internet/ansible-middleware.keycloak
3
0
Fork 0
mirror of https://github.com/ansible-middleware/keycloak.git synced 2026-08-01 04:14:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixing linting issues

Browse Source
This commit is contained in:
Ranabir Chakraborty
2026-06-25 00:52:44 +05:30
parent 86a6bc63bb
commit 728d5288ec
54 changed files with 449 additions and 444 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
roles/keycloak_realm/README.md
View File

@@ -10,18 +10,18 @@ Role Defaults
| Variable | Description | Default |
|:---------|:------------|:--------|
|`keycloak_admin_user`| Administration console user account | `admin` |
|`keycloak_host`| hostname | `localhost` |
|`keycloak_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
|`keycloak_http_port`| HTTP port | `8080` |
|`keycloak_https_port`| TLS HTTP port | `8443` |
|`keycloak_auth_realm`| Name of the main authentication realm | `master` |
|`keycloak_management_http_port`| Management port | `9990` |
|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|`keycloak_client_public`| Configure a public realm client | `True` |
|`keycloak_client_web_origins`| Web origins for realm client | `/*` |
|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` |
|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` |
|`keycloak_realm_admin_user`| Administration console user account | `admin` |
|`keycloak_realm_host`| hostname | `localhost` |
|`keycloak_realm_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
|`keycloak_realm_http_port`| HTTP port | `8080` |
|`keycloak_realm_https_port`| TLS HTTP port | `8443` |
|`keycloak_realm_auth_realm`| Name of the main authentication realm | `master` |
|`keycloak_realm_management_http_port`| Management port | `9990` |
|`keycloak_realm_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|`keycloak_realm_client_public`| Configure a public realm client | `True` |
|`keycloak_realm_client_web_origins`| Web origins for realm client | `/*` |
|`keycloak_realm_url`| URL for configuration rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port }}` |
|`keycloak_realm_management_url`| URL for management console rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port }}` |
Role Variables
@@ -31,30 +31,30 @@ The following are a set of _required_ variables for the role:
| Variable | Description |
|:---------|:------------|
|`keycloak_realm` | Name of the realm to be created |
|`keycloak_admin_password`| Password for the administration console user account |
|`keycloak_realm_realm` | Name of the realm to be created |
|`keycloak_realm_admin_password`| Password for the administration console user account |
The following variables are available for creating clients:
| Variable | Description | Default |
|:---------|:------------|:---------|
|`keycloak_clients` | List of _client_ declarations for the realm | `[]` |
|`keycloak_client_default_roles` | List of default role name for clients | `[]` |
|`keycloak_client_users` | List of user/role mappings for a client | `[]` |
|`keycloak_realm_clients` | List of _client_ declarations for the realm | `[]` |
|`keycloak_realm_client_default_roles` | List of default role name for clients | `[]` |
|`keycloak_realm_client_users` | List of user/role mappings for a client | `[]` |
The following variables are available for creating user federation:
| Variable | Description | Default |
|:---------|:------------|:---------|
|`keycloak_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
|`keycloak_realm_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
Variable formats
----------------
* `keycloak_user_federation`, a list of:
* `keycloak_realm_user_federation`, a list of:
```yaml
- realm: <name of the realm in which user federation should be configured, required>
@@ -68,24 +68,24 @@ Variable formats
Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables.
* `keycloak_clients`, a list of:
* `keycloak_realm_clients`, a list of:
```yaml
- name: <name of the client>
id: <id of the client>
client_id: <id of the client>
secret: <secret of the client (Optional)>
roles: <keycloak_client_default_roles>
roles: <keycloak_realm_client_default_roles>
realm: <name of the realm that contains the client>
public_client: <true for public, false for confidential>
web_origins: <list of allowed we origins for the client>
users: <keycloak_client_users>
users: <keycloak_realm_client_users>
```
`name` and either `id` or `client_id` are required.
* `keycloak_client_users`, a list of:
* `keycloak_realm_client_users`, a list of:
```yaml
- username: <username, required>
@@ -118,7 +118,7 @@ For features not covered by this role, the collection provides dedicated modules
| `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) |
| `keycloak_client` | Clients (also used internally by this role) |
| `keycloak_role` | Realm and client roles |
| `keycloak_user_federation` | User federations such as LDAP (also used internally by this role) |
| `keycloak_realm_user_federation` | User federations such as LDAP (also used internally by this role) |
Example Playbook

