat-single-sign-on) services.
|
||||
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_host`| hostname | `localhost` |
|
||||
|`keycloak_context`| Context path for rest calls | `/auth` |
|
||||
|`keycloak_http_port`| HTTP port | `8080` |
|
||||
|`keycloak_https_port`| TLS HTTP port | `8443` |
|
||||
|`keycloak_auth_realm`| Name of the main authentication realm | `master` |
|
||||
|`keycloak_management_http_port`| Management port | `9990` |
|
||||
|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_client_public`| Configure a public realm client | `True` |
|
||||
|`keycloak_client_web_origins`| Web origins for realm client | `+` |
|
||||
|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` |
|
||||
|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` |
|
||||
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
The following are a set of _required_ variables for the role:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_realm` | Name of the realm to be created |
|
||||
|`keycloak_admin_password`| Password for the administration console user account |
|
||||
|
||||
|
||||
The following variables are available for creating clients:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_clients` | List of _client_ declarations for the realm | `[]` |
|
||||
|`keycloak_client_default_roles` | List of default role name for clients | `[]` |
|
||||
|`keycloak_client_users` | List of user/role mappings for a client | `[]` |
|
||||
|
||||
|
||||
The following variable are available for creating user federation:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
|
||||
|
||||
|
||||
Variable formats
|
||||
----------------
|
||||
|
||||
* `keycloak_user_federation`, a list of:
|
||||
|
||||
```yaml
|
||||
- realm: <name of the realm in which user federation should be configured, required>
|
||||
name: <name of the user federation provider, required>
|
||||
provider_id: <type of the user federation provider, required>
|
||||
provider_type: <Provider Type, default is set to org.keycloak.storage.UserStorageProvider>
|
||||
config: <dictionary of supported configuration values, required>
|
||||
mappers: <list of supported configuration values, required>
|
||||
```
|
||||
|
||||
Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables.
|
||||
|
||||
|
||||
* `keycloak_clients`, a list of:
|
||||
|
||||
```yaml
|
||||
- name: <name of the client>
|
||||
id: <id of the client>
|
||||
client_id: <id of the client>
|
||||
roles: <keycloak_client_default_roles>
|
||||
realm: <name of the realm that contains the client>
|
||||
public_client: <true for public, false for confidential>
|
||||
web_origins: <list of allowed we origins for the client>
|
||||
users: <keycloak_client_users>
|
||||
```
|
||||
|
||||
`name` and either `id` or `client_id` are required.
|
||||
|
||||
|
||||
* `keycloak_client_users`, a list of:
|
||||
|
||||
```yaml
|
||||
- username: <username, required>
|
||||
password: <password, required>
|
||||
firstName: <firstName, optional>
|
||||
lastName: <lastName, optional>
|
||||
email: <email, optional>
|
||||
client_roles: <list of client user/role mappings>
|
||||
```
|
||||
|
||||
* Client user/role mappings, a list of:
|
||||
|
||||
```yaml
|
||||
- client: <name of the client>
|
||||
role: <name of the role>
|
||||
realm: <name of the realm>
|
||||
```
|
||||
|
||||
For a comprehensive example, refer to the [playbook](../../playbooks/keycloak_realm.yml).
|
||||
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
The following is an example playbook that makes use of the role to create a realm in keycloak.
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
collections:
|
||||
- middleware_automation.keycloak
|
||||
tasks:
|
||||
- name: Include keycloak role
|
||||
include_role:
|
||||
name: keycloak_realm
|
||||
vars:
|
||||
keycloak_admin_password: "changeme"
|
||||
keycloak_realm: TestRealm
|
||||
keycloak_clients: [...]
|
||||
```
|
||||
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
* [Romain Pelisse](https://github.com/rpelisse)
|
||||
48
2.1.0/_sources/testing.md.txt
Normal file
48
2.1.0/_sources/testing.md.txt
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# Testing
|
||||
|
||||
## Continuous integration
|
||||
|
||||
The collection is tested with a [molecule](https://github.com/ansible-community/molecule) setup covering the included roles and verifying correct installation and idempotency.
|
||||
In order to run the molecule tests locally with python 3.9 available, after cloning the repository:
|
||||
|
||||
```
|
||||
pip install yamllint 'molecule[docker]~=3.5.2' ansible-core flake8 ansible-lint voluptuous
|
||||
molecule test --all
|
||||
```
|
||||
|
||||
|
||||
## Integration testing
|
||||
|
||||
Demo repositories which depend on the collection, and aggregate functionality with other middleware_automation collections, are automatically rebuilt
|
||||
at every collection release to ensure non-breaking changes and consistent behaviour.
|
||||
|
||||
The repository are:
|
||||
|
||||
- [Flange demo](https://github.com/ansible-middleware/flange-demo)
|
||||
A deployment of Wildfly cluster integrated with keycloak and infinispan.
|
||||
- [CrossDC keycloak demo](https://github.com/ansible-middleware/cross-dc-rhsso-demo)
|
||||
A clustered multi-regional installation of keycloak with infinispan remote caches.
|
||||
|
||||
|
||||
## Test playbooks
|
||||
|
||||
Sample playbooks are provided in the `playbooks/` directory; to run the playbooks locally (requires a rhel system with python 3.9+, ansible, and systemd) the steps are as follows:
|
||||
|
||||
```
|
||||
# setup environment
|
||||
pip install ansible-core
|
||||
# clone the repository
|
||||
git clone https://github.com/ansible-middleware/keycloak
|
||||
cd keycloak
|
||||
# install collection dependencies
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
# install collection python deps
|
||||
pip install -r requirements.txt
|
||||
# create inventory for localhost
|
||||
cat << EOF > inventory
|
||||
[keycloak]
|
||||
localhost ansible_connection=local
|
||||
EOF
|
||||
# run the playbook
|
||||
ansible-playbook -i inventory playbooks/keycloak.yml
|
||||
```
|
||||
Loading…
Add table
Add a link
Reference in a new issue