---
-collections:
- - name: middleware_automation.keycloak
+---
+collections:
+ - name: middleware_automation.keycloak
The keycloak collection also depends on the following python packages to be present on the controller host:
@@ -173,7 +173,7 @@
Install from controller node (local source)
Making the keycloak zip archive (or the RHSSO zip archive), available to the playbook repository root directory, and setting keycloak_offline_install to True, allows to skip
the download tasks. The local path for the archive matches the downloaded archive path, so it is also used as a cache when multiple hosts are provisioned in a cluster.
-keycloak_offline_install: True
+keycloak_offline_install: True
And depending on keycloak_rhsso_enable:
@@ -185,11 +185,11 @@ the download tasks. The local path for the archive matches the downloaded archiv
Install from alternate sources (like corporate Nexus, artifactory, proxy, etc)
For RHSSO:
-sso_download_url: "https://<internal-nexus.private.net>/<path>/<to>/rh-sso-x.y.z-server-dist.zip"
+sso_download_url: "https://<internal-nexus.private.net>/<path>/<to>/rh-sso-x.y.z-server-dist.zip"
For keycloak:
-keycloak_download_url: "https://<internal-nexus.private.net>/<path>/<to>/keycloak-x.y.zip"
+keycloak_download_url: "https://<internal-nexus.private.net>/<path>/<to>/keycloak-x.y.zip"
Example installation command
Execute the following command from the source root directory
-ansible-playbook -i <ansible_hosts> -e @rhn-creds.yml playbooks/keycloak.yml -e keycloak_admin_password=<changeme>
+ansible-playbook -i <ansible_hosts> -e @rhn-creds.yml playbooks/keycloak.yml -e keycloak_admin_password=<changeme>
keycloak_admin_password Password for the administration console user account.
ansible_hosts is the inventory, below is an example inventory for deploying to localhost
-[keycloak]
-localhost ansible_connection=local
+[keycloak]
+localhost ansible_connection=local
Example configuration command
Execute the following command from the source root directory:
-ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_admin_password=<changeme> -e keycloak_realm=test
+ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_admin_password=<changeme> -e keycloak_realm=test
keycloak_admin_password password for the administration console user account.
keycloak_realm name of the realm to be created/used.
ansible_hosts is the inventory, below is an example inventory for deploying to localhost
-[keycloak]
-localhost ansible_connection=local
+[keycloak]
+localhost ansible_connection=local
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
---
-- hosts: ...
- vars:
- keycloak_admin_password: "remembertochangeme"
- collections:
- - middleware_automation.keycloak
- roles:
- - middleware_automation.keycloak.keycloak
+---
+- hosts: ...
+ vars:
+ keycloak_admin_password: "remembertochangeme"
+ collections:
+ - middleware_automation.keycloak
+ roles:
+ - middleware_automation.keycloak.keycloak
-
---
-- hosts: ...
- collections:
- - middleware_automation.keycloak
- tasks:
- - name: Include keycloak role
- include_role:
- name: keycloak
- vars:
- keycloak_admin_password: "remembertochangeme"
- keycloak_offline_install: True
- # This should be the filename of keycloak archive on Ansible node: keycloak-16.1.0.zip
+---
+- hosts: ...
+ collections:
+ - middleware_automation.keycloak
+ tasks:
+ - name: Include keycloak role
+ include_role:
+ name: keycloak
+ vars:
+ keycloak_admin_password: "remembertochangeme"
+ keycloak_offline_install: True
+ # This should be the filename of keycloak archive on Ansible node: keycloak-16.1.0.zip
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
- realm: <name of the realm in which user federation should be configured, required>
- name: <name of the user federation provider, required>
- provider_id: <type of the user federation provider, required>
- provider_type: <Provider Type, default is set to org.keycloak.storage.UserStorageProvider>
- config: <dictionary of supported configuration values, required>
- mappers: <list of supported configuration values, required>
+ - realm: <name of the realm in which user federation should be configured, required>
+ name: <name of the user federation provider, required>
+ provider_id: <type of the user federation provider, required>
+ provider_type: <Provider Type, default is set to org.keycloak.storage.UserStorageProvider>
+ config: <dictionary of supported configuration values, required>
+ mappers: <list of supported configuration values, required>
Refer to docs for information on supported variables.
-
- name: <name of the client>
- id: <id of the client>
- client_id: <id of the client>
- roles: <keycloak_client_default_roles>
- realm: <name of the realm that contains the client>
- public_client: <true for public, false for confidential>
- web_origins: <list of allowed we origins for the client>
- users: <keycloak_client_users>
+ - name: <name of the client>
+ id: <id of the client>
+ client_id: <id of the client>
+ roles: <keycloak_client_default_roles>
+ realm: <name of the realm that contains the client>
+ public_client: <true for public, false for confidential>
+ web_origins: <list of allowed we origins for the client>
+ users: <keycloak_client_users>
name and either id or client_id are required.
-
- username: <username, required>
- password: <password, required>
- firstName: <firstName, optional>
- lastName: <lastName, optional>
- email: <email, optional>
- client_roles: <list of client user/role mappings>
+ - username: <username, required>
+ password: <password, required>
+ firstName: <firstName, optional>
+ lastName: <lastName, optional>
+ email: <email, optional>
+ client_roles: <list of client user/role mappings>
-
- client: <name of the client>
- role: <name of the role>
- realm: <name of the realm>
+ - client: <name of the client>
+ role: <name of the role>
+ realm: <name of the realm>
For a comprehensive example, refer to the playbook.
@@ -279,18 +279,18 @@
Example Playbook
The following is an example playbook that makes use of the role to create a realm in keycloak.
----
-- hosts: ...
- collections:
- - middleware_automation.keycloak
- tasks:
- - name: Include keycloak role
- include_role:
- name: keycloak_realm
- vars:
- keycloak_admin_password: "changeme"
- keycloak_realm: TestRealm
- keycloak_clients: [...]
+---
+- hosts: ...
+ collections:
+ - middleware_automation.keycloak
+ tasks:
+ - name: Include keycloak role
+ include_role:
+ name: keycloak_realm
+ vars:
+ keycloak_admin_password: "changeme"
+ keycloak_realm: TestRealm
+ keycloak_clients: [...]
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..
Continuous integration
The collection is tested with a molecule setup covering the included roles and verifying correct installation and idempotency.
In order to run the molecule tests locally with python 3.9 available, after cloning the repository:
-pip install yamllint 'molecule[docker]~=3.5.2' ansible-core flake8 ansible-lint voluptuous
-molecule test --all
+pip install yamllint 'molecule[docker]~=3.5.2' ansible-core flake8 ansible-lint voluptuous
+molecule test --all
Test playbooks
Sample playbooks are provided in the playbooks/ directory; to run the playbooks locally (requires a rhel system with python 3.9+, ansible, and systemd) the steps are as follows:
-# setup environment
-pip install ansible-core
-# clone the repository
-git clone https://github.com/ansible-middleware/keycloak
-cd keycloak
-# install collection dependencies
-ansible-galaxy collection install -r requirements.yml
-# install collection python deps
-pip install -r requirements.txt
-# create inventory for localhost
-cat << EOF > inventory
-[keycloak]
-localhost ansible_connection=local
-EOF
-# run the playbook
-ansible-playbook -i inventory playbooks/keycloak.yml
+# setup environment
+pip install ansible-core
+# clone the repository
+git clone https://github.com/ansible-middleware/keycloak
+cd keycloak
+# install collection dependencies
+ansible-galaxy collection install -r requirements.yml
+# install collection python deps
+pip install -r requirements.txt
+# create inventory for localhost
+cat << EOF > inventory
+[keycloak]
+localhost ansible_connection=local
+EOF
+# run the playbook
+ansible-playbook -i inventory playbooks/keycloak.yml
-
© Copyright 2022, Red Hat, Inc..
+
© Copyright 2023, Red Hat, Inc..