mirror of
https://github.com/ansible-middleware/keycloak.git
synced 2025-04-05 02:10:29 -07:00
Merge pull request #240 from guidograzioli/update_modules
update keycloak modules
This commit is contained in:
Guido Grazioli
GitHub
commit
c57753f608
18 changed files with 2549 additions and 387 deletions
14
.github/workflows/traffic.yml
vendored
14
.github/workflows/traffic.yml
vendored
|
|
@ -1,9 +1,9 @@
|
|||
name: Collect traffic stats
|
||||
on:
|
||||
schedule:
|
||||
schedule:
|
||||
- cron: "51 23 * * 0"
|
||||
workflow_dispatch:
|
||||
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
traffic:
|
||||
runs-on: ubuntu-latest
|
||||
|
|
@ -11,12 +11,12 @@ jobs:
|
|||
- uses: actions/checkout@v2
|
||||
with:
|
||||
ref: "gh-pages"
|
||||
|
||||
- name: GitHub traffic
|
||||
|
||||
- name: GitHub traffic
|
||||
uses: sangonzal/repository-traffic-action@v.0.1.6
|
||||
env:
|
||||
TRAFFIC_ACTION_TOKEN: ${{ secrets.TRIGGERING_PAT }}
|
||||
|
||||
TRAFFIC_ACTION_TOKEN: ${{ secrets.TRIGGERING_PAT }}
|
||||
|
||||
- name: Commit changes
|
||||
uses: EndBug/add-and-commit@v4
|
||||
with:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
=============================================
|
||||
middleware\_automation.keycloak Release Notes
|
||||
=============================================
|
||||
=============
|
||||
Release Notes
|
||||
=============
|
||||
|
||||
.. contents:: Topics
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,37 @@
|
|||
## Developing
|
||||
|
||||
### Build and install locally
|
||||
|
||||
Clone the repository, checkout the tag you want to build, or pick the main branch for the development version; then:
|
||||
|
||||
ansible-galaxy collection build .
|
||||
ansible-galaxy collection install middleware_automation-keycloak-*.tar.gz
|
||||
|
||||
|
||||
### Development environment
|
||||
|
||||
Make sure your development machine has avilable:
|
||||
|
||||
* python 3.11+
|
||||
* virtualenv
|
||||
* docker (or podman)
|
||||
|
||||
In order to run setup the development environment and run the molecule tests locally, after cloning the repository:
|
||||
|
||||
```
|
||||
# create new virtualenv using python 3
|
||||
virtualenv $PATH_TO_DEV_VIRTUALENV
|
||||
# activate the virtual env
|
||||
source $PATH_TO_DEV_VIRTUALENV/bin/activate
|
||||
# install ansible and tools onto the virtualenv
|
||||
pip install yamllint 'molecule>=6.0' 'molecule-plugins[docker]' 'ansible-core>=2.15' ansible-lint
|
||||
# install collection dependencies
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
# install python dependencies
|
||||
pip install -r requirements.txt molecule/requirements.txt
|
||||
# execute the tests (replace --all with -s subdirectory to run a single test)
|
||||
molecule test --all
|
||||
```
|
||||
|
||||
## Contributor's Guidelines
|
||||
|
||||
|
|
|
|||
16
README.md
16
README.md
|
|
@ -3,7 +3,7 @@
|
|||
<!--start build_status -->
|
||||
[](https://github.com/ansible-middleware/keycloak/actions/workflows/ci.yml)
|
||||
|
||||
> **_NOTE:_ If you are Red Hat customer, install `redhat.sso` (for Red Hat Single Sign-On) or `redhat.rhbk` (for Red Hat Build of Keycloak) from [Automation Hub](https://console.redhat.com/ansible/ansible-dashboard) as the certified version of this collection.**
|
||||
> **_NOTE:_ If you are Red Hat customer, install `redhat.rhbk` (for Red Hat Build of Keycloak) or `redhat.sso` (for Red Hat Single Sign-On) from [Automation Hub](https://console.redhat.com/ansible/ansible-dashboard) as the certified version of this collection.**
|
||||
|
||||
<!--end build_status -->
|
||||
<!--start description -->
|
||||
|
|
@ -49,9 +49,10 @@ A requirement file is provided to install:
|
|||
<!--start roles_paths -->
|
||||
### Included roles
|
||||
|
||||
* [`keycloak`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak/README.md): role for installing the service (keycloak <= 19.0).
|
||||
* [`keycloak_realm`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_realm/README.md): role for configuring a realm, user federation(s), clients and users, in an installed service.
|
||||
* [`keycloak_quarkus`](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_quarkus/README.md): role for installing the quarkus variant of keycloak (>= 17.0.0).
|
||||
* `keycloak_quarkus`: role for installing keycloak (>= 19.0.0, quarkus based).
|
||||
* `keycloak_realm`: role for configuring a realm, user federation(s), clients and users, in an installed service.
|
||||
* `keycloak`: role for installing legacy keycloak (<= 19.0, wildfly based).
|
||||
|
||||
<!--end roles_paths -->
|
||||
|
||||
## Usage
|
||||
|
|
@ -59,9 +60,9 @@ A requirement file is provided to install:
|
|||
|
||||
### Install Playbook
|
||||
<!--start rhbk_playbook -->
|
||||
* [`playbooks/keycloak.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak.yml) installs keycloak legacy based on the defined variables (using most defaults).
|
||||
* [`playbooks/keycloak_quarkus.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak_quarkus.yml) installs keycloak >= 17 based on the defined variables (using most defaults).
|
||||
|
||||
* [`playbooks/keycloak.yml`](https://github.com/ansible-middleware/keycloak/blob/main/playbooks/keycloak.yml) installs keycloak legacy based on the defined variables (using most defaults).
|
||||
|
||||
Both playbooks include the `keycloak` role, with different settings, as described in the following sections.
|
||||
|
||||
For full service configuration details, refer to the [keycloak role README](https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak/README.md).
|
||||
|
|
@ -92,7 +93,7 @@ Execute the following command from the source root directory
|
|||
|
||||
```
|
||||
ansible-playbook -i <ansible_hosts> -e @rhn-creds.yml playbooks/keycloak.yml -e keycloak_admin_password=<changeme>
|
||||
```
|
||||
```
|
||||
|
||||
- `keycloak_admin_password` Password for the administration console user account.
|
||||
- `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost
|
||||
|
|
@ -143,4 +144,3 @@ Apache License v2.0 or later
|
|||
<!--start license -->
|
||||
See [LICENSE](LICENSE) to view the full text.
|
||||
<!--end license -->
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
</div>
|
||||
<hr/>
|
||||
<div role="contentinfo">
|
||||
<p>© Copyright 2022, Red Hat, Inc.</p>
|
||||
<p>© Copyright 2024, Red Hat, Inc.</p>
|
||||
</div>
|
||||
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
|
||||
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
|
||||
|
|
@ -18,4 +18,4 @@
|
|||
</section>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -10,31 +10,25 @@ Welcome to Keycloak Collection documentation
|
|||
README
|
||||
plugins/index
|
||||
roles/index
|
||||
Changelog <CHANGELOG>
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: Developer documentation
|
||||
|
||||
testing
|
||||
developing
|
||||
releasing
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: General
|
||||
|
||||
Changelog <CHANGELOG>
|
||||
Developing <developing>
|
||||
Testing <testing>
|
||||
Releasing <releasing>
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:caption: Middleware collections
|
||||
|
||||
Infinispan / Red Hat Data Grid <https://ansible-middleware.github.io/infinispan/main/>
|
||||
Keycloak / Red Hat Single Sign-On <https://ansible-middleware.github.io/keycloak/main/>
|
||||
Infinispan / Red Hat Data Grid <https://ansible-middleware.github.io/infinispan/main/>
|
||||
Wildfly / Red Hat JBoss EAP <https://ansible-middleware.github.io/wildfly/main/>
|
||||
Tomcat / Red Hat JWS <https://ansible-middleware.github.io/jws/main/>
|
||||
ActiveMQ / Red Hat AMQ Broker <https://ansible-middleware.github.io/amq/main/>
|
||||
Kafka / Red Hat AMQ Streams <https://ansible-middleware.github.io/amq_streams/main/>
|
||||
Ansible Middleware utilities <https://ansible-middleware.github.io/common/main/>
|
||||
Red Hat CSP Download <https://ansible-middleware.github.io/redhat-csp-download/main/>
|
||||
JCliff <https://ansible-middleware.github.io/ansible_collections_jcliff/main/>
|
||||
|
|
|
|||
|
|
@ -4,24 +4,7 @@
|
|||
|
||||
The collection is tested with a [molecule](https://github.com/ansible-community/molecule) setup covering the included roles and verifying correct installation and idempotency.
|
||||
In order to run the molecule tests locally with python 3.9 available, after cloning the repository:
|
||||
|
||||
```
|
||||
pip install yamllint 'molecule[docker]~=3.5.2' ansible-core flake8 ansible-lint voluptuous
|
||||
molecule test --all
|
||||
```
|
||||
|
||||
|
||||
## Integration testing
|
||||
|
||||
Demo repositories which depend on the collection, and aggregate functionality with other middleware_automation collections, are automatically rebuilt
|
||||
at every collection release to ensure non-breaking changes and consistent behaviour.
|
||||
|
||||
The repository are:
|
||||
|
||||
- [Flange demo](https://github.com/ansible-middleware/flange-demo)
|
||||
A deployment of Wildfly cluster integrated with keycloak and infinispan.
|
||||
- [CrossDC keycloak demo](https://github.com/ansible-middleware/cross-dc-rhsso-demo)
|
||||
A clustered multi-regional installation of keycloak with infinispan remote caches.
|
||||
The test scenarios are available on the source code repository each on his own subdirectory under [molecule/](https://github.com/ansible-middleware/keycloak/molecule).
|
||||
|
||||
|
||||
## Test playbooks
|
||||
|
|
@ -29,15 +12,7 @@ The repository are:
|
|||
Sample playbooks are provided in the `playbooks/` directory; to run the playbooks locally (requires a rhel system with python 3.9+, ansible, and systemd) the steps are as follows:
|
||||
|
||||
```
|
||||
# setup environment
|
||||
pip install ansible-core
|
||||
# clone the repository
|
||||
git clone https://github.com/ansible-middleware/keycloak
|
||||
cd keycloak
|
||||
# install collection dependencies
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
# install collection python deps
|
||||
pip install -r requirements.txt
|
||||
# setup environment as in developing
|
||||
# create inventory for localhost
|
||||
cat << EOF > inventory
|
||||
[keycloak]
|
||||
|
|
|
|||
|
|
@ -4,39 +4,38 @@
|
|||
vars:
|
||||
keycloak_quarkus_show_deprecation_warnings: false
|
||||
keycloak_quarkus_admin_pass: "remembertochangeme"
|
||||
keycloak_realm: TestRealm
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_quarkus_host: instance
|
||||
keycloak_quarkus_log: file
|
||||
keycloak_quarkus_frontend_url: 'http://localhost:8080/'
|
||||
keycloak_quarkus_start_dev: True
|
||||
keycloak_quarkus_start_dev: true
|
||||
keycloak_quarkus_proxy_mode: none
|
||||
keycloak_client_default_roles:
|
||||
- TestRoleAdmin
|
||||
- TestRoleUser
|
||||
keycloak_client_users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient
|
||||
role: TestRoleUser
|
||||
- username: TestAdmin
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient
|
||||
role: TestRoleUser
|
||||
- client: TestClient
|
||||
role: TestRoleAdmin
|
||||
keycloak_clients:
|
||||
- name: TestClient
|
||||
roles: "{{ keycloak_client_default_roles }}"
|
||||
public_client: "{{ keycloak_client_public }}"
|
||||
web_origins: "{{ keycloak_client_web_origins }}"
|
||||
users: "{{ keycloak_client_users }}"
|
||||
client_id: TestClient
|
||||
attributes:
|
||||
post.logout.redirect.uris: '/public/logout'
|
||||
roles:
|
||||
- role: keycloak_quarkus
|
||||
- role: keycloak_realm
|
||||
keycloak_realm: TestRealm
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_context: ''
|
||||
keycloak_client_users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient
|
||||
role: TestRoleUser
|
||||
realm: "{{ keycloak_realm }}"
|
||||
- username: TestAdmin
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient
|
||||
role: TestRoleUser
|
||||
realm: "{{ keycloak_realm }}"
|
||||
- client: TestClient
|
||||
role: TestRoleAdmin
|
||||
realm: "{{ keycloak_realm }}"
|
||||
keycloak_realm: TestRealm
|
||||
keycloak_clients:
|
||||
- name: TestClient
|
||||
realm: "{{ keycloak_realm }}"
|
||||
public_client: "{{ keycloak_client_public }}"
|
||||
web_origins: "{{ keycloak_client_web_origins }}"
|
||||
users: "{{ keycloak_client_users }}"
|
||||
client_id: TestClient
|
||||
attributes:
|
||||
post.logout.redirect.uris: '/public/logout'
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
keycloak_quarkus_log: file
|
||||
keycloak_quarkus_log_level: debug
|
||||
keycloak_quarkus_log_target: /tmp/keycloak
|
||||
keycloak_quarkus_start_dev: True
|
||||
keycloak_quarkus_start_dev: true
|
||||
keycloak_quarkus_proxy_mode: none
|
||||
keycloak_quarkus_offline_install: true
|
||||
keycloak_quarkus_download_path: /tmp/keycloak/
|
||||
|
|
@ -17,9 +17,6 @@
|
|||
- role: keycloak_quarkus
|
||||
- role: keycloak_realm
|
||||
keycloak_context: ''
|
||||
keycloak_client_default_roles:
|
||||
- TestRoleAdmin
|
||||
- TestRoleUser
|
||||
keycloak_client_users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
|
|
@ -39,7 +36,6 @@
|
|||
keycloak_realm: TestRealm
|
||||
keycloak_clients:
|
||||
- name: TestClient
|
||||
roles: "{{ keycloak_client_default_roles }}"
|
||||
realm: "{{ keycloak_realm }}"
|
||||
public_client: "{{ keycloak_client_public }}"
|
||||
web_origins: "{{ keycloak_client_web_origins }}"
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -40,8 +40,8 @@ options:
|
|||
state:
|
||||
description:
|
||||
- State of the client
|
||||
- On C(present), the client will be created (or updated if it exists already).