49
roles/keycloak_realm/defaults/main.yml
View File

@@ -1,18 +1,18 @@
---
### Keycloak configuration settings
keycloak_host: localhost
keycloak_http_port: 8080
keycloak_https_port: 8443
keycloak_management_http_port: 9990
keycloak_realm_host: localhost
keycloak_realm_http_port: 8080
keycloak_realm_https_port: 8443
keycloak_realm_management_http_port: 9990
### Keycloak administration console user
keycloak_admin_user: admin
keycloak_auth_realm: master
keycloak_auth_client: admin-cli
keycloak_context: ''
keycloak_realm_admin_user: admin
keycloak_realm_auth_realm: master
keycloak_realm_auth_client: admin-cli
keycloak_realm_context: ''
# administrator console password, this is a required variable
keycloak_admin_password: ''
keycloak_realm_admin_password: ''
### Keycloak realms, clients, roles, federation
# list of clients to create in the realm
@@ -26,35 +26,36 @@ keycloak_admin_password: ''
# and users is a list of account, see below for the format definition
# an empty name will skip the creation of the client
#
# keycloak_clients:
# keycloak_realm_clients:
# - name: ''
# roles: "{{ keycloak_client_default_roles }}"
# realm: "{{ keycloak_realm }}"
# public_client: "{{ keycloak_client_public }}"
# web_origins: "{{ keycloak_client_web_origins }}"
# redirect_uris: "{{ keycloak_client_redirect_uris }}"
# users: "{{ keycloak_client_users }}"
keycloak_clients: []
# roles: "{{ keycloak_realm_client_default_roles }}"
# realm: "{{ keycloak_realm_realm }}"
# public_client: "{{ keycloak_realm_client_public }}"
# web_origins: "{{ keycloak_realm_client_web_origins }}"
# redirect_uris: "{{ keycloak_realm_client_redirect_uris }}"
# users: "{{ keycloak_realm_client_users }}"
keycloak_realm_clients: []
# list of roles to create in the client
keycloak_client_default_roles: []
keycloak_realm_client_default_roles: []
# if True, create a public client; otherwise, a confidetial client
keycloak_client_public: true
keycloak_realm_client_public: true
# allowed web origins for the client
keycloak_client_web_origins: '/*'
keycloak_realm_client_web_origins: '/*'
# list of user and role mappings to create in the client
# Each user has the form:
# { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] }
# where each client_role has the form:
# { client: '', role: '', realm: '' }
keycloak_client_users: []
keycloak_realm_client_users: []
### List of Keycloak User Federation
keycloak_user_federation: []
keycloak_realm_user_federation: []
# other settings
keycloak_url: "http://{{ keycloak_host }}:{{ keycloak_http_port + (keycloak_jboss_port_offset | default(0)) }}"
keycloak_management_url: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + (keycloak_jboss_port_offset | default(0)) }}"
keycloak_realm_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
keycloak_realm_management_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
keycloak_realm_no_log: true

40
roles/keycloak_realm/meta/argument_specs.yml
View File

@@ -1,94 +1,94 @@
argument_specs:
main:
options:
keycloak_host:
keycloak_realm_host:
# line 3 of keycloak_realm/defaults/main.yml
default: "localhost"
description: "Hostname for rest calls"
type: "str"
keycloak_context:
keycloak_realm_context:
# line 5 of keycloak_realm/defaults/main.yml
default: ""
description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)"
type: "str"
keycloak_http_port:
keycloak_realm_http_port:
# line 4 of keycloak_realm/defaults/main.yml
default: 8080
description: "HTTP port"
type: "int"
keycloak_https_port:
keycloak_realm_https_port:
# line 5 of keycloak_realm/defaults/main.yml
default: 8443
description: "HTTPS port"
type: "int"
keycloak_management_http_port:
keycloak_realm_management_http_port:
# line 6 of keycloak_realm/defaults/main.yml
default: 9990
description: "Management port"
type: "int"
keycloak_admin_user:
keycloak_realm_admin_user:
# line 10 of keycloak_realm/defaults/main.yml
default: "admin"
description: "Administration console user account"
type: "str"
keycloak_auth_realm:
keycloak_realm_auth_realm:
# line 11 of keycloak_realm/defaults/main.yml
default: "master"
description: "Name of the main authentication realm"
type: "str"
keycloak_auth_client:
keycloak_realm_auth_client:
# line 12 of keycloak_realm/defaults/main.yml
default: "admin-cli"
description: "Authentication client for configuration REST calls"
type: "str"
keycloak_client_default_roles:
keycloak_realm_client_default_roles:
# line 36 of keycloak_realm/defaults/main.yml
default: "[]"
description: "List of roles to configure as client default"
type: "list"
keycloak_client_public:
keycloak_realm_client_public:
# line 39 of keycloak_realm/defaults/main.yml
default: true
description: "Configure a public realm client"
type: "bool"
keycloak_client_web_origins:
keycloak_realm_client_web_origins:
# line 42 of keycloak_realm/defaults/main.yml
default: "/*"
description: "Web origins for realm client"
type: "str"
keycloak_client_users:
keycloak_realm_client_users:
# line 49 of keycloak_realm/defaults/main.yml
default: "[]"
description: "List of users to configure in the realm client"
type: "list"
keycloak_user_federation:
keycloak_realm_user_federation:
# line 52 of keycloak_realm/defaults/main.yml
default: "[]"
description: "List of user federations to configure in the realm"
type: "list"
keycloak_admin_password:
keycloak_realm_admin_password:
# line 5 of keycloak_realm/vars/main.yml
required: true
description: "Password for the administration console user account"
type: "str"
keycloak_realm:
keycloak_realm_realm:
# line 8 of keycloak_realm/vars/main.yml
required: true
description: "Name of the realm to be configured"
type: "str"
keycloak_clients:
keycloak_realm_clients:
# line 11 of keycloak_realm/vars/main.yml
default: "[]"
description: "List of client declarations for the realm"
type: "list"
keycloak_url:
keycloak_realm_url:
# line 14 of keycloak_realm/vars/main.yml
default: "http://{{ keycloak_host }}:{{ keycloak_http_port + ( keycloak_jboss_port_offset | default(0) ) }}"
default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
description: "URL for configuration rest calls"
type: "str"
keycloak_management_url:
keycloak_realm_management_url:
# line 15 of keycloak_realm/vars/main.yml
default: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + ( keycloak_jboss_port_offset | default(0) ) }}"
default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
description: "URL for management console rest calls"
type: "str"
downstream:

64
roles/keycloak_realm/tasks/main.yml
View File

@@ -1,19 +1,19 @@
---
- name: Generate keycloak auth token
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
method: POST
body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password"
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
validate_certs: false
no_log: "{{ keycloak_no_log | default('True') }}"
register: keycloak_auth_response
until: keycloak_auth_response.status == 200
no_log: "{{ keycloak_realm_no_log | default('True') }}"
register: keycloak_realm_auth_response
until: keycloak_realm_auth_response.status == 200
retries: 5
delay: 2
- name: "Determine if realm exists"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
method: GET
validate_certs: false
status_code:
@@ -21,38 +21,38 @@
- 404
headers:
Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: keycloak_realm_exists
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_realm_exists
- name: Create Realm
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms"
method: POST
body: "{{ lookup('template', 'realm.json.j2') }}"
validate_certs: false
body_format: json
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 201
when: keycloak_realm_exists.status == 404
when: keycloak_realm_realm_exists.status == 404
- name: Create user federation
middleware_automation.keycloak.keycloak_user_federation:
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}"
auth_realm: "{{ keycloak_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}"
auth_password: "{{ keycloak_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm) }}"
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_realm_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
name: "{{ item.name }}"
state: present
provider_id: "{{ item.provider_id }}"
provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}"
config: "{{ item.config }}"
mappers: "{{ item.mappers | default(omit) }}"
no_log: "{{ keycloak_no_log | default('True') }}"
register: create_user_federation_result
loop: "{{ keycloak_user_federation | flatten }}"
when: keycloak_user_federation is defined
no_log: "{{ keycloak_realm_no_log | default('True') }}"
register: keycloak_realm_create_user_federation_result
loop: "{{ keycloak_realm_user_federation | flatten }}"
when: keycloak_realm_user_federation is defined
- name: Validate Keycloak clients
ansible.builtin.assert:
@@ -61,18 +61,18 @@
- (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0)
fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required"
quiet: true
loop: "{{ keycloak_clients | flatten }}"
loop: "{{ keycloak_realm_clients | flatten }}"
loop_control:
label: "{{ item.name | default('unnamed client') }}"
- name: Create or update a Keycloak client
middleware_automation.keycloak.keycloak_client:
auth_client_id: "{{ keycloak_auth_client }}"
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}"
auth_realm: "{{ keycloak_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}"
auth_password: "{{ keycloak_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm) }}"
auth_client_id: "{{ keycloak_realm_auth_client }}"
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_realm_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
default_roles: "{{ item.roles | default(omit) }}"
client_id: "{{ item.client_id | default(omit) }}"
id: "{{ item.id | default(omit) }}"
@@ -94,21 +94,21 @@
protocol: "{{ item.protocol | default(omit) }}"
attributes: "{{ item.attributes | default(omit) }}"
state: present
no_log: "{{ keycloak_no_log | default('false') }}"
register: create_client_result
loop: "{{ keycloak_clients | flatten }}"
no_log: "{{ keycloak_realm_no_log | default('false') }}"
register: keycloak_realm_create_client_result
loop: "{{ keycloak_realm_clients | flatten }}"
when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined)
- name: Create client roles
ansible.builtin.include_tasks: manage_client_roles.yml
loop: "{{ keycloak_clients | flatten }}"
loop: "{{ keycloak_realm_clients | flatten }}"
loop_control:
loop_var: client
when: "'roles' in client"
- name: Create client users
ansible.builtin.include_tasks: manage_client_users.yml
loop: "{{ keycloak_clients | flatten }}"
loop: "{{ keycloak_realm_clients | flatten }}"
loop_control:
loop_var: client
when: "'users' in client"

