# keycloak_authentication – Configure authentication in Keycloak — Keycloak Ansible Collection documentation

# keycloak_authentication – Configure authentication in Keycloak

Note

This module is part of the middleware_automation.keycloak collection.

It is not included in `ansible-core`. To check whether it is installed, run `ansible-galaxy collection list`.

To install it, use: `ansible-galaxy collection install middleware_automation.keycloak`.

To use it in a playbook, specify: `middleware_automation.keycloak.keycloak_authentication`.

New in middleware_automation.keycloak 3.0.0

## Synopsis

- This module actually can only make a copy of an existing authentication flow, add an execution to it and configure it.

- It can also delete the flow.

## Parameters

Parameter | Comments
--- | ---
alias string / required | Alias for the authentication flow.
auth_client_id string | OpenID Connect client_id to authenticate to the API with. Default: `"admin-cli"`
auth_client_secret string | Client Secret to use in conjunction with auth_client_id (if required).
auth_keycloak_url aliases: url string / required | URL to the Keycloak instance.
auth_password aliases: password string | Password to authenticate for API access with.
auth_realm string | Keycloak realm name to authenticate to for API access.
auth_username aliases: username string | Username to authenticate for API access with.
authenticationExecutions list / elements=dictionary | Configuration structure for the executions.
authenticationConfig dictionary | Describe the config of the authentication.
displayName string | Name of the execution or subflow to create or update.
flowAlias string | Alias of parent flow.
index integer | Priority order of the execution.
providerId string | `providerID` for the new flow when not copied from an existing flow.

requirement

string

Control status of the subflow or execution.

Choices:

- `"REQUIRED"`

- `"ALTERNATIVE"`

- `"DISABLED"`

- `"CONDITIONAL"`

subFlowType

string

For new subflows, optionally specify the type.

Is only used at creation.

Choices:

- `"basic-flow"` ← (default)

- `"form-flow"`

connection_timeout integer | Controls the HTTP connections timeout period (in seconds) to Keycloak API. Default: `10`
copyFrom string | `flowAlias` of the authentication flow to use for the copy.
description string | Description of the flow.

force

boolean

If `true`, allows to remove the authentication flow and recreate it.

Choices:

- `false` ← (default)

- `true`

http_agent string | Configures the HTTP User-Agent header. Default: `"Ansible"`

providerId

string

`providerId` for the new flow when not copied from an existing flow.

Choices:

- `"basic-flow"`

- `"client-flow"`

realm string / required | The name of the realm in which is the authentication.
refresh_token string | Authentication refresh token for Keycloak API.

state

string

Control if the authentication flow must exists or not.

Choices:

- `"present"` ← (default)

- `"absent"`

token string | Authentication token for Keycloak API.

validate_certs

boolean

Verify TLS certificates (do not disable this in production).

Choices:

- `false`

- `true` ← (default)

## Attributes

Attribute | Support | Description
--- | --- | ---
action_group | Action group: middleware_automation.keycloak.keycloak added in middleware_automation.keycloak 3.0.0 | Use `group/middleware_automation.keycloak.keycloak` in `module_defaults` to set defaults for this module.
check_mode | Support: full | Can run in `check_mode` and return changed status prediction without modifying target.
diff_mode | Support: full | Will return details on what has changed (or possibly needs changing in `check_mode`), when in diff mode.

## Examples

    - name: Create an authentication flow from first broker login and add an execution to it.
      middleware_automation.keycloak.keycloak_authentication:
        auth_keycloak_url: http://localhost:8080
        auth_realm: master
        auth_username: admin
        auth_password: password
        realm: master
        alias: "Copy of first broker login"
        copyFrom: "first broker login"
        authenticationExecutions:
          - providerId: "test-execution1"
            requirement: "REQUIRED"
            authenticationConfig:
              alias: "test.execution1.property"
              config:
              test1.property: "value"
          - providerId: "test-execution2"
            requirement: "REQUIRED"
            authenticationConfig:
              alias: "test.execution2.property"
              config:
              test2.property: "value"
        state: present

    - name: Re-create the authentication flow
      middleware_automation.keycloak.keycloak_authentication:
        auth_keycloak_url: http://localhost:8080
        auth_realm: master
        auth_username: admin
        auth_password: password
        realm: master
        alias: "Copy of first broker login"
        copyFrom: "first broker login"
        authenticationExecutions:
          - providerId: "test-provisioning"
            requirement: "REQUIRED"
            authenticationConfig:
              alias: "test.provisioning.property"
              config:
              test.provisioning.property: "value"
        state: present
        force: true

    - name: Create an authentication flow with subflow containing an execution.
      middleware_automation.keycloak.keycloak_authentication:
        auth_keycloak_url: http://localhost:8080
        auth_realm: master
        auth_username: admin
        auth_password: password
        realm: master
        alias: "Copy of first broker login"
        copyFrom: "first broker login"
        authenticationExecutions:
          - providerId: "test-execution1"
            requirement: "REQUIRED"
          - displayName: "New Subflow"
            requirement: "REQUIRED"
          - providerId: "auth-cookie"
            requirement: "REQUIRED"
            flowAlias: "New Sublow"
        state: present

    - name: Remove authentication.
      middleware_automation.keycloak.keycloak_authentication:
        auth_keycloak_url: http://localhost:8080
        auth_realm: master
        auth_username: admin
        auth_password: password
        realm: master
        alias: "Copy of first broker login"
        state: absent

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Description
--- | ---

end_state

dictionary

Representation of the authentication after module execution.

Returned: on success

Sample: `{"alias": "Copy of first broker login", "authenticationExecutions": [{"alias": "review profile config", "authenticationConfig": {"alias": "review profile config", "config": {"update.profile.on.first.login": "missing"}, "id": "6f09e4fb-aad4-496a-b873-7fa9779df6d7"}, "configurable": true, "displayName": "Review Profile", "id": "8f77dab8-2008-416f-989e-88b09ccf0b4c", "index": 0, "level": 0, "providerId": "idp-review-profile", "requirement": "REQUIRED", "requirementChoices": ["REQUIRED", "ALTERNATIVE", "DISABLED"]}], "builtIn": false, "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", "id": "bc228863-5887-4297-b898-4d988f8eaa5c", "providerId": "basic-flow", "topLevel": true}`

msg string | Message as to what action was taken. Returned: always

### Authors

- Philippe Gauthier (@elfelip)

- Gaëtan Daubresse (@Gaetan2907)