|
||||
- On C(absent), the client will be removed if it exists
|
||||
- On V(present), the client will be created (or updated if it exists already).
|
||||
- On V(absent), the client will be removed if it exists
|
||||
choices: ['present', 'absent']
|
||||
default: 'present'
|
||||
type: str
|
||||
|
|
@ -55,7 +55,7 @@ options:
|
|||
client_id:
|
||||
description:
|
||||
- Client id of client to be worked on. This is usually an alphanumeric name chosen by
|
||||
you. Either this or I(id) is required. If you specify both, I(id) takes precedence.
|
||||
you. Either this or O(id) is required. If you specify both, O(id) takes precedence.
|
||||
This is 'clientId' in the Keycloak REST API.
|
||||
aliases:
|
||||
- clientId
|
||||
|
|
@ -63,13 +63,13 @@ options:
|
|||
|
||||
id:
|
||||
description:
|
||||
- Id of client to be worked on. This is usually an UUID. Either this or I(client_id)
|
||||
- Id of client to be worked on. This is usually an UUID. Either this or O(client_id)
|
||||
is required. If you specify both, this takes precedence.
|
||||
type: str
|
||||
|
||||
name:
|
||||
description:
|
||||
- Name of the client (this is not the same as I(client_id)).
|
||||
- Name of the client (this is not the same as O(client_id)).
|
||||
type: str
|
||||
|
||||
description:
|
||||
|
|
@ -108,20 +108,21 @@ options:
|
|||
|
||||
client_authenticator_type:
|
||||
description:
|
||||
- How do clients authenticate with the auth server? Either C(client-secret) or
|
||||
C(client-jwt) can be chosen. When using C(client-secret), the module parameter
|
||||
I(secret) can set it, while for C(client-jwt), you can use the keys C(use.jwks.url),
|
||||
C(jwks.url), and C(jwt.credential.certificate) in the I(attributes) module parameter
|
||||
to configure its behavior.
|
||||
This is 'clientAuthenticatorType' in the Keycloak REST API.
|
||||
choices: ['client-secret', 'client-jwt']
|
||||
- How do clients authenticate with the auth server? Either V(client-secret),
|
||||
V(client-jwt), or V(client-x509) can be chosen. When using V(client-secret), the module parameter
|
||||
O(secret) can set it, for V(client-jwt), you can use the keys C(use.jwks.url),
|
||||
C(jwks.url), and C(jwt.credential.certificate) in the O(attributes) module parameter
|
||||
to configure its behavior. For V(client-x509) you can use the keys C(x509.allow.regex.pattern.comparison)
|
||||
and C(x509.subjectdn) in the O(attributes) module parameter to configure which certificate(s) to accept.
|
||||
- This is 'clientAuthenticatorType' in the Keycloak REST API.
|
||||
choices: ['client-secret', 'client-jwt', 'client-x509']
|
||||
aliases:
|
||||
- clientAuthenticatorType
|
||||
type: str
|
||||
|
||||
secret:
|
||||
description:
|
||||
- When using I(client_authenticator_type) C(client-secret) (the default), you can
|
||||
- When using O(client_authenticator_type=client-secret) (the default), you can
|
||||
specify a secret here (otherwise one will be generated if it does not exit). If
|
||||
changing this secret, the module will not register a change currently (but the
|
||||
changed secret will be saved).
|
||||
|
|
@ -246,9 +247,11 @@ options:
|
|||
|
||||
protocol:
|
||||
description:
|
||||
- Type of client (either C(openid-connect) or C(saml).
|
||||
- Type of client.
|
||||
- At creation only, default value will be V(openid-connect) if O(protocol) is omitted.
|
||||
- The V(docker-v2) value was added in community.general 8.6.0.
|
||||
type: str
|
||||
choices: ['openid-connect', 'saml']
|
||||
choices: ['openid-connect', 'saml', 'docker-v2']
|
||||
|
||||
full_scope_allowed:
|
||||
description:
|
||||
|
|
@ -286,7 +289,7 @@ options:
|
|||
|
||||
use_template_config:
|
||||
description:
|
||||
- Whether or not to use configuration from the I(client_template).
|
||||
- Whether or not to use configuration from the O(client_template).
|
||||
This is 'useTemplateConfig' in the Keycloak REST API.
|
||||
aliases:
|
||||
- useTemplateConfig
|
||||
|
|
@ -294,7 +297,7 @@ options:
|
|||
|
||||
use_template_scope:
|
||||
description:
|
||||
- Whether or not to use scope configuration from the I(client_template).
|
||||
- Whether or not to use scope configuration from the O(client_template).
|
||||
This is 'useTemplateScope' in the Keycloak REST API.
|
||||
aliases:
|
||||
- useTemplateScope
|
||||
|
|
@ -302,7 +305,7 @@ options:
|
|||
|
||||
use_template_mappers:
|
||||
description:
|
||||
- Whether or not to use mapper configuration from the I(client_template).
|
||||
- Whether or not to use mapper configuration from the O(client_template).
|
||||
This is 'useTemplateMappers' in the Keycloak REST API.
|
||||
aliases:
|
||||
- useTemplateMappers
|
||||
|
|
@ -338,6 +341,42 @@ options:
|
|||
description:
|
||||
- Override realm authentication flow bindings.
|
||||
type: dict
|
||||
suboptions:
|
||||
browser:
|
||||
description:
|
||||
- Flow ID of the browser authentication flow.
|
||||
- O(authentication_flow_binding_overrides.browser)
|
||||
and O(authentication_flow_binding_overrides.browser_name) are mutually exclusive.
|
||||
type: str
|
||||
|
||||
browser_name:
|
||||
description:
|
||||
- Flow name of the browser authentication flow.
|
||||
- O(authentication_flow_binding_overrides.browser)
|
||||
and O(authentication_flow_binding_overrides.browser_name) are mutually exclusive.
|
||||
aliases:
|
||||
- browserName
|
||||
type: str
|
||||
version_added: 9.1.0
|
||||
|
||||
direct_grant:
|
||||
description:
|
||||
- Flow ID of the direct grant authentication flow.
|
||||
- O(authentication_flow_binding_overrides.direct_grant)
|
||||
and O(authentication_flow_binding_overrides.direct_grant_name) are mutually exclusive.
|
||||
aliases:
|
||||
- directGrant
|
||||
type: str
|
||||
|
||||
direct_grant_name:
|
||||
description:
|
||||
- Flow name of the direct grant authentication flow.
|
||||
- O(authentication_flow_binding_overrides.direct_grant)
|
||||
and O(authentication_flow_binding_overrides.direct_grant_name) are mutually exclusive.
|
||||
aliases:
|
||||
- directGrantName
|
||||
type: str
|
||||
version_added: 9.1.0
|
||||
aliases:
|
||||
- authenticationFlowBindingOverrides
|
||||
version_added: 3.4.0
|
||||
|
|
@ -391,38 +430,37 @@ options:
|
|||
|
||||
protocol:
|
||||
description:
|
||||
- This is either C(openid-connect) or C(saml), this specifies for which protocol this protocol mapper.
|
||||
is active.
|
||||
choices: ['openid-connect', 'saml']
|
||||
- This specifies for which protocol this protocol mapper is active.
|
||||
choices: ['openid-connect', 'saml', 'docker-v2']
|
||||
type: str
|
||||
|
||||
protocolMapper:
|
||||
description:
|
||||
- The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is
|
||||
- "The Keycloak-internal name of the type of this protocol-mapper. While an exhaustive list is
|
||||
impossible to provide since this may be extended through SPIs by the user of Keycloak,
|
||||
by default Keycloak as of 3.4 ships with at least
|
||||
- C(docker-v2-allow-all-mapper)
|
||||
- C(oidc-address-mapper)
|
||||
- C(oidc-full-name-mapper)
|
||||
- C(oidc-group-membership-mapper)
|
||||
- C(oidc-hardcoded-claim-mapper)
|
||||
- C(oidc-hardcoded-role-mapper)
|
||||
- C(oidc-role-name-mapper)
|
||||
- C(oidc-script-based-protocol-mapper)
|
||||
- C(oidc-sha256-pairwise-sub-mapper)
|
||||
- C(oidc-usermodel-attribute-mapper)
|
||||
- C(oidc-usermodel-client-role-mapper)
|
||||
- C(oidc-usermodel-property-mapper)
|
||||
- C(oidc-usermodel-realm-role-mapper)
|
||||
- C(oidc-usersessionmodel-note-mapper)
|
||||
- C(saml-group-membership-mapper)
|
||||
- C(saml-hardcode-attribute-mapper)
|
||||
- C(saml-hardcode-role-mapper)
|
||||
- C(saml-role-list-mapper)
|
||||
- C(saml-role-name-mapper)
|
||||
- C(saml-user-attribute-mapper)
|
||||
- C(saml-user-property-mapper)
|
||||
- C(saml-user-session-note-mapper)
|
||||
by default Keycloak as of 3.4 ships with at least:"
|
||||
- V(docker-v2-allow-all-mapper)
|
||||
- V(oidc-address-mapper)
|
||||
- V(oidc-full-name-mapper)
|
||||
- V(oidc-group-membership-mapper)
|
||||
- V(oidc-hardcoded-claim-mapper)
|
||||
- V(oidc-hardcoded-role-mapper)
|
||||
- V(oidc-role-name-mapper)
|
||||
- V(oidc-script-based-protocol-mapper)
|
||||
- V(oidc-sha256-pairwise-sub-mapper)
|
||||
- V(oidc-usermodel-attribute-mapper)
|
||||
- V(oidc-usermodel-client-role-mapper)
|
||||
- V(oidc-usermodel-property-mapper)
|
||||
- V(oidc-usermodel-realm-role-mapper)
|
||||
- V(oidc-usersessionmodel-note-mapper)
|
||||
- V(saml-group-membership-mapper)
|
||||
- V(saml-hardcode-attribute-mapper)
|
||||
- V(saml-hardcode-role-mapper)
|
||||
- V(saml-role-list-mapper)
|
||||
- V(saml-role-name-mapper)
|
||||
- V(saml-user-attribute-mapper)
|
||||
- V(saml-user-property-mapper)
|
||||
- V(saml-user-session-note-mapper)
|
||||
- An exhaustive list of available mappers on your installation can be obtained on
|
||||
the admin console by going to Server Info -> Providers and looking under
|
||||
'protocol-mapper'.
|
||||
|
|
@ -431,10 +469,10 @@ options:
|
|||
config:
|
||||
description:
|
||||
- Dict specifying the configuration options for the protocol mapper; the
|
||||
contents differ depending on the value of I(protocolMapper) and are not documented
|
||||
contents differ depending on the value of O(protocol_mappers[].protocolMapper) and are not documented
|
||||
other than by the source of the mappers and its parent class(es). An example is given
|
||||
below. It is easiest to obtain valid config values by dumping an already-existing
|
||||
protocol mapper configuration through check-mode in the I(existing) field.
|
||||
protocol mapper configuration through check-mode in the RV(existing) field.
|
||||
type: dict
|
||||
|
||||
attributes:
|
||||
|
|
@ -478,7 +516,7 @@ options:
|
|||
|
||||
saml.signature.algorithm:
|
||||
description:
|
||||
- Signature algorithm used to sign SAML documents. One of C(RSA_SHA256), C(RSA_SHA1), C(RSA_SHA512), or C(DSA_SHA1).
|
||||
- Signature algorithm used to sign SAML documents. One of V(RSA_SHA256), V(RSA_SHA1), V(RSA_SHA512), or V(DSA_SHA1).
|
||||
|
||||
saml.signing.certificate:
|
||||
description:
|
||||
|
|
@ -496,22 +534,21 @@ options:
|
|||
description:
|
||||
- SAML Redirect Binding URL for the client's assertion consumer service (login responses).
|
||||
|
||||
|
||||
saml_force_name_id_format:
|
||||
description:
|
||||
- For SAML clients, Boolean specifying whether to ignore requested NameID subject format and using the configured one instead.
|
||||
|
||||
saml_name_id_format:
|
||||
description:
|
||||
- For SAML clients, the NameID format to use (one of C(username), C(email), C(transient), or C(persistent))
|
||||
- For SAML clients, the NameID format to use (one of V(username), V(email), V(transient), or V(persistent))
|
||||
|
||||
saml_signature_canonicalization_method:
|
||||
description:
|
||||
- SAML signature canonicalization method. This is one of four values, namely
|
||||
C(http://www.w3.org/2001/10/xml-exc-c14n#) for EXCLUSIVE,
|
||||
C(http://www.w3.org/2001/10/xml-exc-c14n#WithComments) for EXCLUSIVE_WITH_COMMENTS,
|
||||
C(http://www.w3.org/TR/2001/REC-xml-c14n-20010315) for INCLUSIVE, and
|
||||
C(http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments) for INCLUSIVE_WITH_COMMENTS.
|
||||
V(http://www.w3.org/2001/10/xml-exc-c14n#) for EXCLUSIVE,
|
||||
V(http://www.w3.org/2001/10/xml-exc-c14n#WithComments) for EXCLUSIVE_WITH_COMMENTS,
|
||||
V(http://www.w3.org/TR/2001/REC-xml-c14n-20010315) for INCLUSIVE, and
|
||||
V(http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments) for INCLUSIVE_WITH_COMMENTS.