14
roles/keycloak_realm/tasks/manage_client_roles.yml
View File

@@ -1,13 +1,13 @@
- name: Create client roles
middleware_automation.keycloak.keycloak_role:
name: "{{ item }}"
realm: "{{ client.realm | default(keycloak_realm) }}"
realm: "{{ client.realm | default(keycloak_realm_realm) }}"
client_id: "{{ client.client_id }}"
auth_client_id: "{{ keycloak_auth_client }}"
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}"
auth_realm: "{{ keycloak_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}"
auth_password: "{{ keycloak_admin_password }}"
auth_client_id: "{{ keycloak_realm_auth_client }}"
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_realm_admin_password }}"
state: present
loop: "{{ client.roles | flatten }}"
no_log: "{{ keycloak_no_log | default('True') }}"
no_log: "{{ keycloak_realm_no_log | default('True') }}"

4
roles/keycloak_realm/tasks/manage_token_lifespan.yml
View File

@@ -1,7 +1,7 @@
---
- name: "Update Access token lifespan"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
method: PUT
body:
accessTokenLifespan: 300
@@ -11,4 +11,4 @@
- 200
- 204
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"

24
roles/keycloak_realm/tasks/manage_user.yml
View File

@@ -1,15 +1,15 @@
---
- name: "Check if User Already Exists"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
validate_certs: false
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: keycloak_user_search_result
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_user_search_result
- name: "Create User"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users"
method: POST
body:
enabled: true
@@ -21,21 +21,21 @@
validate_certs: false
body_format: json
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 201
when: keycloak_user_search_result.json | length == 0
when: keycloak_realm_user_search_result.json | length == 0
- name: "Get User"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
validate_certs: false
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: keycloak_user
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_user
- name: "Update User Password"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users/{{ (keycloak_user.json | first).id }}/reset-password"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users/{{ (keycloak_realm_user.json | first).id }}/reset-password"
method: PUT
body:
type: password
@@ -47,5 +47,5 @@
- 200
- 204
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: keycloak_user
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_user

22
roles/keycloak_realm/tasks/manage_user_client_roles.yml
View File

@@ -1,20 +1,20 @@
---
- name: "Get Realm for role"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm) }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm_realm) }}"
method: GET
validate_certs: false
status_code:
- 200
headers:
Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: client_role_realm
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_client_role_realm
- name: Check if Mapping is available
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available"
method: GET
validate_certs: false
@@ -22,13 +22,13 @@
- 200
headers:
Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: client_role_user_available
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_client_role_user_available
- name: "Create Role Mapping"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}"
method: POST
body:
@@ -40,7 +40,7 @@
validate_certs: false
body_format: json
headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 204
loop: "{{ client_role_user_available.json | flatten }}"
loop: "{{ keycloak_realm_client_role_user_available.json | flatten }}"
when: item.name == client_role.role

16
roles/keycloak_realm/tasks/manage_user_roles.yml
View File

@@ -1,21 +1,21 @@
---
- name: "Get User {{ user.username }}"
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
headers:
validate_certs: false
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
register: keycloak_user
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_user
- name: Refresh keycloak auth token
ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token"
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
method: POST
body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password"
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
validate_certs: false
register: keycloak_auth_response
no_log: "{{ keycloak_no_log | default('True') }}"
until: keycloak_auth_response.status == 200
register: keycloak_realm_auth_response
no_log: "{{ keycloak_realm_no_log | default('True') }}"
until: keycloak_realm_auth_response.status == 200
retries: 5
delay: 2

4
roles/keycloak_realm/templates/realm.json.j2
View File

@@ -1,6 +1,6 @@
{
"id": "{{ keycloak_realm }}",
"realm": "{{ keycloak_realm }}",
"id": "{{ keycloak_realm_realm }}",
"realm": "{{ keycloak_realm_realm }}",
"enabled": true,
"eventsEnabled": true,
"eventsExpiration": 7200

2
roles/keycloak_realm/vars/main.yml
View File

@@ -2,4 +2,4 @@
# vars file for keycloak_realm
# name of the realm to create, this is a required variable
keycloak_realm:
keycloak_realm_realm: