# keycloak_authz_custom_policy – Allows administration of Keycloak client custom Javascript policies using Keycloak API — Keycloak Ansible Collection documentation

# keycloak_authz_custom_policy – Allows administration of Keycloak client custom Javascript policies using Keycloak API

Note

This module is part of the middleware_automation.keycloak collection.

It is not included in `ansible-core`. To check whether it is installed, run `ansible-galaxy collection list`.

To install it, use: `ansible-galaxy collection install middleware_automation.keycloak`.

To use it in a playbook, specify: `middleware_automation.keycloak.keycloak_authz_custom_policy`.

New in middleware_automation.keycloak 3.0.0

## Synopsis

- This module allows the administration of Keycloak client custom Javascript using the Keycloak REST API. Custom Javascript policies are only available if a client has Authorization enabled and if they have been deployed to the Keycloak server as JAR files.

- This module requires access to the REST API using OpenID Connect; the user connecting and the realm being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate realm definition with the scope tailored to your needs and a user having the expected roles.

- The names of module options are snake_cased versions of the camelCase options used by Keycloak. The Authorization Services paths and payloads have not officially been documented by the Keycloak project. https://www.puppeteers.net/blog/keycloak-authorization-services-rest-api-paths-and-payload/.

## Parameters

Parameter | Comments
--- | ---
auth_client_id string | OpenID Connect client_id to authenticate to the API with. Default: `"admin-cli"`
auth_client_secret string | Client Secret to use in conjunction with auth_client_id (if required).
auth_keycloak_url aliases: url string / required | URL to the Keycloak instance.
auth_password aliases: password string | Password to authenticate for API access with.
auth_realm string | Keycloak realm name to authenticate to for API access.
auth_username aliases: username string | Username to authenticate for API access with.
client_id string / required | The `clientId` of the Keycloak client that should have the custom policy attached to it. This is usually a human-readable name of the Keycloak client.
connection_timeout integer | Controls the HTTP connections timeout period (in seconds) to Keycloak API. Default: `10`
http_agent string | Configures the HTTP User-Agent header. Default: `"Ansible"`
name string / required | Name of the custom policy to create.
policy_type string / required | The type of the policy. This must match the name of the custom policy deployed to the server. Multiple policies pointing to the same policy type can be created, but their names have to differ.
realm string / required | The name of the Keycloak realm the Keycloak client is in.
refresh_token string | Authentication refresh token for Keycloak API.

state

string

State of the custom policy.

On `present`, the custom policy is created (or updated if it exists already).

On `absent`, the custom policy is removed if it exists.

Choices:

- `"present"` ← (default)

- `"absent"`

token string | Authentication token for Keycloak API.

validate_certs

boolean

Verify TLS certificates (do not disable this in production).

Choices:

- `false`

- `true` ← (default)

## Attributes

Attribute | Support | Description
--- | --- | ---
action_group | Action group: middleware_automation.keycloak.keycloak added in middleware_automation.keycloak 3.0.0 | Use `group/middleware_automation.keycloak.keycloak` in `module_defaults` to set defaults for this module.
check_mode | Support: full | Can run in `check_mode` and return changed status prediction without modifying target.
diff_mode | Support: none | Will return details on what has changed (or possibly needs changing in `check_mode`), when in diff mode.

## Examples

    - name: Manage Keycloak custom authorization policy
      middleware_automation.keycloak.keycloak_authz_custom_policy:
        name: OnlyOwner
        state: present
        policy_type: script-policy.js
        client_id: myclient
        realm: myrealm
        auth_keycloak_url: http://localhost:8080
        auth_username: keycloak
        auth_password: keycloak
        auth_realm: master

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Description
--- | ---
end_state dictionary | Representation of the custom policy after module execution. Returned: on success
name string | Name of the custom policy. Returned: when state=present Sample: `"file:delete"`
policy_type string | Type of custom policy. Returned: when state=present Sample: `"File delete"`
msg string | Message as to what action was taken. Returned: always

### Authors

- Samuli Seppänen (@mattock)