|
||||
|
||||
saml_single_logout_service_url_post:
|
||||
description:
|
||||
|
|
@ -523,12 +560,12 @@ options:
|
|||
|
||||
user.info.response.signature.alg:
|
||||
description:
|
||||
- For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of C(RS256) or C(unsigned).
|
||||
- For OpenID-Connect clients, JWA algorithm for signed UserInfo-endpoint responses. One of V(RS256) or V(unsigned).
|
||||
|
||||
request.object.signature.alg:
|
||||
description:
|
||||
- For OpenID-Connect clients, JWA algorithm which the client needs to use when sending
|
||||
OIDC request object. One of C(any), C(none), C(RS256).
|
||||
OIDC request object. One of V(any), V(none), V(RS256).
|
||||
|
||||
use.jwks.url:
|
||||
description:
|
||||
|
|
@ -544,9 +581,21 @@ options:
|
|||
- For OpenID-Connect clients, client certificate for validating JWT issued by
|
||||
client and signed by its key, base64-encoded.
|
||||
|
||||
x509.subjectdn:
|
||||
description:
|
||||
- For OpenID-Connect clients, subject which will be used to authenticate the client.
|
||||
type: str
|
||||
version_added: 9.5.0
|
||||
|
||||
x509.allow.regex.pattern.comparison:
|
||||
description:
|
||||
- For OpenID-Connect clients, boolean specifying whether to allow C(x509.subjectdn) as regular expression.
|
||||
type: bool
|
||||
version_added: 9.5.0
|
||||
|
||||
extends_documentation_fragment:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
- middleware_automation.keycloak.attributes
|
||||
- middleware_automation.keycloak.keycloak
|
||||
- middleware_automation.keycloak.attributes
|
||||
|
||||
author:
|
||||
- Eike Frost (@eikef)
|
||||
|
|
@ -587,6 +636,22 @@ EXAMPLES = '''
|
|||
delegate_to: localhost
|
||||
|
||||
|
||||
- name: Create or update a Keycloak client (minimal example), with x509 authentication
|
||||
middleware_automation.keycloak.keycloak_client:
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
realm: master
|
||||
state: present
|
||||
client_id: test
|
||||
client_authenticator_type: client-x509
|
||||
attributes:
|
||||
x509.subjectdn: "CN=client"
|
||||
x509.allow.regex.pattern.comparison: false
|
||||
|
||||
|
||||
- name: Create or update a Keycloak client (with all the bells and whistles)
|
||||
middleware_automation.keycloak.keycloak_client:
|
||||
auth_client_id: admin-cli
|
||||
|
|
@ -637,7 +702,7 @@ EXAMPLES = '''
|
|||
- test01
|
||||
- test02
|
||||
authentication_flow_binding_overrides:
|
||||
browser: 4c90336b-bf1d-4b87-916d-3677ba4e5fbb
|
||||
browser: 4c90336b-bf1d-4b87-916d-3677ba4e5fbb
|
||||
protocol_mappers:
|
||||
- config:
|
||||
access.token.claim: true
|
||||
|
|
@ -717,11 +782,17 @@ end_state:
|
|||
'''
|
||||
|
||||
from ansible_collections.middleware_automation.keycloak.plugins.module_utils.identity.keycloak.keycloak import KeycloakAPI, camel, \
|
||||
keycloak_argument_spec, get_token, KeycloakError
|
||||
keycloak_argument_spec, get_token, KeycloakError, is_struct_included
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
import copy
|
||||
|
||||
|
||||
PROTOCOL_OPENID_CONNECT = 'openid-connect'
|
||||
PROTOCOL_SAML = 'saml'
|
||||
PROTOCOL_DOCKER_V2 = 'docker-v2'
|
||||
CLIENT_META_DATA = ['authorizationServicesEnabled']
|
||||
|
||||
|
||||
def normalise_cr(clientrep, remove_ids=False):
|
||||
""" Re-sorts any properties where the order so that diff's is minimised, and adds default values where appropriate so that the
|
||||
the change detection is more effective.
|
||||
|
|
@ -737,6 +808,12 @@ def normalise_cr(clientrep, remove_ids=False):
|
|||
if 'attributes' in clientrep:
|
||||
clientrep['attributes'] = list(sorted(clientrep['attributes']))
|
||||
|
||||
if 'defaultClientScopes' in clientrep:
|
||||
clientrep['defaultClientScopes'] = list(sorted(clientrep['defaultClientScopes']))
|
||||
|
||||
if 'optionalClientScopes' in clientrep:
|
||||
clientrep['optionalClientScopes'] = list(sorted(clientrep['optionalClientScopes']))
|
||||
|
||||
if 'redirectUris' in clientrep:
|
||||
clientrep['redirectUris'] = list(sorted(clientrep['redirectUris']))
|
||||
|
||||
|
|
@ -762,11 +839,70 @@ def sanitize_cr(clientrep):
|
|||
if 'secret' in result:
|
||||
result['secret'] = 'no_log'
|
||||
if 'attributes' in result:
|
||||
if 'saml.signing.private.key' in result['attributes']:
|
||||
result['attributes']['saml.signing.private.key'] = 'no_log'
|
||||
attributes = result['attributes']
|
||||
if isinstance(attributes, dict) and 'saml.signing.private.key' in attributes:
|
||||
attributes['saml.signing.private.key'] = 'no_log'
|
||||
return normalise_cr(result)
|
||||
|
||||
|
||||
def get_authentication_flow_id(flow_name, realm, kc):
|
||||
""" Get the authentication flow ID based on the flow name, realm, and Keycloak client.
|
||||
|
||||
Args:
|
||||
flow_name (str): The name of the authentication flow.
|
||||
realm (str): The name of the realm.
|
||||
kc (KeycloakClient): The Keycloak client instance.
|
||||
|
||||
Returns:
|
||||
str: The ID of the authentication flow.
|
||||
|
||||
Raises:
|
||||
KeycloakAPIException: If the authentication flow with the given name is not found in the realm.
|
||||
"""
|
||||
flow = kc.get_authentication_flow_by_alias(flow_name, realm)
|
||||
if flow:
|
||||
return flow["id"]
|
||||
kc.module.fail_json(msg='Authentification flow %s not found in realm %s' % (flow_name, realm))
|
||||
|
||||
|
||||
def flow_binding_from_dict_to_model(newClientFlowBinding, realm, kc):
|
||||
""" Convert a dictionary representing client flow bindings to a model representation.
|
||||
|
||||
Args:
|
||||
newClientFlowBinding (dict): A dictionary containing client flow bindings.
|
||||
realm (str): The name of the realm.
|
||||
kc (KeycloakClient): An instance of the KeycloakClient class.
|
||||
|
||||
Returns:
|
||||
dict: A dictionary representing the model flow bindings. The dictionary has two keys:
|
||||
- "browser" (str or None): The ID of the browser authentication flow binding, or None if not provided.
|
||||
- "direct_grant" (str or None): The ID of the direct grant authentication flow binding, or None if not provided.
|
||||
|
||||
Raises:
|
||||
KeycloakAPIException: If the authentication flow with the given name is not found in the realm.
|
||||
|
||||
"""
|
||||
|
||||
modelFlow = {
|
||||
"browser": None,
|
||||
"direct_grant": None
|
||||
}
|
||||
|
||||
for k, v in newClientFlowBinding.items():
|
||||
if not v:
|
||||
continue
|
||||
if k == "browser":
|
||||
modelFlow["browser"] = v
|
||||
elif k == "browser_name":
|
||||
modelFlow["browser"] = get_authentication_flow_id(v, realm, kc)
|
||||
elif k == "direct_grant":
|
||||
modelFlow["direct_grant"] = v
|
||||
elif k == "direct_grant_name":
|
||||
modelFlow["direct_grant"] = get_authentication_flow_id(v, realm, kc)
|
||||
|
||||
return modelFlow
|
||||
|
||||
|
||||
def main():
|
||||
"""
|
||||
Module execution
|
||||
|
|
@ -780,11 +916,18 @@ def main():
|
|||
consentText=dict(type='str'),
|
||||
id=dict(type='str'),
|
||||
name=dict(type='str'),
|
||||
protocol=dict(type='str', choices=['openid-connect', 'saml']),
|
||||
protocol=dict(type='str', choices=[PROTOCOL_OPENID_CONNECT, PROTOCOL_SAML, PROTOCOL_DOCKER_V2]),
|
||||
protocolMapper=dict(type='str'),
|
||||
config=dict(type='dict'),
|
||||
)
|
||||
|
||||
authentication_flow_spec = dict(
|
||||
browser=dict(type='str'),
|
||||
browser_name=dict(type='str', aliases=['browserName']),
|
||||
direct_grant=dict(type='str', aliases=['directGrant']),
|
||||
direct_grant_name=dict(type='str', aliases=['directGrantName']),
|
||||
)
|
||||
|
||||
meta_args = dict(
|
||||
state=dict(default='present', choices=['present', 'absent']),
|
||||
realm=dict(type='str', default='master'),
|
||||
|
|
@ -798,7 +941,7 @@ def main():
|
|||
base_url=dict(type='str', aliases=['baseUrl']),
|
||||
surrogate_auth_required=dict(type='bool', aliases=['surrogateAuthRequired']),
|
||||
enabled=dict(type='bool'),
|
||||
client_authenticator_type=dict(type='str', choices=['client-secret', 'client-jwt'], aliases=['clientAuthenticatorType']),
|
||||
client_authenticator_type=dict(type='str', choices=['client-secret', 'client-jwt', 'client-x509'], aliases=['clientAuthenticatorType']),
|
||||
secret=dict(type='str', no_log=True),
|
||||
registration_access_token=dict(type='str', aliases=['registrationAccessToken'], no_log=True),
|
||||
default_roles=dict(type='list', elements='str', aliases=['defaultRoles']),
|
||||
|
|
@ -814,7 +957,7 @@ def main():
|
|||
authorization_services_enabled=dict(type='bool', aliases=['authorizationServicesEnabled']),
|
||||
public_client=dict(type='bool', aliases=['publicClient']),
|
||||
frontchannel_logout=dict(type='bool', aliases=['frontchannelLogout']),
|
||||
protocol=dict(type='str', choices=['openid-connect', 'saml']),
|
||||
protocol=dict(type='str', choices=[PROTOCOL_OPENID_CONNECT, PROTOCOL_SAML, PROTOCOL_DOCKER_V2]),
|
||||
attributes=dict(type='dict'),
|
||||
full_scope_allowed=dict(type='bool', aliases=['fullScopeAllowed']),
|
||||
node_re_registration_timeout=dict(type='int', aliases=['nodeReRegistrationTimeout']),
|
||||
|
|
@ -824,7 +967,13 @@ def main():
|
|||
use_template_scope=dict(type='bool', aliases=['useTemplateScope']),
|
||||
use_template_mappers=dict(type='bool', aliases=['useTemplateMappers']),
|
||||
always_display_in_console=dict(type='bool', aliases=['alwaysDisplayInConsole']),
|
||||
authentication_flow_binding_overrides=dict(type='dict', aliases=['authenticationFlowBindingOverrides']),
|
||||
authentication_flow_binding_overrides=dict(
|
||||
type='dict',
|
||||
aliases=['authenticationFlowBindingOverrides'],
|
||||
options=authentication_flow_spec,
|
||||
required_one_of=[['browser', 'direct_grant', 'browser_name', 'direct_grant_name']],
|
||||
mutually_exclusive=[['browser', 'browser_name'], ['direct_grant', 'direct_grant_name']],
|
||||
),
|
||||
protocol_mappers=dict(type='list', elements='dict', options=protmapper_spec, aliases=['protocolMappers']),
|
||||
authorization_settings=dict(type='dict', aliases=['authorizationSettings']),
|
||||
default_client_scopes=dict(type='list', elements='str', aliases=['defaultClientScopes']),
|
||||
|
|
@ -885,7 +1034,9 @@ def main():
|
|||
# Unfortunately, the ansible argument spec checker introduces variables with null values when
|
||||
# they are not specified
|
||||
if client_param == 'protocol_mappers':
|
||||
new_param_value = [dict((k, v) for k, v in x.items() if x[k] is not None) for x in new_param_value]
|
||||
new_param_value = [{k: v for k, v in x.items() if v is not None} for x in new_param_value]
|
||||
elif client_param == 'authentication_flow_binding_overrides':
|
||||
new_param_value = flow_binding_from_dict_to_model(new_param_value, realm, kc)
|
||||
|
||||
changeset[camel(client_param)] = new_param_value
|
||||
|
||||
|
|
@ -912,6 +1063,8 @@ def main():
|
|||
|
||||
if 'clientId' not in desired_client:
|
||||
module.fail_json(msg='client_id needs to be specified when creating a new client')
|
||||
if 'protocol' not in desired_client:
|
||||
desired_client['protocol'] = PROTOCOL_OPENID_CONNECT
|
||||
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after=sanitize_cr(desired_client))
|
||||
|
|
@ -940,7 +1093,7 @@ def main():
|
|||
if module._diff:
|
||||
result['diff'] = dict(before=sanitize_cr(before_norm),
|
||||
after=sanitize_cr(desired_norm))
|
||||
result['changed'] = (before_norm != desired_norm)
|
||||
result['changed'] = not is_struct_included(desired_norm, before_norm, CLIENT_META_DATA)
|
||||
|
||||
module.exit_json(**result)
|
||||
|
||||
|
|
|
|||
848
plugins/modules/keycloak_realm.py
Normal file
848
plugins/modules/keycloak_realm.py
Normal file
|
|
@ -0,0 +1,848 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# Copyright (c) 2017, Eike Frost <ei@kefro.st>
|
||||
# Copyright (c) 2021, Christophe Gilles <christophe.gilles54@gmail.com>
|
||||
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: keycloak_realm
|
||||
|
||||
short_description: Allows administration of Keycloak realm via Keycloak API
|
||||
|
||||
version_added: 3.0.0
|
||||
|
||||
description:
|
||||
- This module allows the administration of Keycloak realm via the Keycloak REST API. It
|
||||
requires access to the REST API via OpenID Connect; the user connecting and the realm being
|
||||
used must have the requisite access rights. In a default Keycloak installation, admin-cli
|
||||
and an admin user would work, as would a separate realm definition with the scope tailored
|
||||
to your needs and a user having the expected roles.
|
||||
|
||||
- The names of module options are snake_cased versions of the camelCase ones found in the
|
||||
Keycloak API and its documentation at U(https://www.keycloak.org/docs-api/8.0/rest-api/index.html).
|
||||
Aliases are provided so camelCased versions can be used as well.
|
||||
|
||||
- The Keycloak API does not always sanity check inputs e.g. you can set
|
||||
SAML-specific settings on an OpenID Connect client for instance and vice versa. Be careful.
|
||||
If you do not specify a setting, usually a sensible default is chosen.
|
||||
|
||||
attributes:
|
||||
check_mode:
|
||||
support: full
|
||||
diff_mode:
|
||||
support: full
|
||||
|
||||
options:
|
||||
state:
|
||||
description:
|
||||
- State of the realm.
|
||||
- On V(present), the realm will be created (or updated if it exists already).
|
||||
- On V(absent), the realm will be removed if it exists.
|
||||
choices: ['present', 'absent']
|
||||
default: 'present'
|
||||
type: str
|
||||
|
||||
id:
|
||||
description:
|
||||
- The realm to create.
|
||||
type: str
|
||||
realm:
|
||||
description:
|
||||
- The realm name.
|
||||
type: str
|
||||
access_code_lifespan:
|
||||
description:
|
||||
- The realm access code lifespan.
|
||||
aliases:
|
||||
- accessCodeLifespan
|
||||
type: int
|
||||
access_code_lifespan_login:
|
||||
description:
|
||||
- The realm access code lifespan login.
|
||||
aliases:
|
||||
- accessCodeLifespanLogin
|
||||
type: int
|
||||
access_code_lifespan_user_action:
|
||||
description:
|
||||
- The realm access code lifespan user action.
|
||||
aliases:
|
||||
- accessCodeLifespanUserAction
|
||||
type: int
|
||||
access_token_lifespan:
|
||||
description:
|
||||
- The realm access token lifespan.
|
||||
aliases:
|
||||
- accessTokenLifespan
|
||||
type: int
|
||||
access_token_lifespan_for_implicit_flow:
|
||||
description:
|
||||
- The realm access token lifespan for implicit flow.
|
||||
aliases:
|
||||
- accessTokenLifespanForImplicitFlow
|
||||
type: int
|
||||
account_theme:
|
||||
description:
|
||||
- The realm account theme.
|
||||
aliases:
|
||||
- accountTheme
|
||||
type: str
|
||||
action_token_generated_by_admin_lifespan:
|
||||
description:
|
||||
- The realm action token generated by admin lifespan.
|
||||
aliases:
|
||||
- actionTokenGeneratedByAdminLifespan
|
||||
type: int
|
||||
action_token_generated_by_user_lifespan:
|
||||
description:
|
||||
- The realm action token generated by user lifespan.
|
||||
aliases:
|
||||
- actionTokenGeneratedByUserLifespan
|
||||
type: int
|
||||
admin_events_details_enabled:
|
||||
description:
|
||||
- The realm admin events details enabled.
|
||||
aliases:
|
||||
- adminEventsDetailsEnabled
|
||||
type: bool
|
||||
admin_events_enabled:
|
||||
description:
|
||||
- The realm admin events enabled.
|
||||
aliases:
|
||||
- adminEventsEnabled
|
||||
type: bool
|
||||
admin_theme:
|
||||
description:
|
||||
- The realm admin theme.
|
||||
aliases:
|
||||
- adminTheme
|
||||
type: str
|
||||
attributes:
|
||||
description:
|
||||
- The realm attributes.
|
||||
type: dict
|
||||
browser_flow:
|
||||
description:
|
||||
- The realm browser flow.
|
||||
aliases:
|
||||
- browserFlow
|
||||
type: str
|
||||
browser_security_headers:
|
||||
description:
|
||||
- The realm browser security headers.
|
||||
aliases:
|
||||
- browserSecurityHeaders
|
||||
type: dict
|
||||
brute_force_protected:
|
||||
description:
|
||||
- The realm brute force protected.
|
||||
aliases:
|
||||
- bruteForceProtected
|
||||
type: bool
|
||||
client_authentication_flow:
|
||||
description:
|
||||
- The realm client authentication flow.
|
||||
aliases:
|
||||
- clientAuthenticationFlow
|
||||
type: str
|
||||
client_scope_mappings:
|
||||
description:
|
||||
- The realm client scope mappings.
|
||||
aliases:
|
||||
- clientScopeMappings
|
||||
type: dict
|
||||
default_default_client_scopes:
|
||||
description:
|
||||
- The realm default default client scopes.
|
||||
aliases:
|
||||
- defaultDefaultClientScopes
|
||||
type: list
|
||||
elements: str
|
||||
default_groups:
|
||||
description:
|
||||
- The realm default groups.
|
||||
aliases:
|
||||
- defaultGroups
|
||||
type: list
|
||||
elements: str
|
||||
default_locale:
|
||||
description:
|
||||
- The realm default locale.
|
||||
aliases:
|
||||
- defaultLocale
|
||||
type: str
|
||||
default_optional_client_scopes:
|
||||
description:
|
||||
- The realm default optional client scopes.
|
||||
aliases:
|
||||
- defaultOptionalClientScopes
|
||||
type: list
|
||||
elements: str
|
||||
default_roles:
|
||||
description:
|
||||
- The realm default roles.
|
||||
aliases:
|
||||
- defaultRoles
|
||||
type: list
|
||||
elements: str
|
||||
default_signature_algorithm:
|
||||
description:
|
||||
- The realm default signature algorithm.
|
||||
aliases:
|
||||
- defaultSignatureAlgorithm
|
||||
type: str
|
||||
direct_grant_flow:
|
||||
description:
|
||||
- The realm direct grant flow.
|
||||
aliases:
|
||||
- directGrantFlow
|
||||
type: str
|
||||
display_name:
|
||||
description:
|
||||
- The realm display name.
|
||||
aliases:
|
||||
- displayName
|
||||
type: str
|
||||
display_name_html:
|
||||
description:
|
||||
- The realm display name HTML.
|
||||
aliases:
|
||||
- displayNameHtml
|
||||
type: str
|
||||
docker_authentication_flow:
|
||||
description:
|
||||
- The realm docker authentication flow.
|
||||
aliases:
|
||||
- dockerAuthenticationFlow
|
||||
type: str
|
||||
duplicate_emails_allowed:
|
||||
description:
|
||||
- The realm duplicate emails allowed option.
|
||||
aliases:
|
||||
- duplicateEmailsAllowed
|
||||
type: bool
|
||||
edit_username_allowed:
|
||||
description:
|
||||
- The realm edit username allowed option.
|
||||
aliases:
|
||||
- editUsernameAllowed
|
||||
type: bool
|
||||
email_theme:
|
||||
description:
|
||||
- The realm email theme.
|
||||
aliases:
|
||||
- emailTheme
|
||||
type: str
|
||||
enabled:
|
||||
description:
|
||||
- The realm enabled option.
|
||||
type: bool
|
||||
enabled_event_types:
|
||||
description:
|
||||
- The realm enabled event types.
|
||||
aliases:
|
||||
- enabledEventTypes
|
||||
type: list
|
||||
elements: str
|
||||
events_enabled:
|
||||
description:
|
||||
- Enables or disables login events for this realm.
|
||||
aliases:
|
||||
- eventsEnabled
|
||||
type: bool
|
||||
version_added: 3.6.0
|
||||
events_expiration:
|
||||
description:
|
||||
- The realm events expiration.
|
||||
aliases:
|
||||
- eventsExpiration
|
||||
type: int
|
||||
events_listeners:
|
||||
description:
|
||||
- The realm events listeners.
|
||||
aliases:
|
||||
- eventsListeners
|
||||
type: list
|
||||
elements: str
|
||||
failure_factor:
|
||||
description:
|
||||
- The realm failure factor.
|
||||
aliases:
|
||||
- failureFactor
|
||||
type: int
|
||||
internationalization_enabled:
|
||||
description:
|
||||
- The realm internationalization enabled option.
|
||||
aliases:
|
||||
- internationalizationEnabled
|
||||
type: bool
|
||||
login_theme:
|
||||
description:
|
||||
- The realm login theme.
|
||||
aliases:
|
||||
- loginTheme
|
||||
type: str
|
||||
login_with_email_allowed:
|
||||
description:
|
||||
- The realm login with email allowed option.
|
||||
aliases:
|
||||
- loginWithEmailAllowed
|
||||
type: bool
|
||||
max_delta_time_seconds:
|
||||
description:
|
||||
- The realm max delta time in seconds.
|
||||
aliases:
|
||||
- maxDeltaTimeSeconds
|
||||
type: int
|
||||
max_failure_wait_seconds:
|
||||
description:
|
||||
- The realm max failure wait in seconds.
|
||||
aliases:
|
||||
- maxFailureWaitSeconds
|
||||
type: int
|
||||
minimum_quick_login_wait_seconds:
|
||||
description:
|
||||
- The realm minimum quick login wait in seconds.
|
||||
aliases:
|
||||
- minimumQuickLoginWaitSeconds
|
||||
type: int
|
||||
not_before:
|
||||
description:
|
||||
- The realm not before.
|
||||
aliases:
|
||||
- notBefore
|
||||
type: int
|
||||
offline_session_idle_timeout:
|
||||
description:
|
||||
- The realm offline session idle timeout.
|
||||
aliases:
|
||||
- offlineSessionIdleTimeout
|
||||
type: int
|
||||
offline_session_max_lifespan:
|
||||
description:
|
||||
- The realm offline session max lifespan.
|
||||
aliases:
|
||||
- offlineSessionMaxLifespan
|
||||
type: int
|
||||
offline_session_max_lifespan_enabled:
|
||||
description:
|
||||
- The realm offline session max lifespan enabled option.
|
||||
aliases:
|
||||
- offlineSessionMaxLifespanEnabled
|
||||
type: bool
|
||||
otp_policy_algorithm:
|
||||
description:
|
||||
- The realm otp policy algorithm.
|
||||
aliases:
|
||||
- otpPolicyAlgorithm
|
||||
type: str
|
||||
otp_policy_digits:
|
||||
description:
|
||||
- The realm otp policy digits.
|
||||
aliases:
|
||||
- otpPolicyDigits
|
||||
type: int
|
||||
otp_policy_initial_counter:
|
||||
description:
|
||||
- The realm otp policy initial counter.
|
||||
aliases:
|
||||
- otpPolicyInitialCounter
|
||||
type: int
|
||||
otp_policy_look_ahead_window:
|
||||
description:
|
||||
- The realm otp policy look ahead window.
|
||||
aliases:
|
||||
- otpPolicyLookAheadWindow
|
||||
type: int
|
||||
otp_policy_period:
|
||||
description:
|
||||
- The realm otp policy period.
|
||||
aliases:
|
||||
- otpPolicyPeriod
|
||||
type: int
|
||||
otp_policy_type:
|
||||
description:
|
||||
- The realm otp policy type.
|
||||
aliases:
|
||||
- otpPolicyType
|
||||
type: str
|
||||
otp_supported_applications:
|
||||
description:
|
||||
- The realm otp supported applications.
|
||||
aliases:
|
||||
- otpSupportedApplications
|
||||
type: list
|
||||
elements: str
|
||||
password_policy:
|
||||
description:
|
||||
- The realm password policy.
|
||||
aliases:
|
||||
- passwordPolicy
|
||||
type: str
|
||||
permanent_lockout:
|
||||
description:
|
||||
- The realm permanent lockout.
|
||||
aliases:
|
||||
- permanentLockout
|
||||
type: bool
|
||||
quick_login_check_milli_seconds:
|
||||
description:
|
||||
- The realm quick login check in milliseconds.
|
||||
aliases:
|
||||
- quickLoginCheckMilliSeconds
|
||||
type: int
|
||||
refresh_token_max_reuse:
|
||||
description:
|
||||
- The realm refresh token max reuse.
|
||||
aliases:
|
||||
- refreshTokenMaxReuse
|
||||
type: int
|
||||
registration_allowed:
|
||||
description:
|
||||
- The realm registration allowed option.
|
||||
aliases:
|
||||
- registrationAllowed
|
||||
type: bool
|
||||
registration_email_as_username:
|
||||
description:
|
||||
- The realm registration email as username option.
|
||||
aliases:
|
||||
- registrationEmailAsUsername
|
||||
type: bool
|
||||
registration_flow:
|
||||
description:
|
||||
- The realm registration flow.
|
||||
aliases:
|
||||
- registrationFlow
|
||||
type: str
|
||||
remember_me:
|
||||
description:
|
||||
- The realm remember me option.
|
||||
aliases:
|
||||
- rememberMe
|
||||
type: bool
|
||||
reset_credentials_flow:
|
||||
description:
|
||||
- The realm reset credentials flow.
|
||||
aliases:
|
||||
- resetCredentialsFlow
|
||||
type: str
|
||||
reset_password_allowed:
|
||||
description:
|
||||
- The realm reset password allowed option.
|
||||
aliases:
|
||||
- resetPasswordAllowed
|
||||
type: bool
|
||||
revoke_refresh_token:
|
||||
description:
|
||||
- The realm revoke refresh token option.
|
||||
aliases:
|
||||
- revokeRefreshToken
|
||||
type: bool
|
||||
smtp_server:
|
||||
description:
|
||||
- The realm smtp server.
|
||||
aliases:
|
||||
- smtpServer
|
||||
type: dict
|
||||
ssl_required:
|
||||
description:
|
||||
- The realm ssl required option.
|
||||
choices: ['all', 'external', 'none']
|
||||
aliases:
|
||||
- sslRequired
|
||||
type: str
|
||||
sso_session_idle_timeout:
|
||||
description:
|
||||
- The realm sso session idle timeout.
|
||||
aliases:
|
||||
- ssoSessionIdleTimeout
|
||||
type: int
|
||||
sso_session_idle_timeout_remember_me:
|
||||
description:
|
||||
- The realm sso session idle timeout remember me.
|
||||
aliases:
|
||||
- ssoSessionIdleTimeoutRememberMe
|
||||
type: int
|
||||
sso_session_max_lifespan:
|
||||
description:
|
||||
- The realm sso session max lifespan.
|
||||
aliases:
|
||||
- ssoSessionMaxLifespan
|
||||
type: int
|
||||
sso_session_max_lifespan_remember_me:
|
||||
description:
|
||||
- The realm sso session max lifespan remember me.
|
||||
aliases:
|
||||
- ssoSessionMaxLifespanRememberMe
|
||||
type: int
|
||||
supported_locales:
|
||||
description:
|
||||
- The realm supported locales.
|
||||
aliases:
|
||||
- supportedLocales
|
||||
type: list
|
||||
elements: str
|
||||
user_managed_access_allowed:
|
||||
description:
|
||||
- The realm user managed access allowed option.
|
||||
aliases:
|
||||
- userManagedAccessAllowed
|
||||
type: bool
|
||||
verify_email:
|
||||
description:
|
||||
- The realm verify email option.
|
||||
aliases:
|
||||
- verifyEmail
|
||||
type: bool
|
||||
wait_increment_seconds:
|
||||
description:
|
||||
- The realm wait increment in seconds.
|
||||
aliases:
|
||||
- waitIncrementSeconds
|
||||
type: int
|
||||
|
||||
extends_documentation_fragment:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
- middleware_automation.keycloak.attributes
|
||||
|
||||
author:
|
||||
- Christophe Gilles (@kris2kris)
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
- name: Create or update Keycloak realm (minimal example)
|
||||
middleware_automation.keycloak.keycloak_realm:
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
id: realm
|
||||
realm: realm
|
||||
state: present
|
||||
|
||||
- name: Delete a Keycloak realm
|
||||
middleware_automation.keycloak.keycloak_realm:
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: https://auth.example.com/auth
|
||||
auth_realm: master
|
||||
auth_username: USERNAME
|
||||
auth_password: PASSWORD
|
||||
id: test
|
||||
state: absent
|
||||
'''
|
||||
|
||||
RETURN = '''
|
||||
msg:
|
||||
description: Message as to what action was taken.
|
||||
returned: always
|
||||
type: str
|
||||
sample: "Realm testrealm has been updated"
|
||||
|
||||
proposed:
|
||||
description: Representation of proposed realm.
|
||||
returned: always
|
||||
type: dict
|
||||
sample: {
|
||||
id: "test"
|
||||
}
|
||||
|
||||
existing:
|
||||
description: Representation of existing realm (sample is truncated).
|
||||
returned: always
|
||||
type: dict
|
||||
sample: {
|
||||
"adminUrl": "http://www.example.com/admin_url",
|
||||
"attributes": {
|
||||
"request.object.signature.alg": "RS256",
|
||||
}
|
||||
}
|
||||
|
||||
end_state:
|
||||
description: Representation of realm after module execution (sample is truncated).
|
||||
returned: on success
|
||||
type: dict
|
||||
sample: {
|
||||
"adminUrl": "http://www.example.com/admin_url",
|
||||
"attributes": {
|
||||
"request.object.signature.alg": "RS256",
|
||||
}
|
||||
}
|
||||
'''
|
||||
|
||||
from ansible_collections.middleware_automation.keycloak.plugins.module_utils.identity.keycloak.keycloak import KeycloakAPI, camel, \
|
||||
keycloak_argument_spec, get_token, KeycloakError
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
|
||||
|
||||
def normalise_cr(realmrep):
|
||||
""" Re-sorts any properties where the order is important so that diff's is minimised and the change detection is more effective.
|
||||
|
||||
:param realmrep: the realmrep dict to be sanitized
|
||||
:return: normalised realmrep dict
|
||||
"""
|
||||
# Avoid the dict passed in to be modified
|
||||
realmrep = realmrep.copy()
|
||||
|
||||
if 'enabledEventTypes' in realmrep:
|
||||
realmrep['enabledEventTypes'] = list(sorted(realmrep['enabledEventTypes']))
|
||||
|
||||
if 'otpSupportedApplications' in realmrep:
|
||||
realmrep['otpSupportedApplications'] = list(sorted(realmrep['otpSupportedApplications']))
|
||||
|
||||
if 'supportedLocales' in realmrep:
|
||||
realmrep['supportedLocales'] = list(sorted(realmrep['supportedLocales']))
|
||||
|
||||
return realmrep
|
||||
|
||||
|
||||
def sanitize_cr(realmrep):
|
||||
""" Removes probably sensitive details from a realm representation.
|
||||
|
||||
:param realmrep: the realmrep dict to be sanitized
|
||||
:return: sanitized realmrep dict
|
||||
"""
|
||||
result = realmrep.copy()
|
||||
if 'secret' in result:
|
||||
result['secret'] = '********'
|
||||
if 'attributes' in result:
|
||||
if 'saml.signing.private.key' in result['attributes']:
|
||||
result['attributes'] = result['attributes'].copy()
|
||||
result['attributes']['saml.signing.private.key'] = '********'
|
||||
return normalise_cr(result)
|
||||
|
||||
|
||||
def main():
|
||||
"""
|
||||
Module execution
|
||||
|
||||
:return:
|
||||
"""
|
||||
argument_spec = keycloak_argument_spec()
|
||||
|
||||
meta_args = dict(
|
||||
state=dict(default='present', choices=['present', 'absent']),
|
||||
|
||||
id=dict(type='str'),
|
||||
realm=dict(type='str'),
|
||||
access_code_lifespan=dict(type='int', aliases=['accessCodeLifespan']),
|
||||
access_code_lifespan_login=dict(type='int', aliases=['accessCodeLifespanLogin']),
|
||||
access_code_lifespan_user_action=dict(type='int', aliases=['accessCodeLifespanUserAction']),
|
||||
access_token_lifespan=dict(type='int', aliases=['accessTokenLifespan'], no_log=False),
|
||||
access_token_lifespan_for_implicit_flow=dict(type='int', aliases=['accessTokenLifespanForImplicitFlow'], no_log=False),
|
||||
account_theme=dict(type='str', aliases=['accountTheme']),
|
||||
action_token_generated_by_admin_lifespan=dict(type='int', aliases=['actionTokenGeneratedByAdminLifespan'], no_log=False),
|
||||
action_token_generated_by_user_lifespan=dict(type='int', aliases=['actionTokenGeneratedByUserLifespan'], no_log=False),
|
||||
admin_events_details_enabled=dict(type='bool', aliases=['adminEventsDetailsEnabled']),
|
||||
admin_events_enabled=dict(type='bool', aliases=['adminEventsEnabled']),
|
||||
admin_theme=dict(type='str', aliases=['adminTheme']),
|
||||
attributes=dict(type='dict'),
|
||||
browser_flow=dict(type='str', aliases=['browserFlow']),
|
||||
browser_security_headers=dict(type='dict', aliases=['browserSecurityHeaders']),
|
||||
brute_force_protected=dict(type='bool', aliases=['bruteForceProtected']),
|
||||
client_authentication_flow=dict(type='str', aliases=['clientAuthenticationFlow']),
|
||||
client_scope_mappings=dict(type='dict', aliases=['clientScopeMappings']),
|
||||
default_default_client_scopes=dict(type='list', elements='str', aliases=['defaultDefaultClientScopes']),
|
||||
default_groups=dict(type='list', elements='str', aliases=['defaultGroups']),
|
||||
default_locale=dict(type='str', aliases=['defaultLocale']),
|
||||
default_optional_client_scopes=dict(type='list', elements='str', aliases=['defaultOptionalClientScopes']),
|
||||
default_roles=dict(type='list', elements='str', aliases=['defaultRoles']),
|
||||
default_signature_algorithm=dict(type='str', aliases=['defaultSignatureAlgorithm']),
|
||||
direct_grant_flow=dict(type='str', aliases=['directGrantFlow']),
|
||||
display_name=dict(type='str', aliases=['displayName']),
|
||||
display_name_html=dict(type='str', aliases=['displayNameHtml']),
|
||||
docker_authentication_flow=dict(type='str', aliases=['dockerAuthenticationFlow']),
|
||||
duplicate_emails_allowed=dict(type='bool', aliases=['duplicateEmailsAllowed']),
|
||||
edit_username_allowed=dict(type='bool', aliases=['editUsernameAllowed']),
|
||||
email_theme=dict(type='str', aliases=['emailTheme']),
|
||||
enabled=dict(type='bool'),
|
||||
enabled_event_types=dict(type='list', elements='str', aliases=['enabledEventTypes']),
|
||||
events_enabled=dict(type='bool', aliases=['eventsEnabled']),
|
||||
events_expiration=dict(type='int', aliases=['eventsExpiration']),
|
||||
events_listeners=dict(type='list', elements='str', aliases=['eventsListeners']),
|
||||
failure_factor=dict(type='int', aliases=['failureFactor']),
|
||||
internationalization_enabled=dict(type='bool', aliases=['internationalizationEnabled']),
|
||||
login_theme=dict(type='str', aliases=['loginTheme']),
|
||||
login_with_email_allowed=dict(type='bool', aliases=['loginWithEmailAllowed']),
|
||||
max_delta_time_seconds=dict(type='int', aliases=['maxDeltaTimeSeconds']),
|
||||
max_failure_wait_seconds=dict(type='int', aliases=['maxFailureWaitSeconds']),
|
||||
minimum_quick_login_wait_seconds=dict(type='int', aliases=['minimumQuickLoginWaitSeconds']),
|
||||
not_before=dict(type='int', aliases=['notBefore']),
|
||||
offline_session_idle_timeout=dict(type='int', aliases=['offlineSessionIdleTimeout']),
|
||||
offline_session_max_lifespan=dict(type='int', aliases=['offlineSessionMaxLifespan']),
|
||||
offline_session_max_lifespan_enabled=dict(type='bool', aliases=['offlineSessionMaxLifespanEnabled']),
|
||||
otp_policy_algorithm=dict(type='str', aliases=['otpPolicyAlgorithm']),
|
||||
otp_policy_digits=dict(type='int', aliases=['otpPolicyDigits']),
|
||||
otp_policy_initial_counter=dict(type='int', aliases=['otpPolicyInitialCounter']),
|
||||
otp_policy_look_ahead_window=dict(type='int', aliases=['otpPolicyLookAheadWindow']),
|
||||
otp_policy_period=dict(type='int', aliases=['otpPolicyPeriod']),
|
||||
otp_policy_type=dict(type='str', aliases=['otpPolicyType']),
|
||||
otp_supported_applications=dict(type='list', elements='str', aliases=['otpSupportedApplications']),
|
||||
password_policy=dict(type='str', aliases=['passwordPolicy'], no_log=False),
|
||||
permanent_lockout=dict(type='bool', aliases=['permanentLockout']),
|
||||
quick_login_check_milli_seconds=dict(type='int', aliases=['quickLoginCheckMilliSeconds']),
|
||||
refresh_token_max_reuse=dict(type='int', aliases=['refreshTokenMaxReuse'], no_log=False),
|
||||
registration_allowed=dict(type='bool', aliases=['registrationAllowed']),
|
||||
registration_email_as_username=dict(type='bool', aliases=['registrationEmailAsUsername']),
|
||||
registration_flow=dict(type='str', aliases=['registrationFlow']),
|
||||
remember_me=dict(type='bool', aliases=['rememberMe']),
|
||||
reset_credentials_flow=dict(type='str', aliases=['resetCredentialsFlow']),
|
||||
reset_password_allowed=dict(type='bool', aliases=['resetPasswordAllowed'], no_log=False),
|
||||
revoke_refresh_token=dict(type='bool', aliases=['revokeRefreshToken']),
|
||||
smtp_server=dict(type='dict', aliases=['smtpServer']),
|
||||
ssl_required=dict(choices=["external", "all", "none"], aliases=['sslRequired']),
|
||||
sso_session_idle_timeout=dict(type='int', aliases=['ssoSessionIdleTimeout']),
|
||||
sso_session_idle_timeout_remember_me=dict(type='int', aliases=['ssoSessionIdleTimeoutRememberMe']),
|
||||
sso_session_max_lifespan=dict(type='int', aliases=['ssoSessionMaxLifespan']),
|
||||
sso_session_max_lifespan_remember_me=dict(type='int', aliases=['ssoSessionMaxLifespanRememberMe']),
|
||||
supported_locales=dict(type='list', elements='str', aliases=['supportedLocales']),
|
||||
user_managed_access_allowed=dict(type='bool', aliases=['userManagedAccessAllowed']),
|
||||
verify_email=dict(type='bool', aliases=['verifyEmail']),
|
||||
wait_increment_seconds=dict(type='int', aliases=['waitIncrementSeconds']),
|
||||
)
|
||||
|
||||
argument_spec.update(meta_args)
|
||||
|
||||
module = AnsibleModule(argument_spec=argument_spec,
|
||||
supports_check_mode=True,
|
||||
required_one_of=([['id', 'realm', 'enabled'],
|
||||
['token', 'auth_realm', 'auth_username', 'auth_password']]),
|
||||
required_together=([['auth_realm', 'auth_username', 'auth_password']]))
|
||||
|
||||
result = dict(changed=False, msg='', diff={}, proposed={}, existing={}, end_state={})
|
||||
|
||||
# Obtain access token, initialize API
|
||||
try:
|
||||
connection_header = get_token(module.params)
|
||||
except KeycloakError as e:
|
||||
module.fail_json(msg=str(e))
|
||||
|
||||
kc = KeycloakAPI(module, connection_header)
|
||||
|
||||
realm = module.params.get('realm')
|
||||
state = module.params.get('state')
|
||||
|
||||
# convert module parameters to realm representation parameters (if they belong in there)
|
||||
params_to_ignore = list(keycloak_argument_spec().keys()) + ['state']
|
||||
|
||||
# Filter and map the parameters names that apply to the role
|
||||
realm_params = [x for x in module.params
|
||||
if x not in params_to_ignore and
|
||||
module.params.get(x) is not None]
|
||||
|
||||
# See whether the realm already exists in Keycloak
|
||||
before_realm = kc.get_realm_by_id(realm=realm)
|
||||
|
||||
if before_realm is None:
|
||||
before_realm = {}
|
||||
|
||||
# Build a proposed changeset from parameters given to this module
|
||||
changeset = {}
|
||||
|
||||
for realm_param in realm_params:
|
||||
new_param_value = module.params.get(realm_param)
|
||||
changeset[camel(realm_param)] = new_param_value
|
||||
|
||||
# Prepare the desired values using the existing values (non-existence results in a dict that is save to use as a basis)
|
||||
desired_realm = before_realm.copy()
|
||||
desired_realm.update(changeset)
|
||||
|
||||
result['proposed'] = sanitize_cr(changeset)
|
||||
before_realm_sanitized = sanitize_cr(before_realm)
|
||||
result['existing'] = before_realm_sanitized
|
||||
|
||||
# Cater for when it doesn't exist (an empty dict)
|
||||
if not before_realm:
|
||||
if state == 'absent':
|
||||
# Do nothing and exit
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after='')
|
||||
result['changed'] = False
|
||||
result['end_state'] = {}
|
||||
result['msg'] = 'Realm does not exist, doing nothing.'
|
||||
module.exit_json(**result)
|
||||
|
||||
# Process a creation
|
||||
result['changed'] = True
|
||||
|
||||
if 'id' not in desired_realm:
|
||||
module.fail_json(msg='id needs to be specified when creating a new realm')
|
||||
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after=sanitize_cr(desired_realm))
|
||||
|
||||
if module.check_mode:
|
||||
module.exit_json(**result)
|
||||
|
||||
# create it
|
||||
kc.create_realm(desired_realm)
|
||||
after_realm = kc.get_realm_by_id(desired_realm['id'])
|
||||
|
||||
result['end_state'] = sanitize_cr(after_realm)
|
||||
|
||||
result['msg'] = 'Realm %s has been created.' % desired_realm['id']
|
||||
module.exit_json(**result)
|
||||
|
||||
else:
|
||||
if state == 'present':
|
||||
# Process an update
|
||||
|
||||
# doing an update
|
||||
result['changed'] = True
|
||||
if module.check_mode:
|
||||
# We can only compare the current realm with the proposed updates we have
|
||||
before_norm = normalise_cr(before_realm)
|
||||
desired_norm = normalise_cr(desired_realm)
|
||||
if module._diff:
|
||||
result['diff'] = dict(before=sanitize_cr(before_norm),
|
||||
after=sanitize_cr(desired_norm))
|
||||
result['changed'] = (before_norm != desired_norm)
|
||||
|
||||
module.exit_json(**result)
|
||||
|
||||
# do the update
|
||||
kc.update_realm(desired_realm, realm=realm)
|
||||
|
||||
after_realm = kc.get_realm_by_id(realm=realm)
|
||||
|
||||
if before_realm == after_realm:
|
||||
result['changed'] = False
|
||||
|
||||
result['end_state'] = sanitize_cr(after_realm)
|
||||
|
||||
if module._diff:
|
||||
result['diff'] = dict(before=before_realm_sanitized,
|
||||
after=sanitize_cr(after_realm))
|
||||
|
||||
result['msg'] = 'Realm %s has been updated.' % desired_realm['id']
|
||||
module.exit_json(**result)
|
||||
|
||||
else:
|
||||
# Process a deletion (because state was not 'present')
|
||||
result['changed'] = True
|
||||
|
||||
if module._diff:
|
||||
result['diff'] = dict(before=before_realm_sanitized, after='')
|
||||
|
||||
if module.check_mode:
|
||||
module.exit_json(**result)
|
||||
|
||||
# delete it
|
||||
kc.delete_realm(realm=realm)
|
||||
|
||||
result['proposed'] = {}
|
||||
result['end_state'] = {}
|
||||
|
||||
result['msg'] = 'Realm %s has been deleted.' % before_realm['id']
|
||||
|
||||
module.exit_json(**result)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
@ -40,8 +40,8 @@ options:
|
|||
state:
|
||||
description:
|
||||
- State of the role.
|
||||
- On C(present), the role will be created if it does not yet exist, or updated with the parameters you provide.
|
||||
- On C(absent), the role will be removed if it exists.
|
||||
- On V(present), the role will be created if it does not yet exist, or updated with the parameters you provide.
|
||||
- On V(absent), the role will be removed if it exists.
|
||||
default: 'present'
|
||||
type: str
|
||||
choices:
|
||||
|
|
@ -77,6 +77,42 @@ options:
|
|||
description:
|
||||
- A dict of key/value pairs to set as custom attributes for the role.
|
||||
- Values may be single values (e.g. a string) or a list of strings.
|
||||
composite:
|
||||
description:
|
||||
- If V(true), the role is a composition of other realm and/or client role.
|
||||
default: false
|
||||
type: bool
|
||||
version_added: 7.1.0
|
||||
composites:
|
||||
description:
|
||||
- List of roles to include to the composite realm role.
|
||||
- If the composite role is a client role, the C(clientId) (not ID of the client) must be specified.
|
||||
default: []
|
||||
type: list
|
||||
elements: dict
|
||||
version_added: 7.1.0
|
||||
suboptions:
|
||||
name:
|
||||
description:
|
||||
- Name of the role. This can be the name of a REALM role or a client role.
|
||||
type: str
|
||||
required: true
|
||||
client_id:
|
||||
description:
|
||||
- Client ID if the role is a client role. Do not include this option for a REALM role.
|
||||
- Use the client ID you can see in the Keycloak console, not the technical ID of the client.
|
||||
type: str
|
||||
required: false
|
||||
aliases:
|
||||
- clientId
|
||||
state:
|
||||
description:
|
||||
- Create the composite if present, remove it if absent.
|
||||
type: str
|
||||
choices:
|
||||
- present
|
||||
- absent
|
||||
default: present
|
||||
|
||||
extends_documentation_fragment:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
|
|
@ -142,14 +178,14 @@ EXAMPLES = '''
|
|||
auth_password: PASSWORD
|
||||
name: my-new-role
|
||||
attributes:
|
||||
attrib1: value1
|
||||
attrib2: value2
|
||||
attrib3:
|
||||
- with
|
||||
- numerous
|
||||
- individual
|
||||
- list
|
||||
- items
|
||||
attrib1: value1
|
||||
attrib2: value2
|
||||
attrib3:
|
||||
- with
|
||||
- numerous
|
||||
- individual
|
||||
- list
|
||||
- items
|
||||
delegate_to: localhost
|
||||
'''
|
||||
|
||||
|
|
@ -198,8 +234,9 @@ end_state:
|
|||
'''
|
||||
|
||||
from ansible_collections.middleware_automation.keycloak.plugins.module_utils.identity.keycloak.keycloak import KeycloakAPI, camel, \
|
||||
keycloak_argument_spec, get_token, KeycloakError
|
||||
keycloak_argument_spec, get_token, KeycloakError, is_struct_included
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
import copy
|
||||
|
||||
|
||||
def main():
|
||||
|
|
@ -210,6 +247,12 @@ def main():
|
|||
"""
|
||||
argument_spec = keycloak_argument_spec()
|
||||
|
||||
composites_spec = dict(
|
||||
name=dict(type='str', required=True),
|
||||
client_id=dict(type='str', aliases=['clientId'], required=False),
|
||||
state=dict(type='str', default='present', choices=['present', 'absent'])
|
||||
)
|
||||
|
||||
meta_args = dict(
|
||||
state=dict(type='str', default='present', choices=['present', 'absent']),
|
||||
name=dict(type='str', required=True),
|
||||
|
|
@ -217,6 +260,8 @@ def main():
|
|||
realm=dict(type='str', default='master'),
|
||||
client_id=dict(type='str'),
|
||||
attributes=dict(type='dict'),
|
||||
composites=dict(type='list', default=[], options=composites_spec, elements='dict'),
|
||||
composite=dict(type='bool', default=False),
|
||||
)
|
||||
|
||||
argument_spec.update(meta_args)
|
||||
|
|
@ -250,7 +295,7 @@ def main():
|
|||
|
||||
# Filter and map the parameters names that apply to the role
|
||||
role_params = [x for x in module.params
|
||||
if x not in list(keycloak_argument_spec().keys()) + ['state', 'realm', 'client_id', 'composites'] and
|
||||
if x not in list(keycloak_argument_spec().keys()) + ['state', 'realm', 'client_id'] and
|
||||
module.params.get(x) is not None]
|
||||
|
||||
# See if it already exists in Keycloak
|
||||
|
|
@ -269,10 +314,10 @@ def main():
|
|||
new_param_value = module.params.get(param)
|
||||
old_value = before_role[param] if param in before_role else None
|
||||
if new_param_value != old_value:
|
||||
changeset[camel(param)] = new_param_value
|
||||
changeset[camel(param)] = copy.deepcopy(new_param_value)
|
||||
|
||||
# Prepare the desired values using the existing values (non-existence results in a dict that is save to use as a basis)
|
||||
desired_role = before_role.copy()
|
||||
desired_role = copy.deepcopy(before_role)
|
||||
desired_role.update(changeset)
|
||||
|
||||
result['proposed'] = changeset
|
||||
|
|
@ -309,6 +354,9 @@ def main():
|
|||
kc.create_client_role(desired_role, clientid, realm)
|
||||
after_role = kc.get_client_role(name, clientid, realm)
|
||||
|
||||
if after_role['composite']:
|
||||
after_role['composites'] = kc.get_role_composites(rolerep=after_role, clientid=clientid, realm=realm)
|
||||
|
||||
result['end_state'] = after_role
|
||||
|
||||
result['msg'] = 'Role {name} has been created'.format(name=name)
|
||||
|
|
@ -316,10 +364,25 @@ def main():
|
|||
|
||||
else:
|
||||
if state == 'present':
|
||||
compare_exclude = []
|
||||
if 'composites' in desired_role and isinstance(desired_role['composites'], list) and len(desired_role['composites']) > 0:
|
||||
composites = kc.get_role_composites(rolerep=before_role, clientid=clientid, realm=realm)
|
||||
before_role['composites'] = []
|
||||
for composite in composites:
|
||||
before_composite = {}
|
||||
if composite['clientRole']:
|
||||
composite_client = kc.get_client_by_id(id=composite['containerId'], realm=realm)
|
||||
before_composite['client_id'] = composite_client['clientId']
|
||||
else:
|
||||
before_composite['client_id'] = None
|
||||
before_composite['name'] = composite['name']
|
||||
before_composite['state'] = 'present'
|
||||
before_role['composites'].append(before_composite)
|
||||
else:
|
||||
compare_exclude.append('composites')
|
||||
# Process an update
|
||||
|
||||
# no changes
|
||||
if desired_role == before_role:
|
||||
if is_struct_included(desired_role, before_role, exclude=compare_exclude):
|
||||
result['changed'] = False
|
||||
result['end_state'] = desired_role
|
||||
result['msg'] = "No changes required to role {name}.".format(name=name)
|
||||
|
|
@ -341,6 +404,8 @@ def main():
|
|||
else:
|
||||
kc.update_client_role(desired_role, clientid, realm)
|
||||
after_role = kc.get_client_role(name, clientid, realm)
|
||||
if after_role['composite']:
|
||||
after_role['composites'] = kc.get_role_composites(rolerep=after_role, clientid=clientid, realm=realm)
|
||||
|
||||
result['end_state'] = after_role
|
||||
|
||||
|
|
|
|||
|
|
@ -36,9 +36,9 @@ options:
|
|||
state:
|
||||
description:
|
||||
- State of the user federation.
|
||||
- On C(present), the user federation will be created if it does not yet exist, or updated with
|
||||
- On V(present), the user federation will be created if it does not yet exist, or updated with
|
||||
the parameters you provide.
|
||||
- On C(absent), the user federation will be removed if it exists.
|
||||
- On V(absent), the user federation will be removed if it exists.
|
||||
default: 'present'
|
||||
type: str
|
||||
choices:
|
||||
|
|
@ -54,7 +54,7 @@ options:
|
|||
id:
|
||||
description:
|
||||
- The unique ID for this user federation. If left empty, the user federation will be searched
|
||||
by its I(name).
|
||||
by its O(name).
|
||||
type: str
|
||||
|
||||
name:
|
||||
|
|
@ -64,18 +64,15 @@ options:
|
|||
|
||||
provider_id:
|
||||
description:
|
||||
- Provider for this user federation.
|
||||
- Provider for this user federation. Built-in providers are V(ldap), V(kerberos), and V(sssd).
|
||||
Custom user storage providers can also be used.
|
||||
aliases:
|
||||
- providerId
|
||||
type: str
|
||||
choices:
|
||||
- ldap
|
||||
- kerberos
|
||||
- sssd
|
||||
|
||||
provider_type:
|
||||
description:
|
||||
- Component type for user federation (only supported value is C(org.keycloak.storage.UserStorageProvider)).
|
||||
- Component type for user federation (only supported value is V(org.keycloak.storage.UserStorageProvider)).
|
||||
aliases:
|
||||
- providerType
|
||||
default: org.keycloak.storage.UserStorageProvider
|
||||
|
|
@ -88,13 +85,37 @@ options:
|
|||
- parentId
|
||||
type: str
|
||||
|
||||
remove_unspecified_mappers:
|
||||
description:
|
||||
- Remove mappers that are not specified in the configuration for this federation.
|
||||
- Set to V(false) to keep mappers that are not listed in O(mappers).
|
||||
type: bool
|
||||
default: true
|
||||
|
||||
bind_credential_update_mode:
|
||||
description:
|
||||
- The value of the config parameter O(config.bindCredential) is redacted in the Keycloak responses.
|
||||
Comparing the redacted value with the desired value always evaluates to not equal. This means
|
||||
the before and desired states are never equal if the parameter is set.
|
||||
- Set to V(always) to include O(config.bindCredential) in the comparison of before and desired state.
|
||||
Because of the redacted value returned by Keycloak the module will always detect a change
|
||||
and make an update if a O(config.bindCredential) value is set.
|
||||
- Set to V(only_indirect) to exclude O(config.bindCredential) when comparing the before state with the
|
||||
desired state. The value of O(config.bindCredential) will only be updated if there are other changes
|
||||
to the user federation that require an update.
|
||||
type: str
|
||||
default: always
|
||||
choices:
|
||||
- always
|
||||
- only_indirect
|
||||
|
||||
config:
|
||||
description:
|
||||
- Dict specifying the configuration options for the provider; the contents differ depending on
|
||||
the value of I(provider_id). Examples are given below for C(ldap), C(kerberos) and C(sssd).
|
||||
the value of O(provider_id). Examples are given below for V(ldap), V(kerberos) and V(sssd).
|
||||
It is easiest to obtain valid config values by dumping an already-existing user federation
|
||||
configuration through check-mode in the I(existing) field.
|
||||
- The value C(sssd) has been supported since middleware_automation.keycloak 1.0.0.
|
||||
configuration through check-mode in the RV(existing) field.
|
||||
- The value V(sssd) has been supported since middleware_automation.keycloak 2.0.0.
|
||||
type: dict
|
||||
suboptions:
|
||||
enabled:
|
||||
|
|
@ -111,15 +132,15 @@ options:
|
|||
|
||||
importEnabled:
|
||||
description:
|
||||
- If C(true), LDAP users will be imported into Keycloak DB and synced by the configured
|
||||
- If V(true), LDAP users will be imported into Keycloak DB and synced by the configured
|
||||
sync policies.
|
||||
default: true
|
||||
type: bool
|
||||
|
||||
editMode:
|
||||
description:
|
||||
- C(READ_ONLY) is a read-only LDAP store. C(WRITABLE) means data will be synced back to LDAP
|
||||
on demand. C(UNSYNCED) means user data will be imported, but not synced back to LDAP.
|
||||
- V(READ_ONLY) is a read-only LDAP store. V(WRITABLE) means data will be synced back to LDAP
|
||||
on demand. V(UNSYNCED) means user data will be imported, but not synced back to LDAP.
|
||||
type: str
|
||||
choices:
|
||||
- READ_ONLY
|
||||
|
|
@ -136,13 +157,13 @@ options:
|
|||
vendor:
|
||||
description:
|
||||
- LDAP vendor (provider).
|
||||
- Use short name. For instance, write C(rhds) for "Red Hat Directory Server".
|
||||
- Use short name. For instance, write V(rhds) for "Red Hat Directory Server".
|
||||
type: str
|
||||
|
||||
usernameLDAPAttribute:
|
||||
description:
|
||||
- Name of LDAP attribute, which is mapped as Keycloak username. For many LDAP server
|
||||
vendors it can be C(uid). For Active directory it can be C(sAMAccountName) or C(cn).
|
||||
vendors it can be V(uid). For Active directory it can be V(sAMAccountName) or V(cn).
|
||||
The attribute should be filled for all LDAP user records you want to import from
|
||||
LDAP to Keycloak.
|
||||
type: str
|
||||
|
|
@ -151,15 +172,15 @@ options:
|
|||
description:
|
||||
- Name of LDAP attribute, which is used as RDN (top attribute) of typical user DN.
|
||||
Usually it's the same as Username LDAP attribute, however it is not required. For
|
||||
example for Active directory, it is common to use C(cn) as RDN attribute when
|
||||
username attribute might be C(sAMAccountName).
|
||||
example for Active directory, it is common to use V(cn) as RDN attribute when
|
||||
username attribute might be V(sAMAccountName).
|
||||
type: str
|
||||
|
||||
uuidLDAPAttribute:
|
||||
description:
|
||||
- Name of LDAP attribute, which is used as unique object identifier (UUID) for objects
|
||||
in LDAP. For many LDAP server vendors, it is C(entryUUID); however some are different.
|
||||
For example for Active directory it should be C(objectGUID). If your LDAP server does
|
||||
in LDAP. For many LDAP server vendors, it is V(entryUUID); however some are different.
|
||||
For example for Active directory it should be V(objectGUID). If your LDAP server does
|
||||
not support the notion of UUID, you can use any other attribute that is supposed to
|
||||
be unique among LDAP users in tree.
|
||||
type: str
|
||||
|
|
@ -167,7 +188,7 @@ options:
|
|||
userObjectClasses:
|
||||
description:
|
||||
- All values of LDAP objectClass attribute for users in LDAP divided by comma.
|
||||
For example C(inetOrgPerson, organizationalPerson). Newly created Keycloak users
|
||||
For example V(inetOrgPerson, organizationalPerson). Newly created Keycloak users
|
||||
will be written to LDAP with all those object classes and existing LDAP user records
|
||||
are found just if they contain all those object classes.
|
||||
type: str
|
||||
|
|
@ -251,8 +272,8 @@ options:
|
|||
useTruststoreSpi:
|
||||
description:
|
||||
- Specifies whether LDAP connection will use the truststore SPI with the truststore
|
||||
configured in standalone.xml/domain.xml. C(Always) means that it will always use it.
|
||||
C(Never) means that it will not use it. C(Only for ldaps) means that it will use if
|
||||
configured in standalone.xml/domain.xml. V(always) means that it will always use it.
|
||||
V(never) means that it will not use it. V(ldapsOnly) means that it will use if
|
||||
your connection URL use ldaps. Note even if standalone.xml/domain.xml is not
|
||||
configured, the default Java cacerts or certificate specified by
|
||||
C(javax.net.ssl.trustStore) property will be used.
|
||||
|
|
@ -297,7 +318,7 @@ options:
|
|||
connectionPoolingDebug:
|
||||
description:
|
||||
- A string that indicates the level of debug output to produce. Example valid values are
|
||||
C(fine) (trace connection creation and removal) and C(all) (all debugging information).
|
||||
V(fine) (trace connection creation and removal) and V(all) (all debugging information).
|
||||
type: str
|
||||
|
||||
connectionPoolingInitSize:
|
||||
|
|
@ -321,7 +342,7 @@ options:
|
|||
connectionPoolingProtocol:
|
||||
description:
|
||||
- A list of space-separated protocol types of connections that may be pooled.
|
||||
Valid types are C(plain) and C(ssl).
|
||||
Valid types are V(plain) and V(ssl).
|
||||
type: str
|
||||
|
||||
connectionPoolingTimeout:
|
||||
|
|
@ -342,17 +363,26 @@ options:
|
|||
- Name of kerberos realm.
|
||||
type: str
|
||||
|
||||
krbPrincipalAttribute:
|
||||
description:
|
||||
- Name of the LDAP attribute, which refers to Kerberos principal.
|
||||
This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak.
|
||||
When this is empty, the LDAP user will be looked based on LDAP username corresponding
|
||||
to the first part of his Kerberos principal. For instance, for principal C(john@KEYCLOAK.ORG),
|
||||
it will assume that LDAP username is V(john).
|
||||
type: str
|
||||
|
||||
serverPrincipal:
|
||||
description:
|
||||
- Full name of server principal for HTTP service including server and domain name. For
|
||||
example C(HTTP/host.foo.org@FOO.ORG). Use C(*) to accept any service principal in the
|
||||
example V(HTTP/host.foo.org@FOO.ORG). Use V(*) to accept any service principal in the
|
||||
KeyTab file.
|
||||
type: str
|
||||
|
||||
keyTab:
|
||||
description:
|
||||
- Location of Kerberos KeyTab file containing the credentials of server principal. For
|
||||
example C(/etc/krb5.keytab).
|
||||
example V(/etc/krb5.keytab).
|
||||
type: str
|
||||
|
||||
debug:
|
||||
|
|
@ -427,6 +457,16 @@ options:
|
|||
- Max lifespan of cache entry in milliseconds.
|
||||
type: int
|
||||
|
||||
referral:
|
||||
description:
|
||||
- Specifies if LDAP referrals should be followed or ignored. Please note that enabling
|
||||
referrals can slow down authentication as it allows the LDAP server to decide which other
|
||||
LDAP servers to use. This could potentially include untrusted servers.
|
||||
type: str
|
||||
choices:
|
||||
- ignore
|
||||
- follow
|
||||
|
||||
mappers:
|
||||
description:
|
||||
- A list of dicts defining mappers associated with this Identity Provider.
|
||||
|
|
@ -451,7 +491,7 @@ options:
|
|||
|
||||
providerId:
|
||||
description:
|
||||
- The mapper type for this mapper (for instance C(user-attribute-ldap-mapper)).
|
||||
- The mapper type for this mapper (for instance V(user-attribute-ldap-mapper)).
|
||||
type: str
|
||||
|
||||
providerType:
|
||||
|
|
@ -534,14 +574,14 @@ EXAMPLES = '''
|
|||
provider_id: kerberos
|
||||
provider_type: org.keycloak.storage.UserStorageProvider
|
||||
config:
|
||||
priority: 0
|
||||
enabled: true
|
||||
cachePolicy: DEFAULT
|
||||
kerberosRealm: EXAMPLE.COM
|
||||
serverPrincipal: HTTP/host.example.com@EXAMPLE.COM
|
||||
keyTab: keytab
|
||||
allowPasswordAuthentication: false
|
||||
updateProfileFirstLogin: false
|
||||
priority: 0
|
||||
enabled: true
|
||||
cachePolicy: DEFAULT
|
||||
kerberosRealm: EXAMPLE.COM
|
||||
serverPrincipal: HTTP/host.example.com@EXAMPLE.COM
|
||||
keyTab: keytab
|
||||
allowPasswordAuthentication: false
|
||||
updateProfileFirstLogin: false
|
||||
|
||||
- name: Create sssd user federation
|
||||
middleware_automation.keycloak.keycloak_user_federation:
|
||||
|
|
@ -704,16 +744,27 @@ from ansible.module_utils.six.moves.urllib.parse import urlencode
|
|||
from copy import deepcopy
|
||||
|
||||
|
||||
def normalize_kc_comp(comp):
|
||||
if 'config' in comp:
|
||||
# kc completely removes the parameter `krbPrincipalAttribute` if it is set to `''`; the unset kc parameter is equivalent to `''`;
|
||||
# to make change detection and diff more accurate we set it again in the kc responses
|
||||
if 'krbPrincipalAttribute' not in comp['config']:
|
||||
comp['config']['krbPrincipalAttribute'] = ['']
|
||||
|
||||
# kc stores a timestamp of the last sync in `lastSync` to time the periodic sync, it is removed to minimize diff/changes
|
||||
comp['config'].pop('lastSync', None)
|
||||
|
||||
|
||||
def sanitize(comp):
|
||||
compcopy = deepcopy(comp)
|
||||
if 'config' in compcopy:
|
||||
compcopy['config'] = dict((k, v[0]) for k, v in compcopy['config'].items())
|
||||
compcopy['config'] = {k: v[0] for k, v in compcopy['config'].items()}
|
||||
if 'bindCredential' in compcopy['config']:
|
||||
compcopy['config']['bindCredential'] = '**********'
|
||||
if 'mappers' in compcopy:
|
||||
for mapper in compcopy['mappers']:
|
||||
if 'config' in mapper:
|
||||
mapper['config'] = dict((k, v[0]) for k, v in mapper['config'].items())
|
||||
mapper['config'] = {k: v[0] for k, v in mapper['config'].items()}
|
||||
return compcopy
|
||||
|
||||
|
||||
|
|
@ -760,8 +811,10 @@ def main():
|
|||
priority=dict(type='int', default=0),
|
||||
rdnLDAPAttribute=dict(type='str'),
|
||||
readTimeout=dict(type='int'),
|
||||
referral=dict(type='str', choices=['ignore', 'follow']),
|
||||
searchScope=dict(type='str', choices=['1', '2'], default='1'),
|
||||
serverPrincipal=dict(type='str'),
|
||||
krbPrincipalAttribute=dict(type='str'),
|
||||
startTls=dict(type='bool', default=False),
|
||||
syncRegistrations=dict(type='bool', default=False),
|
||||
trustEmail=dict(type='bool', default=False),
|
||||
|
|
@ -792,9 +845,11 @@ def main():
|
|||
realm=dict(type='str', default='master'),
|
||||
id=dict(type='str'),
|
||||
name=dict(type='str'),
|
||||
provider_id=dict(type='str', aliases=['providerId'], choices=['ldap', 'kerberos', 'sssd']),
|
||||
provider_id=dict(type='str', aliases=['providerId']),
|
||||
provider_type=dict(type='str', aliases=['providerType'], default='org.keycloak.storage.UserStorageProvider'),
|
||||
parent_id=dict(type='str', aliases=['parentId']),
|
||||
remove_unspecified_mappers=dict(type='bool', default=True),
|
||||
bind_credential_update_mode=dict(type='str', default='always', choices=['always', 'only_indirect']),
|
||||
mappers=dict(type='list', elements='dict', options=mapper_spec),
|
||||
)
|
||||
|
||||
|
|
@ -825,19 +880,26 @@ def main():
|
|||
|
||||
# Keycloak API expects config parameters to be arrays containing a single string element
|
||||
if config is not None:
|
||||
module.params['config'] = dict((k, [str(v).lower() if not isinstance(v, str) else v])
|
||||
for k, v in config.items() if config[k] is not None)
|
||||
module.params['config'] = {
|
||||
k: [str(v).lower() if not isinstance(v, str) else v]
|
||||
for k, v in config.items()
|
||||
if config[k] is not None
|
||||
}
|
||||
|
||||
if mappers is not None:
|
||||
for mapper in mappers:
|
||||
if mapper.get('config') is not None:
|
||||
mapper['config'] = dict((k, [str(v).lower() if not isinstance(v, str) else v])
|
||||
for k, v in mapper['config'].items() if mapper['config'][k] is not None)
|
||||
mapper['config'] = {
|
||||
k: [str(v).lower() if not isinstance(v, str) else v]
|
||||
for k, v in mapper['config'].items()
|
||||
if mapper['config'][k] is not None
|
||||
}
|
||||
|
||||
# Filter and map the parameters names that apply
|
||||
comp_params = [x for x in module.params
|
||||
if x not in list(keycloak_argument_spec().keys()) + ['state', 'realm', 'mappers'] and
|
||||
module.params.get(x) is not None]
|
||||
if x not in list(keycloak_argument_spec().keys())
|
||||
+ ['state', 'realm', 'mappers', 'remove_unspecified_mappers', 'bind_credential_update_mode']
|
||||
and module.params.get(x) is not None]
|
||||
|
||||
# See if it already exists in Keycloak
|
||||
if cid is None:
|
||||
|
|
@ -855,7 +917,9 @@ def main():
|
|||
|
||||
# if user federation exists, get associated mappers
|
||||
if cid is not None and before_comp:
|
||||
before_comp['mappers'] = sorted(kc.get_components(urlencode(dict(parent=cid)), realm), key=lambda x: x.get('name'))
|
||||
before_comp['mappers'] = sorted(kc.get_components(urlencode(dict(parent=cid)), realm), key=lambda x: x.get('name') or '')
|
||||
|
||||
normalize_kc_comp(before_comp)
|
||||
|
||||
# Build a proposed changeset from parameters given to this module
|
||||
changeset = {}
|
||||
|
|
@ -864,7 +928,7 @@ def main():
|
|||
new_param_value = module.params.get(param)
|
||||
old_value = before_comp[camel(param)] if camel(param) in before_comp else None
|
||||
if param == 'mappers':
|
||||
new_param_value = [dict((k, v) for k, v in x.items() if x[k] is not None) for x in new_param_value]
|
||||
new_param_value = [{k: v for k, v in x.items() if v is not None} for x in new_param_value]
|
||||
if new_param_value != old_value:
|
||||
changeset[camel(param)] = new_param_value
|
||||
|
||||
|
|
@ -873,17 +937,17 @@ def main():
|
|||
if module.params['provider_id'] in ['kerberos', 'sssd']:
|
||||
module.fail_json(msg='Cannot configure mappers for {type} provider.'.format(type=module.params['provider_id']))
|
||||
for change in module.params['mappers']:
|
||||
change = dict((k, v) for k, v in change.items() if change[k] is not None)
|
||||
change = {k: v for k, v in change.items() if v is not None}
|
||||
if change.get('id') is None and change.get('name') is None:
|
||||
module.fail_json(msg='Either `name` or `id` has to be specified on each mapper.')
|
||||
if cid is None:
|
||||
old_mapper = {}
|
||||
elif change.get('id') is not None:
|
||||
old_mapper = kc.get_component(change['id'], realm)
|
||||
old_mapper = next((before_mapper for before_mapper in before_comp.get('mappers', []) if before_mapper["id"] == change['id']), None)
|
||||
if old_mapper is None:
|
||||
old_mapper = {}
|
||||
else:
|
||||
found = kc.get_components(urlencode(dict(parent=cid, name=change['name'])), realm)
|
||||
found = [before_mapper for before_mapper in before_comp.get('mappers', []) if before_mapper['name'] == change['name']]
|
||||
if len(found) > 1:
|
||||
module.fail_json(msg='Found multiple mappers with name `{name}`. Cannot continue.'.format(name=change['name']))
|
||||
if len(found) == 1:
|
||||
|
|
@ -892,10 +956,16 @@ def main():
|
|||
old_mapper = {}
|
||||
new_mapper = old_mapper.copy()
|
||||
new_mapper.update(change)
|
||||
if new_mapper != old_mapper:
|
||||
if changeset.get('mappers') is None:
|
||||
changeset['mappers'] = list()
|
||||
changeset['mappers'].append(new_mapper)
|
||||
# changeset contains all desired mappers: those existing, to update or to create
|
||||
if changeset.get('mappers') is None:
|
||||
changeset['mappers'] = list()
|
||||
changeset['mappers'].append(new_mapper)
|
||||
changeset['mappers'] = sorted(changeset['mappers'], key=lambda x: x.get('name') or '')
|
||||
|
||||
# to keep unspecified existing mappers we add them to the desired mappers list, unless they're already present
|
||||
if not module.params['remove_unspecified_mappers'] and 'mappers' in before_comp:
|
||||
changeset_mapper_ids = [mapper['id'] for mapper in changeset['mappers'] if 'id' in mapper]
|
||||
changeset['mappers'].extend([mapper for mapper in before_comp['mappers'] if mapper['id'] not in changeset_mapper_ids])
|
||||
|
||||
# Prepare the desired values using the existing values (non-existence results in a dict that is save to use as a basis)
|
||||
desired_comp = before_comp.copy()
|
||||
|
|
@ -918,50 +988,68 @@ def main():
|
|||
# Process a creation
|
||||
result['changed'] = True
|
||||
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after=sanitize(desired_comp))
|
||||
|
||||
if module.check_mode:
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after=sanitize(desired_comp))
|
||||
module.exit_json(**result)
|
||||
|
||||
# create it
|
||||
desired_comp = desired_comp.copy()
|
||||
updated_mappers = desired_comp.pop('mappers', [])
|
||||
desired_mappers = desired_comp.pop('mappers', [])
|
||||
after_comp = kc.create_component(desired_comp, realm)
|
||||
|
||||
cid = after_comp['id']
|
||||
updated_mappers = []
|
||||
# when creating a user federation, keycloak automatically creates default mappers
|
||||
default_mappers = kc.get_components(urlencode(dict(parent=cid)), realm)
|
||||
|
||||
for mapper in updated_mappers:
|
||||
found = kc.get_components(urlencode(dict(parent=cid, name=mapper['name'])), realm)
|
||||
# create new mappers or update existing default mappers
|
||||
for desired_mapper in desired_mappers:
|
||||
found = [default_mapper for default_mapper in default_mappers if default_mapper['name'] == desired_mapper['name']]
|
||||
if len(found) > 1:
|
||||
module.fail_json(msg='Found multiple mappers with name `{name}`. Cannot continue.'.format(name=mapper['name']))
|
||||
module.fail_json(msg='Found multiple mappers with name `{name}`. Cannot continue.'.format(name=desired_mapper['name']))
|
||||
if len(found) == 1:
|
||||
old_mapper = found[0]
|
||||
else:
|
||||
old_mapper = {}
|
||||
|
||||
new_mapper = old_mapper.copy()
|
||||
new_mapper.update(mapper)
|
||||
new_mapper.update(desired_mapper)
|
||||
|
||||
if new_mapper.get('id') is not None:
|
||||
kc.update_component(new_mapper, realm)
|
||||
updated_mappers.append(new_mapper)
|
||||
else:
|
||||
if new_mapper.get('parentId') is None:
|
||||
new_mapper['parentId'] = after_comp['id']
|
||||
mapper = kc.create_component(new_mapper, realm)
|
||||
new_mapper['parentId'] = cid
|
||||
updated_mappers.append(kc.create_component(new_mapper, realm))
|
||||
|
||||
after_comp['mappers'] = updated_mappers
|
||||
if module.params['remove_unspecified_mappers']:
|
||||
# we remove all unwanted default mappers
|
||||
# we use ids so we dont accidently remove one of the previously updated default mapper
|
||||
for default_mapper in default_mappers:
|
||||
if not default_mapper['id'] in [x['id'] for x in updated_mappers]:
|
||||
kc.delete_component(default_mapper['id'], realm)
|
||||
|
||||
after_comp['mappers'] = kc.get_components(urlencode(dict(parent=cid)), realm)
|
||||
normalize_kc_comp(after_comp)
|
||||
if module._diff:
|
||||
result['diff'] = dict(before='', after=sanitize(after_comp))
|
||||
result['end_state'] = sanitize(after_comp)
|
||||
|
||||
result['msg'] = "User federation {id} has been created".format(id=after_comp['id'])
|
||||
result['msg'] = "User federation {id} has been created".format(id=cid)
|
||||
module.exit_json(**result)
|
||||
|
||||
else:
|
||||
if state == 'present':
|
||||
# Process an update
|
||||
|
||||
desired_copy = deepcopy(desired_comp)
|
||||
before_copy = deepcopy(before_comp)
|
||||
# exclude bindCredential when checking wether an update is required, therefore
|
||||
# updating it only if there are other changes
|
||||
if module.params['bind_credential_update_mode'] == 'only_indirect':
|
||||
desired_copy.get('config', []).pop('bindCredential', None)
|
||||
before_copy.get('config', []).pop('bindCredential', None)
|
||||
# no changes
|
||||
if desired_comp == before_comp:
|
||||
if desired_copy == before_copy:
|
||||
result['changed'] = False
|
||||
result['end_state'] = sanitize(desired_comp)
|
||||
result['msg'] = "No changes required to user federation {id}.".format(id=cid)
|
||||
|
|
@ -977,22 +1065,33 @@ def main():
|
|||
module.exit_json(**result)
|
||||
|
||||
# do the update
|
||||
desired_comp = desired_comp.copy()
|
||||
updated_mappers = desired_comp.pop('mappers', [])
|
||||
desired_mappers = desired_comp.pop('mappers', [])
|
||||
kc.update_component(desired_comp, realm)
|
||||
after_comp = kc.get_component(cid, realm)
|
||||
|
||||
for mapper in updated_mappers:
|
||||
for before_mapper in before_comp.get('mappers', []):
|
||||
# remove unwanted existing mappers that will not be updated
|
||||
if not before_mapper['id'] in [x['id'] for x in desired_mappers if 'id' in x]:
|
||||
kc.delete_component(before_mapper['id'], realm)
|
||||
|
||||
for mapper in desired_mappers:
|
||||
if mapper in before_comp.get('mappers', []):
|
||||
continue
|
||||
if mapper.get('id') is not None:
|
||||
kc.update_component(mapper, realm)
|
||||
else:
|
||||
if mapper.get('parentId') is None:
|
||||
mapper['parentId'] = desired_comp['id']
|
||||
mapper = kc.create_component(mapper, realm)
|
||||
|
||||
after_comp['mappers'] = updated_mappers
|
||||
result['end_state'] = sanitize(after_comp)
|
||||
kc.create_component(mapper, realm)
|
||||
|
||||
after_comp = kc.get_component(cid, realm)
|
||||
after_comp['mappers'] = sorted(kc.get_components(urlencode(dict(parent=cid)), realm), key=lambda x: x.get('name') or '')
|
||||
normalize_kc_comp(after_comp)
|
||||
after_comp_sanitized = sanitize(after_comp)
|
||||
before_comp_sanitized = sanitize(before_comp)
|
||||
result['end_state'] = after_comp_sanitized
|
||||
if module._diff:
|
||||
result['diff'] = dict(before=before_comp_sanitized, after=after_comp_sanitized)
|
||||
result['changed'] = before_comp_sanitized != after_comp_sanitized
|
||||
result['msg'] = "User federation {id} has been updated".format(id=cid)
|
||||
module.exit_json(**result)
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ Role Defaults
|
|||
|`keycloak_management_http_port`| Management port | `9990` |
|
||||
|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_client_public`| Configure a public realm client | `True` |
|
||||
|`keycloak_client_web_origins`| Web origins for realm client | `+` |
|
||||
|`keycloak_client_web_origins`| Web origins for realm client | `/*` |
|
||||
|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` |
|
||||
|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` |
|
||||
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ keycloak_client_default_roles: []
|
|||
keycloak_client_public: true
|
||||
|
||||
# allowed web origins for the client
|
||||
keycloak_client_web_origins: '+'
|
||||
keycloak_client_web_origins: '/*'
|
||||
|
||||
# list of user and role mappings to create in the client
|
||||
# Each user has the form:
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@ argument_specs:
|
|||
type: "bool"
|
||||
keycloak_client_web_origins:
|
||||
# line 42 of keycloak_realm/defaults/main.yml
|
||||
default: "+"
|
||||
default: "/*"
|
||||
description: "Web origins for realm client"
|
||||
type: "str"
|
||||
keycloak_client_users:
|
||||
|
|
|
|||
|
|
@ -82,7 +82,7 @@
|
|||
base_url: "{{ item.base_url | default('') }}"
|
||||
enabled: "{{ item.enabled | default(True) }}"
|
||||
redirect_uris: "{{ item.redirect_uris | default(omit) }}"
|
||||
web_origins: "{{ item.web_origins | default('+') }}"
|
||||
web_origins: "{{ item.web_origins | default(omit) }}"
|
||||
bearer_only: "{{ item.bearer_only | default(omit) }}"
|
||||
standard_flow_enabled: "{{ item.standard_flow_enabled | default(omit) }}"
|
||||
implicit_flow_enabled: "{{ item.implicit_flow_enabled | default(omit) }}"
|
||||
|
|
@ -92,7 +92,7 @@
|
|||
protocol: "{{ item.protocol | default(omit) }}"
|
||||
attributes: "{{ item.attributes | default(omit) }}"
|
||||
state: present
|
||||
no_log: "{{ keycloak_no_log | default('True') }}"
|
||||
no_log: "{{ keycloak_no_log | default('false') }}"
|
||||
register: create_client_result
|
||||
loop: "{{ keycloak_clients | flatten }}"
|
||||
when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined)
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue