# keycloak_clientsecret_regenerate – Regenerate Keycloak client secret using Keycloak API — Keycloak Ansible Collection documentation

# keycloak_clientsecret_regenerate – Regenerate Keycloak client secret using Keycloak API

Note

This module is part of the middleware_automation.keycloak collection.

It is not included in `ansible-core`. To check whether it is installed, run `ansible-galaxy collection list`.

To install it, use: `ansible-galaxy collection install middleware_automation.keycloak`.

To use it in a playbook, specify: `middleware_automation.keycloak.keycloak_clientsecret_regenerate`.

New in middleware_automation.keycloak 3.0.0

## Synopsis

- This module allows you to regenerate a Keycloak client secret using the Keycloak REST API. It requires access to the REST API using OpenID Connect; the user connecting and the client being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate client definition with the scope tailored to your needs and a user having the expected roles.

- When regenerating a client secret, where possible provide the client’s ID (not client_id) to the module. This removes a lookup to the API to translate the client_id into the client ID.

- Note that this module returns the client secret. To avoid this showing up in the logs, please add `no_log: true` to the task.

## Parameters

Parameter | Comments
--- | ---
auth_client_id string | OpenID Connect client_id to authenticate to the API with. Default: `"admin-cli"`
auth_client_secret string | Client Secret to use in conjunction with auth_client_id (if required).
auth_keycloak_url aliases: url string / required | URL to the Keycloak instance.
auth_password aliases: password string | Password to authenticate for API access with.
auth_realm string | Keycloak realm name to authenticate to for API access.
auth_username aliases: username string | Username to authenticate for API access with.
client_id aliases: clientId string | The client_id of the client. Passing this instead of ID results in an extra API call.
connection_timeout integer | Controls the HTTP connections timeout period (in seconds) to Keycloak API. Default: `10`
http_agent string | Configures the HTTP User-Agent header. Default: `"Ansible"`
id string | The unique identifier for this client. This parameter is not required for getting or generating a client secret but providing it reduces the number of API calls required.
realm string | They Keycloak realm under which this client resides. Default: `"master"`
refresh_token string | Authentication refresh token for Keycloak API.
token string | Authentication token for Keycloak API.

validate_certs

boolean

Verify TLS certificates (do not disable this in production).

Choices:

- `false`

- `true` ← (default)

## Attributes

Attribute | Support | Description
--- | --- | ---
action_group | Action group: middleware_automation.keycloak.keycloak added in middleware_automation.keycloak 3.0.0 | Use `group/middleware_automation.keycloak.keycloak` in `module_defaults` to set defaults for this module.
check_mode | Support: full | Can run in `check_mode` and return changed status prediction without modifying target.
diff_mode | Support: none | Will return details on what has changed (or possibly needs changing in `check_mode`), when in diff mode.

## Examples

    - name: Regenerate a Keycloak client secret, authentication with credentials
      middleware_automation.keycloak.keycloak_clientsecret_regenerate:
        id: '9d59aa76-2755-48c6-b1af-beb70a82c3cd'
        realm: MyCustomRealm
        auth_client_id: admin-cli
        auth_keycloak_url: https://auth.example.com
        auth_realm: master
        auth_username: USERNAME
        auth_password: PASSWORD
      delegate_to: localhost
      no_log: true

    - name: Regenerate a Keycloak client secret, authentication with token
      middleware_automation.keycloak.keycloak_clientsecret_regenerate:
        id: '9d59aa76-2755-48c6-b1af-beb70a82c3cd'
        realm: MyCustomRealm
        auth_client_id: admin-cli
        auth_keycloak_url: https://auth.example.com
        token: TOKEN
      delegate_to: localhost
      no_log: true

    - name: Regenerate a Keycloak client secret, passing client_id instead of id
      middleware_automation.keycloak.keycloak_clientsecret_info:
        client_id: 'myClientId'
        realm: MyCustomRealm
        auth_client_id: admin-cli
        auth_keycloak_url: https://auth.example.com
        token: TOKEN
      delegate_to: localhost
      no_log: true

    - name: Regenerate a new Keycloak client secret, authentication with auth_client_id and auth_client_secret
      middleware_automation.keycloak.keycloak_clientsecret_regenerate:
        id: '9d59aa76-2755-48c6-b1af-beb70a82c3cd'
        realm: MyCustomRealm
        auth_client_id: admin-cli
        auth_client_secret: SECRET
        auth_keycloak_url: https://auth.example.com
      delegate_to: localhost
      no_log: true

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Description
--- | ---
end_state complex | Representation of the client credential after module execution. Returned: on success
type string | Credential type. Returned: always Sample: `"secret"`
value string | Client secret. Returned: always Sample: `"cUGnX1EIeTtPPAkcyGMv0ncyqDPu68P1"`
msg string | Message as to what action was taken. Returned: always

### Authors

- Fynn Chen (@fynncfchen)

- John Cant (@johncant)