keycloak_clientscope_type – Set the type of aclientscope in realm or client using Keycloak API

Note

This module is part of the middleware_automation.keycloak collection.

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install middleware_automation.keycloak.

To use it in a playbook, specify: middleware_automation.keycloak.keycloak_clientscope_type.

New in middleware_automation.keycloak 3.0.0

Synopsis

• This module allows you to set the type (optional, default) of clientscopes using the Keycloak REST API. It requires access to the REST API using OpenID Connect; the user connecting and the client being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate client definition with the scope tailored to your needs and a user having the expected roles.

Parameters

Parameter	Comments
auth_client_id string	OpenID Connect client_id to authenticate to the API with. Default: "admin-cli"
auth_client_secret string	Client Secret to use in conjunction with auth_client_id (if required).
auth_keycloak_url aliases: url string / required	URL to the Keycloak instance.
auth_password aliases: password string	Password to authenticate for API access with.
auth_realm string	Keycloak realm name to authenticate to for API access.
auth_username aliases: username string	Username to authenticate for API access with.
client_id aliases: clientId string	The client_id of the client. If not set the clientscope types are set as a default for the realm.
connection_timeout integer	Controls the HTTP connections timeout period (in seconds) to Keycloak API. Default: 10
default_clientscopes list / elements=string	Client scopes that should be of type default.
http_agent string	Configures the HTTP User-Agent header. Default: "Ansible"
optional_clientscopes list / elements=string	Client scopes that should be of type optional.
realm string	The Keycloak realm. Default: "master"
refresh_token string	Authentication refresh token for Keycloak API.
token string	Authentication token for Keycloak API.
validate_certs boolean	Verify TLS certificates (do not disable this in production). Choices: false true ← (default)

Attributes

Attribute	Support	Description
action_group	Action group: middleware_automation.keycloak.keycloak added in middleware_automation.keycloak 3.0.0	Use group/middleware_automation.keycloak.keycloak in module_defaults to set defaults for this module.
check_mode	Support: full	Can run in check_mode and return changed status prediction without modifying target.
diff_mode	Support: full	Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Set default client scopes on realm level
  middleware_automation.keycloak.keycloak_clientscope_type:
    auth_client_id: admin-cli
    auth_keycloak_url: https://auth.example.com
    auth_realm: master
    auth_username: USERNAME
    auth_password: PASSWORD
    realm: "MyCustomRealm"
    default_clientscopes: ['profile', 'roles']
  delegate_to: localhost


- name: Set default and optional client scopes on client level with token auth
  middleware_automation.keycloak.keycloak_clientscope_type:
    auth_client_id: admin-cli
    auth_keycloak_url: https://auth.example.com
    token: TOKEN
    realm: "MyCustomRealm"
    client_id: "MyCustomClient"
    default_clientscopes: ['profile', 'roles']
    optional_clientscopes: ['phone']
  delegate_to: localhost

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
end_state dictionary	Representation of client scopes after module execution. The sample is truncated. Returned: on success Sample: {"default_clientscopes": ["profile", "role"], "optional_clientscopes": []}
existing dictionary	Representation of client scopes before module execution. Returned: always Sample: {"default_clientscopes": ["profile", "role"], "optional_clientscopes": ["phone"]}
msg string	Message as to what action was taken. Returned: always Sample: ""
proposed dictionary	Representation of proposed client-scope types mapping. Returned: always Sample: {"default_clientscopes": ["profile", "role"], "optional_clientscopes": []}

Authors

• Simon Pahl (@simonpahl)