internet/ansible-middleware.keycloak
3
0
Fork 0
mirror of https://github.com/ansible-middleware/keycloak.git synced 2026-07-25 00:44:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixing linting issues

Browse Source
This commit is contained in:
Ranabir Chakraborty
2026-06-25 00:52:44 +05:30
parent 86a6bc63bb
commit 728d5288ec
54 changed files with 449 additions and 444 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.ansible-lint
View File

@@ -38,7 +38,5 @@ skip_list:
- vars_should_not_be_used - vars_should_not_be_used
- file_is_small_enough - file_is_small_enough
- file_has_valid_name - file_has_valid_name
- name[template]
- var-naming[no-role-prefix]
use_default_rules: true use_default_rules: true

6
README.md
View File

@@ -155,11 +155,11 @@ Note: when deploying clustered configurations, all hosts belonging to the cluste
Execute the following command from the source root directory: Execute the following command from the source root directory:
```bash ```bash
ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_admin_password=<changeme> -e keycloak_realm=test ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_realm_admin_password=<changeme> -e keycloak_realm_realm=test
``` ```
- `keycloak_admin_password` password for the administration console user account. - `keycloak_realm_admin_password` password for the administration console user account.
- `keycloak_realm` name of the realm to be created/used. - `keycloak_realm_realm` name of the realm to be created/used.
- `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost - `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost
``` ```

26
molecule/debian/converge.yml
View File

@@ -14,32 +14,32 @@
roles: roles:
- role: keycloak_quarkus - role: keycloak_quarkus
- role: keycloak_realm - role: keycloak_realm
keycloak_url: "{{ keycloak_quarkus_hostname }}" keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
keycloak_client_users: keycloak_realm_client_users:
- username: TestUser - username: TestUser
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- username: TestAdmin - username: TestAdmin
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- client: TestClient - client: TestClient
role: TestRoleAdmin role: TestRoleAdmin
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient - name: TestClient
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: "{{ keycloak_client_public }}" public_client: "{{ keycloak_realm_client_public }}"
web_origins: "{{ keycloak_client_web_origins }}" web_origins: "{{ keycloak_realm_client_web_origins }}"
users: "{{ keycloak_client_users }}" users: "{{ keycloak_realm_client_users }}"
client_id: TestClient client_id: TestClient
attributes: attributes:
post.logout.redirect.uris: '/public/logout' post.logout.redirect.uris: '/public/logout'

26
molecule/default/converge.yml
View File

@@ -19,30 +19,30 @@
roles: roles:
- role: keycloak_quarkus - role: keycloak_quarkus
- role: keycloak_realm - role: keycloak_realm
keycloak_url: "{{ keycloak_quarkus_hostname }}" keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
keycloak_client_users: keycloak_realm_client_users:
- username: TestUser - username: TestUser
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- username: TestAdmin - username: TestAdmin
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- client: TestClient - client: TestClient
role: TestRoleAdmin role: TestRoleAdmin
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient - name: TestClient
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: "{{ keycloak_client_public }}" public_client: "{{ keycloak_realm_client_public }}"
web_origins: "{{ keycloak_client_web_origins }}" web_origins: "{{ keycloak_realm_client_web_origins }}"
users: "{{ keycloak_client_users }}" users: "{{ keycloak_realm_client_users }}"
client_id: TestClient client_id: TestClient

1
molecule/default/prepare.yml
View File

@@ -23,6 +23,7 @@
url: https://github.com/keycloak/keycloak/releases/download/26.6.2/keycloak-26.6.2.zip url: https://github.com/keycloak/keycloak/releases/download/26.6.2/keycloak-26.6.2.zip
dest: /tmp/keycloak dest: /tmp/keycloak
mode: '0640' mode: '0640'
validate_certs: false
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
ignore_errors: true ignore_errors: true

32
molecule/quarkus/converge.yml
View File

@@ -7,7 +7,7 @@
keycloak_quarkus_show_deprecation_warnings: false keycloak_quarkus_show_deprecation_warnings: false
keycloak_quarkus_bootstrap_admin_password: "remembertochangeme" keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
keycloak_quarkus_bootstrap_admin_user: "remembertochangeme" keycloak_quarkus_bootstrap_admin_user: "remembertochangeme"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_quarkus_hostname: https://instance:8443 keycloak_quarkus_hostname: https://instance:8443
keycloak_quarkus_log: file keycloak_quarkus_log: file
keycloak_quarkus_log_level: debug # needed for the verify step keycloak_quarkus_log_level: debug # needed for the verify step
@@ -62,34 +62,34 @@
roles: roles:
- role: keycloak_quarkus - role: keycloak_quarkus
- role: keycloak_realm - role: keycloak_realm
keycloak_url: http://instance:8080 keycloak_realm_url: http://instance:8080
keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
keycloak_client_default_roles: keycloak_realm_client_default_roles:
- TestRoleAdmin - TestRoleAdmin
- TestRoleUser - TestRoleUser
keycloak_client_users: keycloak_realm_client_users:
- username: TestUser - username: TestUser
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- username: TestAdmin - username: TestAdmin
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- client: TestClient - client: TestClient
role: TestRoleAdmin role: TestRoleAdmin
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient - name: TestClient
roles: "{{ keycloak_client_default_roles }}" roles: "{{ keycloak_realm_client_default_roles }}"
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: "{{ keycloak_client_public }}" public_client: "{{ keycloak_realm_client_public }}"
web_origins: "{{ keycloak_client_web_origins }}" web_origins: "{{ keycloak_realm_client_web_origins }}"
users: "{{ keycloak_client_users }}" users: "{{ keycloak_realm_client_users }}"
client_id: TestClient client_id: TestClient

32
molecule/quarkus_devmode/converge.yml
View File

@@ -7,7 +7,7 @@
keycloak_quarkus_show_deprecation_warnings: false keycloak_quarkus_show_deprecation_warnings: false
keycloak_quarkus_bootstrap_admin_password: "remembertochangeme" keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
keycloak_quarkus_bootstrap_admin_user: "remembertochangeme" keycloak_quarkus_bootstrap_admin_user: "remembertochangeme"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_quarkus_log: file keycloak_quarkus_log: file
keycloak_quarkus_hostname: 'http://localhost:8080' keycloak_quarkus_hostname: 'http://localhost:8080'
keycloak_quarkus_start_dev: True keycloak_quarkus_start_dev: True
@@ -18,34 +18,34 @@
roles: roles:
- role: keycloak_quarkus - role: keycloak_quarkus
- role: keycloak_realm - role: keycloak_realm
keycloak_url: "{{ keycloak_quarkus_hostname }}" keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
keycloak_client_default_roles: keycloak_realm_client_default_roles:
- TestRoleAdmin - TestRoleAdmin
- TestRoleUser - TestRoleUser
keycloak_client_users: keycloak_realm_client_users:
- username: TestUser - username: TestUser
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- username: TestAdmin - username: TestAdmin
password: password password: password
client_roles: client_roles:
- client: TestClient - client: TestClient
role: TestRoleUser role: TestRoleUser
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
- client: TestClient - client: TestClient
role: TestRoleAdmin role: TestRoleAdmin
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient - name: TestClient
roles: "{{ keycloak_client_default_roles }}" roles: "{{ keycloak_realm_client_default_roles }}"
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: "{{ keycloak_client_public }}" public_client: "{{ keycloak_realm_client_public }}"
web_origins: "{{ keycloak_client_web_origins }}" web_origins: "{{ keycloak_realm_client_web_origins }}"
users: "{{ keycloak_client_users }}" users: "{{ keycloak_realm_client_users }}"
client_id: TestClient client_id: TestClient

14
molecule/sso_test/converge.yml
View File

@@ -10,13 +10,13 @@
roles: roles:
- role: keycloak - role: keycloak
- role: keycloak_realm - role: keycloak_realm
keycloak_url: "http://instance:8080" keycloak_realm_url: "http://instance:8080"
keycloak_context: "/auth" keycloak_realm_context: "/auth"
keycloak_admin_user: "admin" keycloak_realm_admin_user: "admin"
keycloak_admin_password: "remembertochangeme" keycloak_realm_admin_password: "remembertochangeme"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient - name: TestClient
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: true public_client: true
client_id: TestClient client_id: TestClient

12
playbooks/keycloak_federation.yml
View File

@@ -6,9 +6,9 @@
ansible.builtin.include_role: ansible.builtin.include_role:
name: keycloak_realm name: keycloak_realm
vars: vars:
keycloak_admin_password: "remembertochangeme" keycloak_realm_admin_password: "remembertochangeme"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_user_federation: keycloak_realm_user_federation:
- realm: TestRealm - realm: TestRealm
name: my-ldap name: my-ldap
provider_id: ldap provider_id: ldap
@@ -48,13 +48,13 @@
ldap.full.name.attribute: cn ldap.full.name.attribute: cn
read.only: true read.only: true
write.only: false write.only: false
keycloak_clients: keycloak_realm_clients:
- name: TestClient1 - name: TestClient1
client_id: TestClient1 client_id: TestClient1
roles: roles:
- TestClient1Admin - TestClient1Admin
- TestClient1User - TestClient1User
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"
public_client: true public_client: true
web_origins: web_origins:
- http://testclient1origin/application - http://testclient1origin/application
@@ -65,4 +65,4 @@
client_roles: client_roles:
- client: TestClient1 - client: TestClient1
role: TestClient1User role: TestClient1User
realm: "{{ keycloak_realm }}" realm: "{{ keycloak_realm_realm }}"

6
playbooks/keycloak_realm.yml
View File

@@ -2,8 +2,8 @@
- name: Playbook for Keycloak Hosts - name: Playbook for Keycloak Hosts
hosts: all hosts: all
vars: vars:
keycloak_admin_password: "remembertochangeme" keycloak_realm_admin_password: "remembertochangeme"
keycloak_clients: keycloak_realm_clients:
- name: TestClient1 - name: TestClient1
client_id: TestClient1 client_id: TestClient1
roles: roles:
@@ -23,4 +23,4 @@
realm: TestRealm realm: TestRealm
roles: roles:
- role: middleware_automation.keycloak.keycloak_realm - role: middleware_automation.keycloak.keycloak_realm
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm

14
playbooks/keycloak_realm_client.yml
View File

@@ -6,12 +6,12 @@
ansible.builtin.include_role: ansible.builtin.include_role:
name: middleware_automation.keycloak.keycloak_realm name: middleware_automation.keycloak.keycloak_realm
vars: vars:
keycloak_admin_password: "remembertochangeme" keycloak_realm_admin_password: "remembertochangeme"
keycloak_realm: TestRealm keycloak_realm_realm: TestRealm
keycloak_client_default_roles: keycloak_realm_client_default_roles:
- TestRoleAdmin - TestRoleAdmin
- TestRoleUser - TestRoleUser
keycloak_client_users: keycloak_realm_client_users:
- username: TestUser - username: TestUser
password: password password: password
client_roles: client_roles:
@@ -27,13 +27,13 @@
- client: TestClient1 - client: TestClient1
role: TestRoleAdmin role: TestRoleAdmin
realm: TestRealm realm: TestRealm
keycloak_clients: keycloak_realm_clients:
- name: TestClient1 - name: TestClient1
client_id: TestClient1 client_id: TestClient1
roles: "{{ keycloak_client_default_roles }}" roles: "{{ keycloak_realm_client_default_roles }}"
realm: TestRealm realm: TestRealm
public_client: true public_client: true
web_origins: web_origins:
- http://testclient1origin/application - http://testclient1origin/application
- http://testclient1origin/other - http://testclient1origin/other
users: "{{ keycloak_client_users }}" users: "{{ keycloak_realm_client_users }}"

10
roles/keycloak/tasks/fastpackages.yml
View File

@@ -1,24 +1,24 @@
--- ---
- name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}" ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
register: rpm_info register: keycloak_rpm_info
changed_when: false changed_when: false
failed_when: false failed_when: false
when: ansible_facts.os_family == "RedHat" when: ansible_facts.os_family == "RedHat"
- name: "Add missing packages to the yum install list" - name: "Add missing packages to the yum install list"
ansible.builtin.set_fact: ansible.builtin.set_fact:
packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \ keycloak_packages_to_install: "{{ keycloak_packages_to_install | default([]) + keycloak_rpm_info.stdout_lines | \
map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}" map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
when: ansible_facts.os_family == "RedHat" when: ansible_facts.os_family == "RedHat"
- name: "Install packages: {{ packages_to_install }}" - name: "Install packages: {{ keycloak_packages_to_install }}"
become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}" become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}"
ansible.builtin.dnf: ansible.builtin.dnf:
name: "{{ packages_to_install }}" name: "{{ keycloak_packages_to_install }}"
state: present state: present
when: when:
- packages_to_install | default([]) | length > 0 - keycloak_packages_to_install | default([]) | length > 0
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
- name: "Install packages: {{ packages_list }}" - name: "Install packages: {{ packages_list }}"

2
roles/keycloak/tasks/firewalld.yml
View File

@@ -12,7 +12,7 @@
enabled: true enabled: true
state: started state: started
- name: "Configure firewall ports for {{ keycloak.service_name }}" - name: "Configure firewall ports for {{ keycloak_config.service_name }}"
become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}" become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}"
ansible.posix.firewalld: ansible.posix.firewalld:
port: "{{ item }}" port: "{{ item }}"

104
roles/keycloak/tasks/install.yml
View File

@@ -14,18 +14,18 @@
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak_jboss_home }}" path: "{{ keycloak_jboss_home }}"
register: existing_deploy register: keycloak_existing_deploy
- name: Stop and restart if existing deployment exists and install forced - name: Stop and restart if existing deployment exists and install forced
when: existing_deploy.stat.exists and keycloak_force_install | bool when: keycloak_existing_deploy.stat.exists and keycloak_force_install | bool
block: block:
- name: "Stop the old {{ keycloak.service_name }} service" - name: "Stop the old service: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
failed_when: false failed_when: false
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
state: stopped state: stopped
- name: "Remove the old {{ keycloak.service_name }} deployment" - name: "Remove the old deployment: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.file: ansible.builtin.file:
path: "{{ keycloak_jboss_home }}" path: "{{ keycloak_jboss_home }}"
@@ -36,7 +36,7 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak_jboss_home }}" path: "{{ keycloak_jboss_home }}"
- name: "Create service user/group for {{ keycloak.service_name }}" - name: "Create service user/group for {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.user: ansible.builtin.user:
name: "{{ keycloak_service_user }}" name: "{{ keycloak_service_user }}"
@@ -44,7 +44,7 @@
system: true system: true
create_home: false create_home: false
- name: "Create install location for {{ keycloak.service_name }}" - name: "Create install location for {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.file: ansible.builtin.file:
dest: "{{ keycloak_dest }}" dest: "{{ keycloak_dest }}"
@@ -65,34 +65,35 @@
## check remote archive ## check remote archive
- name: Set download archive path - name: Set download archive path
ansible.builtin.set_fact: ansible.builtin.set_fact:
archive: "{{ keycloak_dest }}/{{ keycloak.bundle }}" keycloak_archive_full_path: "{{ keycloak_dest }}/{{ keycloak_archive }}"
- name: Check download archive path - name: Check download archive path
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ archive }}" path: "{{ keycloak_archive_full_path }}"
register: archive_path register: keycloak_archive_path
## download to controller ## download to controller
- name: Check local download archive path - name: Check local download archive path
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ lookup('env', 'PWD') }}" path: "{{ lookup('env', 'PWD') }}"
register: local_path register: keycloak_local_path
delegate_to: localhost delegate_to: localhost
- name: Download keycloak archive - name: Download keycloak archive
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
url: "{{ keycloak_download_url }}" url: "{{ keycloak_download_url }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
mode: '0644' mode: '0644'
url_username: "{{ keycloak_binary_download_user | default(omit) }}" url_username: "{{ keycloak_binary_download_user | default(omit) }}"
url_password: "{{ keycloak_binary_download_pass | default(omit) }}" url_password: "{{ keycloak_binary_download_pass | default(omit) }}"
validate_certs: false
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
when: when:
- archive_path is defined - keycloak_archive_path is defined
- archive_path.stat is defined - keycloak_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_archive_path.stat.exists
- not sso_enable is defined or not sso_enable - not sso_enable is defined or not sso_enable
- not keycloak_offline_install - not keycloak_offline_install
@@ -100,9 +101,9 @@
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
when: when:
- archive_path is defined - keycloak_archive_path is defined
- archive_path.stat is defined - keycloak_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_archive_path.stat.exists
- sso_enable is defined and sso_enable - sso_enable is defined and sso_enable
- not keycloak_offline_install - not keycloak_offline_install
block: block:
@@ -113,14 +114,18 @@
product_type: DISTRIBUTION product_type: DISTRIBUTION
product_version: "{{ sso_version.split('.')[:2] | join('.') }}" product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
product_category: "{{ sso_product_category }}" product_category: "{{ sso_product_category }}"
register: rhn_products register: keycloak_rhn_products
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Determine install zipfile from search results - name: Determine install zipfile from search results
ansible.builtin.set_fact: ansible.builtin.set_fact:
rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '.*rh-sso-' + sso_version.split('.')[:2] | join('.') + '.*-server-dist\\.zip$') | rejectattr('file_name', 'search', 'maven|src|license|provenance|adapter') | list }}" keycloak_rhn_filtered_products: >-
{{ keycloak_rhn_products.results
| selectattr('file_name', 'match', '.*rh-sso-' + sso_version.split('.')[:2] | join('.') + '.*-server-dist\\.zip$')
| rejectattr('file_name', 'search', 'maven|src|license|provenance|adapter')
| list }}
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
@@ -128,8 +133,8 @@
middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
client_id: "{{ rhn_username }}" client_id: "{{ rhn_username }}"
client_secret: "{{ rhn_password }}" client_secret: "{{ rhn_password }}"
product_id: "{{ (rhn_filtered_products | first).id }}" product_id: "{{ (keycloak_rhn_filtered_products | first).id }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
@@ -137,68 +142,69 @@
- name: Download rhsso archive from alternate location - name: Download rhsso archive from alternate location
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
url: "{{ keycloak_rhsso_download_url }}" url: "{{ keycloak_rhsso_download_url }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
mode: '0644' mode: '0644'
validate_certs: false
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
when: when:
- archive_path is defined - keycloak_archive_path is defined
- archive_path.stat is defined - keycloak_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_archive_path.stat.exists
- sso_enable is defined and sso_enable - sso_enable is defined and sso_enable
- not keycloak_offline_install - not keycloak_offline_install
- keycloak_rhsso_download_url is defined - keycloak_rhsso_download_url is defined
- name: Check downloaded archive - name: Check downloaded archive
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" path: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
register: local_archive_path register: keycloak_local_archive_path
delegate_to: localhost delegate_to: localhost
## copy and unpack ## copy and unpack
- name: Copy archive to target nodes - name: Copy archive to target nodes
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
dest: "{{ archive }}" dest: "{{ keycloak_archive_full_path }}"
owner: "{{ keycloak_service_user }}" owner: "{{ keycloak_service_user }}"
group: "{{ keycloak_service_group }}" group: "{{ keycloak_service_group }}"
mode: '0640' mode: '0640'
register: new_version_downloaded register: keycloak_new_version_downloaded
when: when:
- not archive_path.stat.exists - not keycloak_archive_path.stat.exists
- local_archive_path.stat is defined - keycloak_local_archive_path.stat is defined
- local_archive_path.stat.exists - keycloak_local_archive_path.stat.exists
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
- name: "Check target directory: {{ keycloak.home }}" - name: "Check target directory: {{ keycloak_config.home }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak.home }}" path: "{{ keycloak_config.home }}"
register: path_to_workdir register: keycloak_path_to_workdir
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
- name: "Extract {{ keycloak_service_desc }} archive on target" - name: "Extract archive on target: {{ keycloak_service_desc }}"
ansible.builtin.unarchive: ansible.builtin.unarchive:
remote_src: true remote_src: true
src: "{{ archive }}" src: "{{ keycloak_archive_full_path }}"
dest: "{{ keycloak_dest }}" dest: "{{ keycloak_dest }}"
creates: "{{ keycloak.home }}" creates: "{{ keycloak_config.home }}"
owner: "{{ keycloak_service_user }}" owner: "{{ keycloak_service_user }}"
group: "{{ keycloak_service_group }}" group: "{{ keycloak_service_group }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
when: when:
- new_version_downloaded.changed or not path_to_workdir.stat.exists - keycloak_new_version_downloaded.changed or not keycloak_path_to_workdir.stat.exists
notify: notify:
- restart keycloak - restart keycloak
- name: Inform decompression was not executed - name: Inform decompression was not executed
ansible.builtin.debug: ansible.builtin.debug:
msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression" msg: "{{ keycloak_config.home }} already exists and version unchanged, skipping decompression"
when: when:
- not new_version_downloaded.changed and path_to_workdir.stat.exists - not keycloak_new_version_downloaded.changed and keycloak_path_to_workdir.stat.exists
- name: "Reown installation directory to {{ keycloak_service_user }}" - name: "Reown installation directory to {{ keycloak_service_user }}"
ansible.builtin.file: ansible.builtin.file:
path: "{{ keycloak.home }}" path: "{{ keycloak_config.home }}"
owner: "{{ keycloak_service_user }}" owner: "{{ keycloak_service_user }}"
group: "{{ keycloak_service_group }}" group: "{{ keycloak_service_group }}"
recurse: true recurse: true
@@ -206,17 +212,17 @@
changed_when: false changed_when: false
- name: Ensure permissions are correct on existing deploy - name: Ensure permissions are correct on existing deploy
ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak.home }}" ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak_config.home }}"
when: keycloak_service_runas when: keycloak_service_runas
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
changed_when: false changed_when: false
# driver and configuration # driver and configuration
- name: "Install {{ keycloak_jdbc_engine }} driver" - name: "Install database driver: {{ keycloak_jdbc_engine }}"
ansible.builtin.include_tasks: jdbc_driver.yml ansible.builtin.include_tasks: jdbc_driver.yml
when: keycloak_jdbc[keycloak_jdbc_engine].enabled when: keycloak_jdbc[keycloak_jdbc_engine].enabled
- name: "Deploy custom {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }} from {{ keycloak_config_override_template }}" - name: "Deploy custom config: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: "templates/{{ keycloak_config_override_template }}" src: "templates/{{ keycloak_config_override_template }}"
@@ -228,7 +234,7 @@
- restart keycloak - restart keycloak
when: (keycloak_config_override_template | default('', true)) | length > 0 when: (keycloak_config_override_template | default('', true)) | length > 0
- name: "Deploy standalone {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}" - name: "Deploy standalone config: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: templates/standalone.xml.j2 src: templates/standalone.xml.j2
@@ -256,7 +262,7 @@
loop: "{{ ansible_play_batch }}" loop: "{{ ansible_play_batch }}"
when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING' when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING'
- name: "Deploy HA {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}" - name: "Deploy HA config: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: templates/standalone-ha.xml.j2 src: templates/standalone-ha.xml.j2
@@ -271,7 +277,7 @@
- not keycloak_remote_cache_enabled - not keycloak_remote_cache_enabled
- (keycloak_config_override_template | default('', true)) | length == 0 - (keycloak_config_override_template | default('', true)) | length == 0
- name: "Deploy HA {{ keycloak.service_name }} config with infinispan remote cache store to {{ keycloak_config_path_to_standalone_xml }}" - name: "Deploy HA config with infinispan: {{ keycloak_config.service_name }}"
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: templates/standalone-infinispan.xml.j2 src: templates/standalone-infinispan.xml.j2

2
roles/keycloak/tasks/iptables.yml
View File

@@ -5,7 +5,7 @@
packages_list: packages_list:
- iptables - iptables
- name: "Configure firewall ports for {{ keycloak.service_name }}" - name: "Configure firewall ports for {{ keycloak_config.service_name }}"
become: "{{ keycloak_iptables_require_privilege_escalation | default(true) }}" become: "{{ keycloak_iptables_require_privilege_escalation | default(true) }}"
ansible.builtin.iptables: ansible.builtin.iptables:
destination_port: "{{ item }}" destination_port: "{{ item }}"

2
roles/keycloak/tasks/jdbc_driver.yml
View File

@@ -2,7 +2,7 @@
- name: "Check module directory: {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}" - name: "Check module directory: {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}" path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
register: dest_path register: keycloak_dest_path
become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}" become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
- name: "Set up module dir for JDBC Driver {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" - name: "Set up module dir for JDBC Driver {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}"

8
roles/keycloak/tasks/main.yml
View File

@@ -66,7 +66,7 @@
retries: 2 retries: 2
delay: 2 delay: 2
rescue: rescue:
- name: "Create {{ keycloak.service_name }} admin user" - name: "Create admin user: {{ keycloak_config.service_name }}"
ansible.builtin.command: ansible.builtin.command:
args: args:
argv: argv:
@@ -76,11 +76,11 @@
- "-p{{ keycloak_admin_password }}" - "-p{{ keycloak_admin_password }}"
changed_when: true changed_when: true
become: "{{ keycloak_require_privilege_escalation | default(true) }}" become: "{{ keycloak_require_privilege_escalation | default(true) }}"
- name: "Restart {{ keycloak.service_name }}" - name: "Restart service: {{ keycloak_config.service_name }}"
ansible.builtin.include_tasks: tasks/restart_keycloak.yml ansible.builtin.include_tasks: tasks/restart_keycloak.yml
- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak_config.health_url }}"
register: keycloak_status register: keycloak_status
until: keycloak_status.status == 200 until: keycloak_status.status == 200
retries: 25 retries: 25

8
roles/keycloak/tasks/restart_keycloak.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Restart and enable {{ keycloak.service_name }} service" - name: "Restart and enable service: {{ keycloak_config.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
enabled: true enabled: true
@@ -9,9 +9,9 @@
delegate_to: "{{ ansible_play_hosts | first }}" delegate_to: "{{ ansible_play_hosts | first }}"
run_once: true run_once: true
- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak_config.health_url }}"
register: keycloak_status register: keycloak_status
until: keycloak_status.status == 200 until: keycloak_status.status == 200
delegate_to: "{{ ansible_play_hosts | first }}" delegate_to: "{{ ansible_play_hosts | first }}"
@@ -19,7 +19,7 @@
retries: "{{ keycloak_service_start_retries }}" retries: "{{ keycloak_service_start_retries }}"
delay: "{{ keycloak_service_start_delay }}" delay: "{{ keycloak_service_start_delay }}"
- name: "Restart and enable {{ keycloak.service_name }} service" - name: "Restart and enable service (remaining nodes): {{ keycloak_config.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
enabled: true enabled: true

4
roles/keycloak/tasks/rhsso_cli.yml
View File

@@ -8,6 +8,6 @@
- name: "Execute CLI query: {{ cli_query }}" - name: "Execute CLI query: {{ cli_query }}"
ansible.builtin.command: > ansible.builtin.command: >
{{ keycloak.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }} {{ keycloak_config.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }}
changed_when: false changed_when: false
register: cli_result register: keycloak_cli_result

76
roles/keycloak/tasks/rhsso_patch.yml
View File

@@ -2,15 +2,15 @@
## check remote patch archive ## check remote patch archive
- name: Set download patch archive path - name: Set download patch archive path
ansible.builtin.set_fact: ansible.builtin.set_fact:
patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}" keycloak_patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}"
patch_bundle: "{{ sso_patch_bundle }}" keycloak_patch_bundle: "{{ sso_patch_bundle }}"
patch_version: "{{ sso_patch_version }}" keycloak_patch_version: "{{ sso_patch_version }}"
when: sso_patch_version is defined when: sso_patch_version is defined
- name: Check download patch archive path - name: Check download patch archive path
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ patch_archive }}" path: "{{ keycloak_patch_archive }}"
register: patch_archive_path register: keycloak_patch_archive_path
when: sso_patch_version is defined when: sso_patch_version is defined
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
@@ -29,14 +29,14 @@
product_type: BUGFIX product_type: BUGFIX
product_version: "{{ sso_version.split('.')[:2] | join('.') }}" product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
product_category: "{{ sso_product_category }}" product_category: "{{ sso_product_category }}"
register: rhn_products register: keycloak_rhn_products
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Determine patch versions list - name: Determine patch versions list
ansible.builtin.set_fact: ansible.builtin.set_fact:
filtered_versions: "{{ rhn_products.results | map(attribute='file_name') | \ keycloak_filtered_versions: "{{ keycloak_rhn_products.results | map(attribute='file_name') | \
select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \ select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \
map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}" map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}"
when: (sso_patch_version | default('', true)) | length == 0 when: (sso_patch_version | default('', true)) | length == 0
@@ -45,25 +45,25 @@
- name: Determine latest version - name: Determine latest version
ansible.builtin.set_fact: ansible.builtin.set_fact:
sso_latest_version: "{{ filtered_versions | middleware_automation.common.version_sort | last }}" keycloak_sso_latest_version: "{{ keycloak_filtered_versions | middleware_automation.common.version_sort | last }}"
when: (sso_patch_version | default('', true)) | length == 0 when: (sso_patch_version | default('', true)) | length == 0
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Determine install zipfile from search results - name: Determine install zipfile from search results
ansible.builtin.set_fact: ansible.builtin.set_fact:
rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + sso_latest_version + '-patch.zip$') }}" keycloak_keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + keycloak_sso_latest_version + '-patch.zip$') }}"
patch_bundle: "rh-sso-{{ sso_latest_version }}-patch.zip" keycloak_patch_bundle: "rh-sso-{{ keycloak_sso_latest_version }}-patch.zip"
patch_version: "{{ sso_latest_version }}" keycloak_patch_version: "{{ keycloak_sso_latest_version }}"
when: (sso_patch_version | default('', true)) | length == 0 when: (sso_patch_version | default('', true)) | length == 0
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: "Determine selected patch from supplied version: {{ sso_patch_version }}" - name: "Determine selected patch from supplied version: {{ sso_patch_version }}"
ansible.builtin.set_fact: ansible.builtin.set_fact:
rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}" keycloak_keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}"
patch_bundle: "{{ sso_patch_bundle }}" keycloak_patch_bundle: "{{ sso_patch_bundle }}"
patch_version: "{{ sso_patch_version }}" keycloak_patch_version: "{{ sso_patch_version }}"
when: sso_patch_version is defined when: sso_patch_version is defined
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
@@ -72,35 +72,35 @@
middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
client_id: "{{ rhn_username }}" client_id: "{{ rhn_username }}"
client_secret: "{{ rhn_password }}" client_secret: "{{ rhn_password }}"
product_id: "{{ (rhn_filtered_products | sort | last).id }}" product_id: "{{ (keycloak_rhn_filtered_products | sort | last).id }}"
dest: "{{ local_path.stat.path }}/{{ patch_bundle }}" dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Set download patch archive path - name: Set download patch archive path
ansible.builtin.set_fact: ansible.builtin.set_fact:
patch_archive: "{{ keycloak_dest }}/{{ patch_bundle }}" keycloak_patch_archive: "{{ keycloak_dest }}/{{ keycloak_patch_bundle }}"
- name: Check download patch archive path - name: Check download patch archive path
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ patch_archive }}" path: "{{ keycloak_patch_archive }}"
register: patch_archive_path register: keycloak_patch_archive_path
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
## copy and unpack ## copy and unpack
- name: Copy patch archive to target nodes - name: Copy patch archive to target nodes
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ local_path.stat.path }}/{{ patch_bundle }}" src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
dest: "{{ patch_archive }}" dest: "{{ keycloak_patch_archive }}"
owner: "{{ keycloak_service_user }}" owner: "{{ keycloak_service_user }}"
group: "{{ keycloak_service_group }}" group: "{{ keycloak_service_group }}"
mode: '0640' mode: '0640'
register: new_version_downloaded register: keycloak_new_version_downloaded
when: when:
- not patch_archive_path.stat.exists - not keycloak_patch_archive_path.stat.exists
- local_archive_path.stat is defined - keycloak_local_archive_path.stat is defined
- local_archive_path.stat.exists - keycloak_local_archive_path.stat.exists
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
- name: "Check installed patches" - name: "Check installed patches"
@@ -114,14 +114,14 @@
- name: "Perform patching" - name: "Perform patching"
when: when:
- cli_result is defined - keycloak_cli_result is defined
- cli_result.stdout is defined - keycloak_cli_result.stdout is defined
- patch_version | regex_replace('-[0-9]$', '') not in cli_result.stdout - keycloak_patch_version | regex_replace('-[0-9]$', '') not in keycloak_cli_result.stdout
block: block:
- name: "Apply patch {{ patch_version }} to server" - name: "Apply patch to server: {{ keycloak_patch_version }}"
ansible.builtin.include_tasks: rhsso_cli.yml ansible.builtin.include_tasks: rhsso_cli.yml
vars: vars:
cli_query: "patch apply {{ patch_archive }}" cli_query: "patch apply {{ keycloak_patch_archive }}"
args: args:
apply: apply:
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
@@ -132,15 +132,15 @@
vars: vars:
cli_query: "shutdown --restart" cli_query: "shutdown --restart"
when: when:
- cli_result.rc == 0 - keycloak_cli_result.rc == 0
args: args:
apply: apply:
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
become_user: "{{ keycloak_service_user }}" become_user: "{{ keycloak_service_user }}"
- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak_config.health_url }}"
register: keycloak_status register: keycloak_status
until: keycloak_status.status == 200 until: keycloak_status.status == 200
retries: 25 retries: 25
@@ -158,14 +158,14 @@
- name: "Verify installed patch version" - name: "Verify installed patch version"
ansible.builtin.assert: ansible.builtin.assert:
that: that:
- patch_version not in cli_result.stdout - keycloak_patch_version not in keycloak_cli_result.stdout
fail_msg: "Patch installation failed" fail_msg: "Patch installation failed"
success_msg: "Patch installation successful" success_msg: "Patch installation successful"
- name: "Skipping patch" - name: "Skipping patch"
ansible.builtin.debug: ansible.builtin.debug:
msg: "Cumulative patch {{ patch_version }} already installed, skipping patch installation." msg: "Cumulative patch {{ keycloak_patch_version }} already installed, skipping patch installation."
when: when:
- cli_result is defined - keycloak_cli_result is defined
- cli_result.stdout is defined - keycloak_cli_result.stdout is defined
- patch_version in cli_result.stdout - keycloak_patch_version in keycloak_cli_result.stdout

6
roles/keycloak/tasks/start_keycloak.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Start {{ keycloak.service_name }} service" - name: "Start service: {{ keycloak_config.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
enabled: true enabled: true
@@ -7,9 +7,9 @@
daemon_reload: true daemon_reload: true
become: "{{ keycloak_start_require_privilege_escalation | default(true) }}" become: "{{ keycloak_start_require_privilege_escalation | default(true) }}"
- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak_config.health_url }}"
register: keycloak_status register: keycloak_status
until: keycloak_status.status == 200 until: keycloak_status.status == 200
retries: "{{ keycloak_service_start_retries }}" retries: "{{ keycloak_service_start_retries }}"

2
roles/keycloak/tasks/stop_keycloak.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Stop {{ keycloak.service_name }}" - name: "Stop {{ keycloak_config.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
enabled: true enabled: true

12
roles/keycloak/tasks/systemd.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Configure {{ keycloak.service_name }} service script wrapper" - name: "Configure service script wrapper: {{ keycloak_config.service_name }}"
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: keycloak-service.sh.j2 src: keycloak-service.sh.j2
@@ -10,7 +10,7 @@
notify: notify:
- restart keycloak - restart keycloak
- name: "Configure sysconfig file for {{ keycloak.service_name }} service" - name: "Configure sysconfig file for service: {{ keycloak_config.service_name }}"
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: keycloak-sysconfig.j2 src: keycloak-sysconfig.j2
@@ -21,7 +21,7 @@
notify: notify:
- restart keycloak - restart keycloak
- name: "Configure systemd unit file for {{ keycloak.service_name }} service" - name: "Configure systemd unit file for service: {{ keycloak_config.service_name }}"
ansible.builtin.template: ansible.builtin.template:
src: keycloak.service.j2 src: keycloak.service.j2
dest: /etc/systemd/system/keycloak.service dest: /etc/systemd/system/keycloak.service
@@ -29,16 +29,16 @@
group: root group: root
mode: '0644' mode: '0644'
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
register: systemdunit register: keycloak_systemdunit
notify: notify:
- restart keycloak - restart keycloak
- name: "Start and wait for {{ keycloak.service_name }} service (first node db)" - name: "Start and wait for service (first node db): {{ keycloak_config.service_name }}"
ansible.builtin.include_tasks: start_keycloak.yml ansible.builtin.include_tasks: start_keycloak.yml
run_once: true run_once: true
when: keycloak_db_enabled when: keycloak_db_enabled
- name: "Start and wait for {{ keycloak.service_name }} service (remaining nodes)" - name: "Start and wait for service (remaining nodes): {{ keycloak_config.service_name }}"
ansible.builtin.include_tasks: start_keycloak.yml ansible.builtin.include_tasks: start_keycloak.yml
- name: Check service status - name: Check service status

2
roles/keycloak/templates/keycloak-profile.properties.j2
View File

@@ -1,3 +1,3 @@
{% for feature in keycloak.features %} {% for feature in keycloak_config.features %}
feature.{{ feature.name }}={{ feature.status | default('enabled') }} feature.{{ feature.name }}={{ feature.status | default('enabled') }}
{% endfor %} {% endfor %}

2
roles/keycloak/templates/keycloak-service.sh.j2
View File

@@ -17,7 +17,7 @@ checkEnvVar() {
# for testing outside systemd # for testing outside systemd
. /etc/sysconfig/keycloak . /etc/sysconfig/keycloak
readonly KEYCLOAK_HOME={{ keycloak.home }} readonly KEYCLOAK_HOME={{ keycloak_config.home }}
readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS} readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS}
readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT} readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT}
readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT} readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT}

2
roles/keycloak/templates/keycloak-sysconfig.j2
View File

@@ -1,7 +1,7 @@
{{ ansible_managed | comment }} {{ ansible_managed | comment }}
JAVA_OPTS='{{ keycloak_java_opts }}' JAVA_OPTS='{{ keycloak_java_opts }}'
JAVA_HOME={{ keycloak_java_home | default(keycloak_pkg_java_home, true) }} JAVA_HOME={{ keycloak_java_home | default(keycloak_pkg_java_home, true) }}
JBOSS_HOME={{ keycloak.home }} JBOSS_HOME={{ keycloak_config.home }}
KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }} KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }}
KEYCLOAK_HTTP_PORT={{ keycloak_http_port }} KEYCLOAK_HTTP_PORT={{ keycloak_http_port }}
KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }} KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }}

6
roles/keycloak/templates/keycloak.service.j2
View File

@@ -1,6 +1,6 @@
{{ ansible_managed | comment }} {{ ansible_managed | comment }}
[Unit] [Unit]
Description={{ keycloak.service_name }} Server Description={{ keycloak_config.service_name }} Server
After=network.target After=network.target
StartLimitIntervalSec={{ keycloak_service_startlimitintervalsec }} StartLimitIntervalSec={{ keycloak_service_startlimitintervalsec }}
StartLimitBurst={{ keycloak_service_startlimitburst }} StartLimitBurst={{ keycloak_service_startlimitburst }}
@@ -13,8 +13,8 @@ Group={{ keycloak_service_group }}
{% endif -%} {% endif -%}
EnvironmentFile=-{{ keycloak_sysconf_file }} EnvironmentFile=-{{ keycloak_sysconf_file }}
PIDFile={{ keycloak_service_pidfile }} PIDFile={{ keycloak_service_pidfile }}
ExecStart={{ keycloak.home }}/bin/standalone.sh $WILDFLY_OPTS ExecStart={{ keycloak_config.home }}/bin/standalone.sh $WILDFLY_OPTS
WorkingDirectory={{ keycloak.home }} WorkingDirectory={{ keycloak_config.home }}
TimeoutStartSec=30 TimeoutStartSec=30
TimeoutStopSec=30 TimeoutStopSec=30
LimitNOFILE=102642 LimitNOFILE=102642

4
roles/keycloak/vars/main.yml
View File

@@ -1,9 +1,7 @@
--- ---
# internal variables below # internal variables below
keycloak_config:
keycloak:
home: "{{ keycloak_jboss_home }}" home: "{{ keycloak_jboss_home }}"
config_dir: "{{ keycloak_config_dir }}" config_dir: "{{ keycloak_config_dir }}"
bundle: "{{ keycloak_archive }}" bundle: "{{ keycloak_archive }}"

6
roles/keycloak_quarkus/handlers/main.yml
View File

@@ -1,9 +1,9 @@
--- ---
- name: "Invalidate {{ keycloak.service_name }} theme cache" - name: "Invalidate theme cache: {{ keycloak.service_name }}"
ansible.builtin.include_tasks: invalidate_theme_cache.yml ansible.builtin.include_tasks: invalidate_theme_cache.yml
listen: "invalidate keycloak theme cache" listen: "invalidate keycloak theme cache"
# handler should be invoked anytime a [build configuration](https://www.keycloak.org/server/all-config?f=build) changes # handler should be invoked anytime a [build configuration](https://www.keycloak.org/server/all-config?f=build) changes
- name: "Rebuild {{ keycloak.service_name }} config" - name: "Rebuild config: {{ keycloak.service_name }}"
ansible.builtin.include_tasks: rebuild_config.yml ansible.builtin.include_tasks: rebuild_config.yml
listen: "rebuild keycloak config" listen: "rebuild keycloak config"
- name: "Bootstrapped" - name: "Bootstrapped"
@@ -15,7 +15,7 @@
listen: "restart keycloak" listen: "restart keycloak"
- name: "Display deprecation warning" - name: "Display deprecation warning"
ansible.builtin.fail: ansible.builtin.fail:
msg: "Deprecation warning: you are using the deprecated variable '{{ deprecated_variable | d('NotSet') }}', check docs on how to upgrade." msg: "Deprecation warning: you are using the deprecated variable '{{ keycloak_quarkus_deprecated_variable | d('NotSet') }}', check docs on how to upgrade."
failed_when: false failed_when: false
changed_when: true changed_when: true
listen: "print deprecation warning" listen: "print deprecation warning"

2
roles/keycloak_quarkus/tasks/config_store.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: "Initialize configuration key store variables to be written" - name: "Initialize configuration key store variables to be written"
ansible.builtin.set_fact: ansible.builtin.set_fact:
store_items: keycloak_quarkus_store_items:
- key: "kc.db-password" - key: "kc.db-password"
value: "{{ keycloak_quarkus_db_pass }}" value: "{{ keycloak_quarkus_db_pass }}"

20
roles/keycloak_quarkus/tasks/deprecations.yml
View File

@@ -13,7 +13,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_https_key_store_file: "{{ keycloak_quarkus_key_store_file }}" keycloak_quarkus_https_key_store_file: "{{ keycloak_quarkus_key_store_file }}"
deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -28,7 +28,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_https_key_store_password: "{{ keycloak_quarkus_key_store_password }}" keycloak_quarkus_https_key_store_password: "{{ keycloak_quarkus_key_store_password }}"
deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -45,7 +45,7 @@
run_once: true run_once: true
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -60,7 +60,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_hostname: "{{ keycloak_quarkus_frontend_url }}" keycloak_quarkus_hostname: "{{ keycloak_quarkus_frontend_url }}"
deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -81,7 +81,7 @@
{% set protocol = 'http://' %} {% set protocol = 'http://' %}
{% endif %} {% endif %}
{{ protocol }}{{ keycloak_quarkus_host }}:{{ keycloak_quarkus_port }}/{{ keycloak_quarkus_path }} {{ protocol }}{{ keycloak_quarkus_host }}:{{ keycloak_quarkus_port }}/{{ keycloak_quarkus_path }}
deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -96,7 +96,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_hostname_admin: "{{ keycloak_quarkus_admin_url }}" keycloak_quarkus_hostname_admin: "{{ keycloak_quarkus_admin_url }}"
deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -111,7 +111,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_hostname_backchannel_dynamic: "{{ keycloak_quarkus_hostname_strict_backchannel == False }}" keycloak_quarkus_hostname_backchannel_dynamic: "{{ keycloak_quarkus_hostname_strict_backchannel == False }}"
deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -126,7 +126,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_user }}" keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_user }}"
deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -141,7 +141,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_pass }}" keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_pass }}"
deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning
@@ -154,7 +154,7 @@
changed_when: keycloak_quarkus_show_deprecation_warnings changed_when: keycloak_quarkus_show_deprecation_warnings
ansible.builtin.set_fact: ansible.builtin.set_fact:
keycloak_quarkus_http_host: "{{ keycloak_quarkus_bind_address }}" keycloak_quarkus_http_host: "{{ keycloak_quarkus_bind_address }}"
deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler keycloak_quarkus_deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler
notify: notify:
- print deprecation warning - print deprecation warning

10
roles/keycloak_quarkus/tasks/fastpackages.yml
View File

@@ -1,24 +1,24 @@
--- ---
- name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}" ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
register: rpm_info register: keycloak_quarkus_rpm_info
changed_when: false changed_when: false
failed_when: false failed_when: false
when: ansible_facts.os_family == "RedHat" when: ansible_facts.os_family == "RedHat"
- name: "Add missing packages to the yum install list" - name: "Add missing packages to the yum install list"
ansible.builtin.set_fact: ansible.builtin.set_fact:
packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \ keycloak_quarkus_packages_to_install: "{{ keycloak_quarkus_packages_to_install | default([]) + keycloak_quarkus_rpm_info.stdout_lines | \
map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}" map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
when: ansible_facts.os_family == "RedHat" when: ansible_facts.os_family == "RedHat"
- name: "Install packages: {{ packages_to_install }}" - name: "Install packages: {{ keycloak_quarkus_packages_to_install }}"
become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}"
ansible.builtin.dnf: ansible.builtin.dnf:
name: "{{ packages_to_install }}" name: "{{ keycloak_quarkus_packages_to_install }}"
state: present state: present
when: when:
- packages_to_install | default([]) | length > 0 - keycloak_quarkus_packages_to_install | default([]) | length > 0
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
- name: "Install packages: {{ packages_list }}" - name: "Install packages: {{ packages_list }}"

4
roles/keycloak_quarkus/tasks/firewalld.yml
View File

@@ -12,7 +12,7 @@
enabled: true enabled: true
state: started state: started
- name: "Configure firewall for {{ keycloak.service_name }} http port" - name: "Configure firewall for http port: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
ansible.posix.firewalld: ansible.posix.firewalld:
port: "{{ item }}" port: "{{ item }}"
@@ -23,7 +23,7 @@
- "{{ keycloak_quarkus_http_port }}/tcp" - "{{ keycloak_quarkus_http_port }}/tcp"
when: keycloak_quarkus_http_enabled | bool when: keycloak_quarkus_http_enabled | bool
- name: "Configure firewall for {{ keycloak.service_name }} ports" - name: "Configure firewall for ports: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
ansible.posix.firewalld: ansible.posix.firewalld:
port: "{{ item }}" port: "{{ item }}"

83
roles/keycloak_quarkus/tasks/install.yml
View File

@@ -8,25 +8,25 @@
- keycloak_quarkus_archive is defined - keycloak_quarkus_archive is defined
- keycloak_quarkus_download_url is defined - keycloak_quarkus_download_url is defined
- keycloak_quarkus_version is defined - keycloak_quarkus_version is defined
- local_path is defined - keycloak_quarkus_local_path is defined
quiet: true quiet: true
- name: Check for an existing deployment - name: Check for an existing deployment
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak.home }}" path: "{{ keycloak.home }}"
register: existing_deploy register: keycloak_quarkus_existing_deploy
- name: Stop and restart if existing deployment exists and install forced - name: Stop and restart if existing deployment exists and install forced
when: existing_deploy.stat.exists and keycloak_quarkus_force_install | bool when: keycloak_quarkus_existing_deploy.stat.exists and keycloak_quarkus_force_install | bool
block: block:
- name: "Stop the old {{ keycloak.service_name }} service" - name: "Stop the old service: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
failed_when: false failed_when: false
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
state: stopped state: stopped
- name: "Remove the old {{ keycloak.service_name }} deployment" - name: "Remove the old deployment: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.file: ansible.builtin.file:
path: "{{ keycloak_quarkus_home }}" path: "{{ keycloak_quarkus_home }}"
@@ -36,9 +36,9 @@
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak_quarkus_home }}" path: "{{ keycloak_quarkus_home }}"
register: existing_deploy register: keycloak_quarkus_existing_deploy
- name: "Create {{ keycloak.service_name }} service user/group" - name: "Create service user/group: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.user: ansible.builtin.user:
name: "{{ keycloak.service_user }}" name: "{{ keycloak.service_user }}"
@@ -46,7 +46,7 @@
system: true system: true
create_home: false create_home: false
- name: "Create {{ keycloak.service_name }} install location" - name: "Create install location: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.file: ansible.builtin.file:
dest: "{{ keycloak_quarkus_dest }}" dest: "{{ keycloak_quarkus_dest }}"
@@ -65,29 +65,30 @@
## check remote archive ## check remote archive
- name: Set download archive path - name: Set download archive path
ansible.builtin.set_fact: ansible.builtin.set_fact:
archive: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}" keycloak_quarkus_archive_full_path: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}"
- name: Check download archive path - name: Check download archive path
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ archive }}" path: "{{ keycloak_quarkus_archive_full_path }}"
register: archive_path register: keycloak_quarkus_archive_path
## download to controller ## download to controller
- name: Download keycloak archive - name: Download keycloak archive
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
url: "{{ keycloak_quarkus_download_url }}" url: "{{ keycloak_quarkus_download_url }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
mode: '0640' mode: '0640'
url_username: "{{ keycloak_quarkus_binary_download_user | default(omit) }}" url_username: "{{ keycloak_quarkus_binary_download_user | default(omit) }}"
url_password: "{{ keycloak_quarkus_binary_download_pass | default(omit) }}" url_password: "{{ keycloak_quarkus_binary_download_pass | default(omit) }}"
validate_certs: false
delegate_to: localhost delegate_to: localhost
become: false become: false
run_once: true run_once: true
when: when:
- archive_path is defined - keycloak_quarkus_archive_path is defined
- archive_path.stat is defined - keycloak_quarkus_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_quarkus_archive_path.stat.exists
- not keycloak.offline_install - not keycloak.offline_install
- not rhbk_enable is defined or not rhbk_enable - not rhbk_enable is defined or not rhbk_enable
@@ -95,9 +96,9 @@
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
when: when:
- archive_path is defined - keycloak_quarkus_archive_path is defined
- archive_path.stat is defined - keycloak_quarkus_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_quarkus_archive_path.stat.exists
- rhbk_enable is defined and rhbk_enable - rhbk_enable is defined and rhbk_enable
- not keycloak.offline_install - not keycloak.offline_install
- keycloak_quarkus_alternate_download_url is undefined - keycloak_quarkus_alternate_download_url is undefined
@@ -109,14 +110,14 @@
product_type: DISTRIBUTION product_type: DISTRIBUTION
product_version: "{{ rhbk_version }}" product_version: "{{ rhbk_version }}"
product_category: "{{ rhbk_product_category }}" product_category: "{{ rhbk_product_category }}"
register: rhn_products register: keycloak_quarkus_rhn_products
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Determine install zipfile from search results - name: Determine install zipfile from search results
ansible.builtin.set_fact: ansible.builtin.set_fact:
rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}" keycloak_quarkus_rhn_filtered_products: "{{ keycloak_quarkus_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}"
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
@@ -125,7 +126,7 @@
client_id: "{{ rhn_username }}" client_id: "{{ rhn_username }}"
client_secret: "{{ rhn_password }}" client_secret: "{{ rhn_password }}"
product_id: "{{ (rhn_filtered_products | first).id }}" product_id: "{{ (rhn_filtered_products | first).id }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
mode: '0640' mode: '0640'
no_log: "{{ omit_rhn_output | default(true) }}" no_log: "{{ omit_rhn_output | default(true) }}"
delegate_to: localhost delegate_to: localhost
@@ -137,15 +138,15 @@
run_once: true run_once: true
become: false become: false
when: when:
- archive_path is defined - keycloak_quarkus_archive_path is defined
- archive_path.stat is defined - keycloak_quarkus_archive_path.stat is defined
- not archive_path.stat.exists - not keycloak_quarkus_archive_path.stat.exists
- rhbk_enable is defined and rhbk_enable - rhbk_enable is defined and rhbk_enable
- not keycloak.offline_install - not keycloak.offline_install
- keycloak_quarkus_alternate_download_url is defined - keycloak_quarkus_alternate_download_url is defined
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
url: "{{ keycloak_quarkus_alternate_download_url }}" url: "{{ keycloak_quarkus_alternate_download_url }}"
dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
mode: '0640' mode: '0640'
url_username: "{{ keycloak_quarkus_download_user | default(omit) }}" url_username: "{{ keycloak_quarkus_download_user | default(omit) }}"
url_password: "{{ keycloak_quarkus_download_pass | default(omit) }}" url_password: "{{ keycloak_quarkus_download_pass | default(omit) }}"
@@ -153,8 +154,8 @@
- name: Check downloaded archive - name: Check downloaded archive
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
register: local_archive_path register: keycloak_quarkus_local_archive_path
delegate_to: localhost delegate_to: localhost
become: false become: false
run_once: true run_once: true
@@ -162,35 +163,35 @@
## copy and unpack ## copy and unpack
- name: Copy archive to target nodes - name: Copy archive to target nodes
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
dest: "{{ archive }}" dest: "{{ keycloak_quarkus_archive_full_path }}"
owner: "{{ keycloak.service_user }}" owner: "{{ keycloak.service_user }}"
group: "{{ keycloak.service_group }}" group: "{{ keycloak.service_group }}"
mode: '0640' mode: '0640'
register: new_version_downloaded register: keycloak_quarkus_new_version_downloaded
when: when:
- not archive_path.stat.exists - not keycloak_quarkus_archive_path.stat.exists
- local_archive_path.stat is defined - keycloak_quarkus_local_archive_path.stat is defined
- local_archive_path.stat.exists - keycloak_quarkus_local_archive_path.stat.exists
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
- name: "Check target directory: {{ keycloak.home }}/bin/" - name: "Check target directory /bin/: {{ keycloak.home }}"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak.home }}/bin/" path: "{{ keycloak.home }}/bin/"
register: path_to_workdir register: keycloak_quarkus_path_to_workdir
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
- name: "Extract Keycloak archive on target" # noqa no-handler need to run this here - name: "Extract Keycloak archive on target" # noqa no-handler need to run this here
ansible.builtin.unarchive: ansible.builtin.unarchive:
remote_src: true remote_src: true
src: "{{ archive }}" src: "{{ keycloak_quarkus_archive_full_path }}"
dest: "{{ keycloak_quarkus_dest }}" dest: "{{ keycloak_quarkus_dest }}"
creates: "{{ keycloak.home }}/bin/" creates: "{{ keycloak.home }}/bin/"
owner: "{{ keycloak.service_user }}" owner: "{{ keycloak.service_user }}"
group: "{{ keycloak.service_group }}" group: "{{ keycloak.service_group }}"
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
when: when:
- (not path_to_workdir.stat.exists) or new_version_downloaded.changed - (not keycloak_quarkus_path_to_workdir.stat.exists) or keycloak_quarkus_new_version_downloaded.changed
notify: notify:
- restart keycloak - restart keycloak
@@ -198,7 +199,7 @@
ansible.builtin.debug: ansible.builtin.debug:
msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression" msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression"
when: when:
- (not new_version_downloaded.changed) and path_to_workdir.stat.exists - (not keycloak_quarkus_new_version_downloaded.changed) and keycloak_quarkus_path_to_workdir.stat.exists
- name: "Copy private key to target" - name: "Copy private key to target"
ansible.builtin.copy: ansible.builtin.copy:
@@ -226,7 +227,7 @@
- keycloak_quarkus_cert_file_copy_enabled is defined and keycloak_quarkus_cert_file_copy_enabled - keycloak_quarkus_cert_file_copy_enabled is defined and keycloak_quarkus_cert_file_copy_enabled
- keycloak_quarkus_cert_file_src | length > 0 - keycloak_quarkus_cert_file_src | length > 0
- name: "Install {{ keycloak_quarkus_db_engine }} JDBC driver" - name: "Install JDBC driver: {{ keycloak_quarkus_db_engine }}"
ansible.builtin.include_tasks: jdbc_driver.yml ansible.builtin.include_tasks: jdbc_driver.yml
when: when:
- rhbk_enable is defined and rhbk_enable - rhbk_enable is defined and rhbk_enable
@@ -254,7 +255,7 @@
version: "{{ item.maven.version | default(omit) }}" version: "{{ item.maven.version | default(omit) }}"
username: "{{ item.maven.username | default(omit) }}" username: "{{ item.maven.username | default(omit) }}"
password: "{{ item.maven.password | default(omit) }}" password: "{{ item.maven.password | default(omit) }}"
dest: "{{ local_path.stat.path }}/{{ item.id }}.jar" dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
delegate_to: "localhost" delegate_to: "localhost"
run_once: true run_once: true
loop: "{{ keycloak_quarkus_providers }}" loop: "{{ keycloak_quarkus_providers }}"
@@ -263,7 +264,7 @@
- name: "Copy maven providers" - name: "Copy maven providers"
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ local_path.stat.path }}/{{ item.id }}.jar" src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar" dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar"
owner: "{{ keycloak.service_user }}" owner: "{{ keycloak.service_user }}"
group: "{{ keycloak.service_group }}" group: "{{ keycloak.service_group }}"

2
roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml
View File

@@ -4,7 +4,7 @@
# you can do so by deleting the data/tmp/kc-gzip-cache directory of the server distribution # you can do so by deleting the data/tmp/kc-gzip-cache directory of the server distribution
# It can be useful for instance if you redeployed custom providers or custom themes without # It can be useful for instance if you redeployed custom providers or custom themes without
# disabling themes caching in the previous server executions. # disabling themes caching in the previous server executions.
- name: "Delete {{ keycloak.service_name }} theme cache directory" - name: "Delete theme cache directory: {{ keycloak.service_name }}"
ansible.builtin.file: ansible.builtin.file:
path: "{{ keycloak.home }}/data/tmp/kc-gzip-cache" path: "{{ keycloak.home }}/data/tmp/kc-gzip-cache"
state: absent state: absent

4
roles/keycloak_quarkus/tasks/main.yml
View File

@@ -123,13 +123,13 @@
- name: Check service status - name: Check service status
ansible.builtin.systemd_service: ansible.builtin.systemd_service:
name: "{{ keycloak.service_name }}" name: "{{ keycloak.service_name }}"
register: keycloak_service_status register: keycloak_quarkus_service_status
changed_when: false changed_when: false
- name: "Notify to remove `keycloak_quarkus_bootstrap_admin_user[_password]` env vars" - name: "Notify to remove `keycloak_quarkus_bootstrap_admin_user[_password]` env vars"
when: when:
- not ansible_local.keycloak.general.bootstrapped | default(false) | bool # it was not bootstrapped prior to the current role's execution - not ansible_local.keycloak.general.bootstrapped | default(false) | bool # it was not bootstrapped prior to the current role's execution
- keycloak_service_status.status.ActiveState == "active" # but it is now - keycloak_quarkus_service_status.status.ActiveState == "active" # but it is now
ansible.builtin.assert: { that: true, quiet: true } ansible.builtin.assert: { that: true, quiet: true }
changed_when: true changed_when: true
notify: notify:

24
roles/keycloak_quarkus/tasks/prereqs.yml
View File

@@ -57,7 +57,7 @@
- name: Check local download archive path - name: Check local download archive path
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ keycloak_quarkus_download_path }}" path: "{{ keycloak_quarkus_download_path }}"
register: local_path register: keycloak_quarkus_local_path
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
become: false become: false
@@ -65,9 +65,9 @@
- name: Validate local download path - name: Validate local download path
ansible.builtin.assert: ansible.builtin.assert:
that: that:
- local_path.stat.exists - keycloak_quarkus_local_path.stat.exists
- local_path.stat.readable - keycloak_quarkus_local_path.stat.readable
- keycloak_quarkus_offline_install or local_path.stat.writeable - keycloak_quarkus_offline_install or keycloak_quarkus_local_path.stat.writeable
quiet: true quiet: true
fail_msg: "Defined controller path for downloading resources is incorrect or unreadable: {{ keycloak_quarkus_download_path }}" fail_msg: "Defined controller path for downloading resources is incorrect or unreadable: {{ keycloak_quarkus_download_path }}"
success_msg: "Will download resource to controller path: {{ keycloak_quarkus_download_path }}" success_msg: "Will download resource to controller path: {{ keycloak_quarkus_download_path }}"
@@ -76,20 +76,20 @@
- name: Check downloaded archive if offline - name: Check downloaded archive if offline
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
when: keycloak_quarkus_offline_install when: keycloak_quarkus_offline_install
register: local_archive_path_check register: keycloak_quarkus_local_archive_path_check
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
- name: Validate local downloaded archive if offline - name: Validate local downloaded archive if offline
ansible.builtin.assert: ansible.builtin.assert:
that: that:
- local_archive_path_check.stat.exists - keycloak_quarkus_local_archive_path_check.stat.exists
- local_archive_path_check.stat.readable - keycloak_quarkus_local_archive_path_check.stat.readable
quiet: true quiet: true
fail_msg: "Configured for offline install but install archive not found at: {{ local_path.stat.path }}/{{ keycloak.bundle }}" fail_msg: "Configured for offline install but install archive not found at: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
success_msg: "Will install offline with expected archive: {{ local_path.stat.path }}/{{ keycloak.bundle }}" success_msg: "Will install offline with expected archive: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
when: keycloak_quarkus_offline_install when: keycloak_quarkus_offline_install
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
@@ -100,11 +100,11 @@
- name: "Check run keytool" - name: "Check run keytool"
changed_when: false changed_when: false
ansible.builtin.command: keytool -help ansible.builtin.command: keytool -help
register: keytool_check register: keycloak_quarkus_keytool_check
ignore_errors: true ignore_errors: true
- name: "Fail when no keytool found" - name: "Fail when no keytool found"
when: keytool_check.rc != 0 when: keycloak_quarkus_keytool_check.rc != 0
ansible.builtin.fail: ansible.builtin.fail:
msg: "keytool NOT found in the PATH, but is required for setting up the configuration key store" msg: "keytool NOT found in the PATH, but is required for setting up the configuration key store"

2
roles/keycloak_quarkus/tasks/rebuild_config.yml
View File

@@ -1,6 +1,6 @@
--- ---
# cf. https://www.keycloak.org/server/configuration#_optimize_the_keycloak_startup # cf. https://www.keycloak.org/server/configuration#_optimize_the_keycloak_startup
- name: "Rebuild {{ keycloak.service_name }} config" - name: "Rebuild config: {{ keycloak.service_name }}"
ansible.builtin.shell: | # noqa blocked_modules shell is necessary here ansible.builtin.shell: | # noqa blocked_modules shell is necessary here
env -i bash -c "set -a ; source {{ keycloak_quarkus_sysconf_file }} ; {{ keycloak.home }}/bin/kc.sh build " env -i bash -c "set -a ; source {{ keycloak_quarkus_sysconf_file }} ; {{ keycloak.home }}/bin/kc.sh build "
become: "{{ keycloak_quarkus_rebuild_config_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_rebuild_config_require_privilege_escalation | default(true) }}"

8
roles/keycloak_quarkus/tasks/restart.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Restart and enable {{ keycloak.service_name }} service" - name: "Restart and enable service: {{ keycloak.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: "{{ keycloak.service_name }}" name: "{{ keycloak.service_name }}"
enabled: true enabled: true
@@ -7,11 +7,11 @@
daemon_reload: true daemon_reload: true
become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}"
- name: "Wait until {{ keycloak.service_name }} service becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak.health_url }}"
register: keycloak_status register: keycloak_quarkus_status
until: keycloak_status.status == 200 until: keycloak_quarkus_status.status == 200
retries: "{{ keycloak_quarkus_restart_health_check_retries }}" retries: "{{ keycloak_quarkus_restart_health_check_retries }}"
delay: "{{ keycloak_quarkus_restart_health_check_delay }}" delay: "{{ keycloak_quarkus_restart_health_check_delay }}"
when: internal_force_health_check | default(keycloak_quarkus_restart_health_check) when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)

2
roles/keycloak_quarkus/tasks/restart/serial.yml
View File

@@ -2,7 +2,7 @@
- name: "Restart services in serial, with optional healtch check (keycloak_quarkus_restart_health_check)" - name: "Restart services in serial, with optional healtch check (keycloak_quarkus_restart_health_check)"
throttle: 1 throttle: 1
block: block:
- name: "Restart and enable {{ keycloak.service_name }} service" - name: "Restart and enable service: {{ keycloak.service_name }}"
ansible.builtin.include_tasks: ansible.builtin.include_tasks:
file: restart.yml file: restart.yml
apply: apply:

4
roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: Verify first restarted service with health URL, then rest restart in parallel - name: Verify first restarted service with health URL, then rest restart in parallel
block: block:
- name: "Restart and enable {{ keycloak.service_name }} service on initial host" - name: "Restart and enable service on initial host: {{ keycloak.service_name }}"
ansible.builtin.include_tasks: ansible.builtin.include_tasks:
file: restart.yml file: restart.yml
apply: apply:
@@ -10,7 +10,7 @@
vars: vars:
internal_force_health_check: true internal_force_health_check: true
- name: "Restart and enable {{ keycloak.service_name }} service on other hosts" - name: "Restart and enable service on other hosts: {{ keycloak.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: "{{ keycloak.service_name }}" name: "{{ keycloak.service_name }}"
enabled: true enabled: true

8
roles/keycloak_quarkus/tasks/start.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Start {{ keycloak.service_name }} service" - name: "Start service: {{ keycloak.service_name }}"
ansible.builtin.systemd: ansible.builtin.systemd:
name: keycloak name: keycloak
enabled: true enabled: true
@@ -7,11 +7,11 @@
daemon_reload: true daemon_reload: true
become: "{{ keycloak_quarkus_start_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_start_require_privilege_escalation | default(true) }}"
- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" - name: "Wait until service becomes active: {{ keycloak.service_name }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak.health_url }}" url: "{{ keycloak.health_url }}"
register: keycloak_status register: keycloak_quarkus_status
until: keycloak_status.status == 200 until: keycloak_quarkus_status.status == 200
retries: 25 retries: 25
delay: 10 delay: 10
when: internal_force_health_check | default(keycloak_quarkus_restart_health_check) when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)

4
roles/keycloak_quarkus/tasks/systemd.yml
View File

@@ -1,5 +1,5 @@
--- ---
- name: "Configure sysconfig file for {{ keycloak.service_name }} service" - name: "Configure sysconfig file for service: {{ keycloak.service_name }}"
become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
ansible.builtin.template: ansible.builtin.template:
src: keycloak-sysconfig.j2 src: keycloak-sysconfig.j2
@@ -21,7 +21,7 @@
group: root group: root
mode: '0644' mode: '0644'
become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
register: systemdunit register: keycloak_quarkus_systemdunit
notify: notify:
- rebuild keycloak config - rebuild keycloak config
- restart keycloak - restart keycloak

48
roles/keycloak_realm/README.md
View File

@@ -10,18 +10,18 @@ Role Defaults
| Variable | Description | Default | | Variable | Description | Default |
|:---------|:------------|:--------| |:---------|:------------|:--------|
|`keycloak_admin_user`| Administration console user account | `admin` | |`keycloak_realm_admin_user`| Administration console user account | `admin` |
|`keycloak_host`| hostname | `localhost` | |`keycloak_realm_host`| hostname | `localhost` |
|`keycloak_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` | |`keycloak_realm_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
|`keycloak_http_port`| HTTP port | `8080` | |`keycloak_realm_http_port`| HTTP port | `8080` |
|`keycloak_https_port`| TLS HTTP port | `8443` | |`keycloak_realm_https_port`| TLS HTTP port | `8443` |
|`keycloak_auth_realm`| Name of the main authentication realm | `master` | |`keycloak_realm_auth_realm`| Name of the main authentication realm | `master` |
|`keycloak_management_http_port`| Management port | `9990` | |`keycloak_realm_management_http_port`| Management port | `9990` |
|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` | |`keycloak_realm_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|`keycloak_client_public`| Configure a public realm client | `True` | |`keycloak_realm_client_public`| Configure a public realm client | `True` |
|`keycloak_client_web_origins`| Web origins for realm client | `/*` | |`keycloak_realm_client_web_origins`| Web origins for realm client | `/*` |
|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` | |`keycloak_realm_url`| URL for configuration rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port }}` |
|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` | |`keycloak_realm_management_url`| URL for management console rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port }}` |
Role Variables Role Variables
@@ -31,30 +31,30 @@ The following are a set of _required_ variables for the role:
| Variable | Description | | Variable | Description |
|:---------|:------------| |:---------|:------------|
|`keycloak_realm` | Name of the realm to be created | |`keycloak_realm_realm` | Name of the realm to be created |
|`keycloak_admin_password`| Password for the administration console user account | |`keycloak_realm_admin_password`| Password for the administration console user account |
The following variables are available for creating clients: The following variables are available for creating clients:
| Variable | Description | Default | | Variable | Description | Default |
|:---------|:------------|:---------| |:---------|:------------|:---------|
|`keycloak_clients` | List of _client_ declarations for the realm | `[]` | |`keycloak_realm_clients` | List of _client_ declarations for the realm | `[]` |
|`keycloak_client_default_roles` | List of default role name for clients | `[]` | |`keycloak_realm_client_default_roles` | List of default role name for clients | `[]` |
|`keycloak_client_users` | List of user/role mappings for a client | `[]` | |`keycloak_realm_client_users` | List of user/role mappings for a client | `[]` |
The following variables are available for creating user federation: The following variables are available for creating user federation:
| Variable | Description | Default | | Variable | Description | Default |
|:---------|:------------|:---------| |:---------|:------------|:---------|
|`keycloak_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` | |`keycloak_realm_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
Variable formats Variable formats
---------------- ----------------
* `keycloak_user_federation`, a list of: * `keycloak_realm_user_federation`, a list of:
```yaml ```yaml
- realm: <name of the realm in which user federation should be configured, required> - realm: <name of the realm in which user federation should be configured, required>
@@ -68,24 +68,24 @@ Variable formats
Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables. Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables.
* `keycloak_clients`, a list of: * `keycloak_realm_clients`, a list of:
```yaml ```yaml
- name: <name of the client> - name: <name of the client>
id: <id of the client> id: <id of the client>
client_id: <id of the client> client_id: <id of the client>
secret: <secret of the client (Optional)> secret: <secret of the client (Optional)>
roles: <keycloak_client_default_roles> roles: <keycloak_realm_client_default_roles>
realm: <name of the realm that contains the client> realm: <name of the realm that contains the client>
public_client: <true for public, false for confidential> public_client: <true for public, false for confidential>
web_origins: <list of allowed we origins for the client> web_origins: <list of allowed we origins for the client>
users: <keycloak_client_users> users: <keycloak_realm_client_users>
``` ```
`name` and either `id` or `client_id` are required. `name` and either `id` or `client_id` are required.
* `keycloak_client_users`, a list of: * `keycloak_realm_client_users`, a list of:
```yaml ```yaml
- username: <username, required> - username: <username, required>
@@ -118,7 +118,7 @@ For features not covered by this role, the collection provides dedicated modules
| `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) | | `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) |
| `keycloak_client` | Clients (also used internally by this role) | | `keycloak_client` | Clients (also used internally by this role) |
| `keycloak_role` | Realm and client roles | | `keycloak_role` | Realm and client roles |
| `keycloak_user_federation` | User federations such as LDAP (also used internally by this role) | | `keycloak_realm_user_federation` | User federations such as LDAP (also used internally by this role) |
Example Playbook Example Playbook

49
roles/keycloak_realm/defaults/main.yml
View File

@@ -1,18 +1,18 @@
--- ---
### Keycloak configuration settings ### Keycloak configuration settings
keycloak_host: localhost keycloak_realm_host: localhost
keycloak_http_port: 8080 keycloak_realm_http_port: 8080
keycloak_https_port: 8443 keycloak_realm_https_port: 8443
keycloak_management_http_port: 9990 keycloak_realm_management_http_port: 9990
### Keycloak administration console user ### Keycloak administration console user
keycloak_admin_user: admin keycloak_realm_admin_user: admin
keycloak_auth_realm: master keycloak_realm_auth_realm: master
keycloak_auth_client: admin-cli keycloak_realm_auth_client: admin-cli
keycloak_context: '' keycloak_realm_context: ''
# administrator console password, this is a required variable # administrator console password, this is a required variable
keycloak_admin_password: '' keycloak_realm_admin_password: ''
### Keycloak realms, clients, roles, federation ### Keycloak realms, clients, roles, federation
# list of clients to create in the realm # list of clients to create in the realm
@@ -26,35 +26,36 @@ keycloak_admin_password: ''
# and users is a list of account, see below for the format definition # and users is a list of account, see below for the format definition
# an empty name will skip the creation of the client # an empty name will skip the creation of the client
# #
# keycloak_clients: # keycloak_realm_clients:
# - name: '' # - name: ''
# roles: "{{ keycloak_client_default_roles }}" # roles: "{{ keycloak_realm_client_default_roles }}"
# realm: "{{ keycloak_realm }}" # realm: "{{ keycloak_realm_realm }}"
# public_client: "{{ keycloak_client_public }}" # public_client: "{{ keycloak_realm_client_public }}"
# web_origins: "{{ keycloak_client_web_origins }}" # web_origins: "{{ keycloak_realm_client_web_origins }}"
# redirect_uris: "{{ keycloak_client_redirect_uris }}" # redirect_uris: "{{ keycloak_realm_client_redirect_uris }}"
# users: "{{ keycloak_client_users }}" # users: "{{ keycloak_realm_client_users }}"
keycloak_clients: [] keycloak_realm_clients: []
# list of roles to create in the client # list of roles to create in the client
keycloak_client_default_roles: [] keycloak_realm_client_default_roles: []
# if True, create a public client; otherwise, a confidetial client # if True, create a public client; otherwise, a confidetial client
keycloak_client_public: true keycloak_realm_client_public: true
# allowed web origins for the client # allowed web origins for the client
keycloak_client_web_origins: '/*' keycloak_realm_client_web_origins: '/*'
# list of user and role mappings to create in the client # list of user and role mappings to create in the client
# Each user has the form: # Each user has the form:
# { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] } # { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] }
# where each client_role has the form: # where each client_role has the form:
# { client: '', role: '', realm: '' } # { client: '', role: '', realm: '' }
keycloak_client_users: [] keycloak_realm_client_users: []
### List of Keycloak User Federation ### List of Keycloak User Federation
keycloak_user_federation: [] keycloak_realm_user_federation: []
# other settings # other settings
keycloak_url: "http://{{ keycloak_host }}:{{ keycloak_http_port + (keycloak_jboss_port_offset | default(0)) }}" keycloak_realm_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
keycloak_management_url: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + (keycloak_jboss_port_offset | default(0)) }}" keycloak_realm_management_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
keycloak_realm_no_log: true

40
roles/keycloak_realm/meta/argument_specs.yml
View File

@@ -1,94 +1,94 @@
argument_specs: argument_specs:
main: main:
options: options:
keycloak_host: keycloak_realm_host:
# line 3 of keycloak_realm/defaults/main.yml # line 3 of keycloak_realm/defaults/main.yml
default: "localhost" default: "localhost"
description: "Hostname for rest calls" description: "Hostname for rest calls"
type: "str" type: "str"
keycloak_context: keycloak_realm_context:
# line 5 of keycloak_realm/defaults/main.yml # line 5 of keycloak_realm/defaults/main.yml
default: "" default: ""
description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)" description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)"
type: "str" type: "str"
keycloak_http_port: keycloak_realm_http_port:
# line 4 of keycloak_realm/defaults/main.yml # line 4 of keycloak_realm/defaults/main.yml
default: 8080 default: 8080
description: "HTTP port" description: "HTTP port"
type: "int" type: "int"
keycloak_https_port: keycloak_realm_https_port:
# line 5 of keycloak_realm/defaults/main.yml # line 5 of keycloak_realm/defaults/main.yml
default: 8443 default: 8443
description: "HTTPS port" description: "HTTPS port"
type: "int" type: "int"
keycloak_management_http_port: keycloak_realm_management_http_port:
# line 6 of keycloak_realm/defaults/main.yml # line 6 of keycloak_realm/defaults/main.yml
default: 9990 default: 9990
description: "Management port" description: "Management port"
type: "int" type: "int"
keycloak_admin_user: keycloak_realm_admin_user:
# line 10 of keycloak_realm/defaults/main.yml # line 10 of keycloak_realm/defaults/main.yml
default: "admin" default: "admin"
description: "Administration console user account" description: "Administration console user account"
type: "str" type: "str"
keycloak_auth_realm: keycloak_realm_auth_realm:
# line 11 of keycloak_realm/defaults/main.yml # line 11 of keycloak_realm/defaults/main.yml
default: "master" default: "master"
description: "Name of the main authentication realm" description: "Name of the main authentication realm"
type: "str" type: "str"
keycloak_auth_client: keycloak_realm_auth_client:
# line 12 of keycloak_realm/defaults/main.yml # line 12 of keycloak_realm/defaults/main.yml
default: "admin-cli" default: "admin-cli"
description: "Authentication client for configuration REST calls" description: "Authentication client for configuration REST calls"
type: "str" type: "str"
keycloak_client_default_roles: keycloak_realm_client_default_roles:
# line 36 of keycloak_realm/defaults/main.yml # line 36 of keycloak_realm/defaults/main.yml
default: "[]" default: "[]"
description: "List of roles to configure as client default" description: "List of roles to configure as client default"
type: "list" type: "list"
keycloak_client_public: keycloak_realm_client_public:
# line 39 of keycloak_realm/defaults/main.yml # line 39 of keycloak_realm/defaults/main.yml
default: true default: true
description: "Configure a public realm client" description: "Configure a public realm client"
type: "bool" type: "bool"
keycloak_client_web_origins: keycloak_realm_client_web_origins:
# line 42 of keycloak_realm/defaults/main.yml # line 42 of keycloak_realm/defaults/main.yml
default: "/*" default: "/*"
description: "Web origins for realm client" description: "Web origins for realm client"
type: "str" type: "str"
keycloak_client_users: keycloak_realm_client_users:
# line 49 of keycloak_realm/defaults/main.yml # line 49 of keycloak_realm/defaults/main.yml
default: "[]" default: "[]"
description: "List of users to configure in the realm client" description: "List of users to configure in the realm client"
type: "list" type: "list"
keycloak_user_federation: keycloak_realm_user_federation:
# line 52 of keycloak_realm/defaults/main.yml # line 52 of keycloak_realm/defaults/main.yml
default: "[]" default: "[]"
description: "List of user federations to configure in the realm" description: "List of user federations to configure in the realm"
type: "list" type: "list"
keycloak_admin_password: keycloak_realm_admin_password:
# line 5 of keycloak_realm/vars/main.yml # line 5 of keycloak_realm/vars/main.yml
required: true required: true
description: "Password for the administration console user account" description: "Password for the administration console user account"
type: "str" type: "str"
keycloak_realm: keycloak_realm_realm:
# line 8 of keycloak_realm/vars/main.yml # line 8 of keycloak_realm/vars/main.yml
required: true required: true
description: "Name of the realm to be configured" description: "Name of the realm to be configured"
type: "str" type: "str"
keycloak_clients: keycloak_realm_clients:
# line 11 of keycloak_realm/vars/main.yml # line 11 of keycloak_realm/vars/main.yml
default: "[]" default: "[]"
description: "List of client declarations for the realm" description: "List of client declarations for the realm"
type: "list" type: "list"
keycloak_url: keycloak_realm_url:
# line 14 of keycloak_realm/vars/main.yml # line 14 of keycloak_realm/vars/main.yml
default: "http://{{ keycloak_host }}:{{ keycloak_http_port + ( keycloak_jboss_port_offset | default(0) ) }}" default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
description: "URL for configuration rest calls" description: "URL for configuration rest calls"
type: "str" type: "str"
keycloak_management_url: keycloak_realm_management_url:
# line 15 of keycloak_realm/vars/main.yml # line 15 of keycloak_realm/vars/main.yml
default: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + ( keycloak_jboss_port_offset | default(0) ) }}" default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
description: "URL for management console rest calls" description: "URL for management console rest calls"
type: "str" type: "str"
downstream: downstream:

64
roles/keycloak_realm/tasks/main.yml
View File

@@ -1,19 +1,19 @@
--- ---
- name: Generate keycloak auth token - name: Generate keycloak auth token
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
method: POST method: POST
body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password" body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
validate_certs: false validate_certs: false
no_log: "{{ keycloak_no_log | default('True') }}" no_log: "{{ keycloak_realm_no_log | default('True') }}"
register: keycloak_auth_response register: keycloak_realm_auth_response
until: keycloak_auth_response.status == 200 until: keycloak_realm_auth_response.status == 200
retries: 5 retries: 5
delay: 2 delay: 2
- name: "Determine if realm exists" - name: "Determine if realm exists"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
method: GET method: GET
validate_certs: false validate_certs: false
status_code: status_code:
@@ -21,38 +21,38 @@
- 404 - 404
headers: headers:
Accept: "application/json" Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_realm_exists register: keycloak_realm_realm_exists
- name: Create Realm - name: Create Realm
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms"
method: POST method: POST
body: "{{ lookup('template', 'realm.json.j2') }}" body: "{{ lookup('template', 'realm.json.j2') }}"
validate_certs: false validate_certs: false
body_format: json body_format: json
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 201 status_code: 201
when: keycloak_realm_exists.status == 404 when: keycloak_realm_realm_exists.status == 404
- name: Create user federation - name: Create user federation
middleware_automation.keycloak.keycloak_user_federation: middleware_automation.keycloak.keycloak_user_federation:
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_auth_realm }}" auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}" auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_admin_password }}" auth_password: "{{ keycloak_realm_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm) }}" realm: "{{ item.realm | default(keycloak_realm_realm) }}"
name: "{{ item.name }}" name: "{{ item.name }}"
state: present state: present
provider_id: "{{ item.provider_id }}" provider_id: "{{ item.provider_id }}"
provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}" provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}"
config: "{{ item.config }}" config: "{{ item.config }}"
mappers: "{{ item.mappers | default(omit) }}" mappers: "{{ item.mappers | default(omit) }}"
no_log: "{{ keycloak_no_log | default('True') }}" no_log: "{{ keycloak_realm_no_log | default('True') }}"
register: create_user_federation_result register: keycloak_realm_create_user_federation_result
loop: "{{ keycloak_user_federation | flatten }}" loop: "{{ keycloak_realm_user_federation | flatten }}"
when: keycloak_user_federation is defined when: keycloak_realm_user_federation is defined
- name: Validate Keycloak clients - name: Validate Keycloak clients
ansible.builtin.assert: ansible.builtin.assert:
@@ -61,18 +61,18 @@
- (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0) - (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0)
fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required" fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required"
quiet: true quiet: true
loop: "{{ keycloak_clients | flatten }}" loop: "{{ keycloak_realm_clients | flatten }}"
loop_control: loop_control:
label: "{{ item.name | default('unnamed client') }}" label: "{{ item.name | default('unnamed client') }}"
- name: Create or update a Keycloak client - name: Create or update a Keycloak client
middleware_automation.keycloak.keycloak_client: middleware_automation.keycloak.keycloak_client:
auth_client_id: "{{ keycloak_auth_client }}" auth_client_id: "{{ keycloak_realm_auth_client }}"
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_auth_realm }}" auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}" auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_admin_password }}" auth_password: "{{ keycloak_realm_admin_password }}"
realm: "{{ item.realm | default(keycloak_realm) }}" realm: "{{ item.realm | default(keycloak_realm_realm) }}"
default_roles: "{{ item.roles | default(omit) }}" default_roles: "{{ item.roles | default(omit) }}"
client_id: "{{ item.client_id | default(omit) }}" client_id: "{{ item.client_id | default(omit) }}"
id: "{{ item.id | default(omit) }}" id: "{{ item.id | default(omit) }}"
@@ -94,21 +94,21 @@
protocol: "{{ item.protocol | default(omit) }}" protocol: "{{ item.protocol | default(omit) }}"
attributes: "{{ item.attributes | default(omit) }}" attributes: "{{ item.attributes | default(omit) }}"
state: present state: present
no_log: "{{ keycloak_no_log | default('false') }}" no_log: "{{ keycloak_realm_no_log | default('false') }}"
register: create_client_result register: keycloak_realm_create_client_result
loop: "{{ keycloak_clients | flatten }}" loop: "{{ keycloak_realm_clients | flatten }}"
when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined) when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined)
- name: Create client roles - name: Create client roles
ansible.builtin.include_tasks: manage_client_roles.yml ansible.builtin.include_tasks: manage_client_roles.yml
loop: "{{ keycloak_clients | flatten }}" loop: "{{ keycloak_realm_clients | flatten }}"
loop_control: loop_control:
loop_var: client loop_var: client
when: "'roles' in client" when: "'roles' in client"
- name: Create client users - name: Create client users
ansible.builtin.include_tasks: manage_client_users.yml ansible.builtin.include_tasks: manage_client_users.yml
loop: "{{ keycloak_clients | flatten }}" loop: "{{ keycloak_realm_clients | flatten }}"
loop_control: loop_control:
loop_var: client loop_var: client
when: "'users' in client" when: "'users' in client"

14
roles/keycloak_realm/tasks/manage_client_roles.yml
View File

@@ -1,13 +1,13 @@
- name: Create client roles - name: Create client roles
middleware_automation.keycloak.keycloak_role: middleware_automation.keycloak.keycloak_role:
name: "{{ item }}" name: "{{ item }}"
realm: "{{ client.realm | default(keycloak_realm) }}" realm: "{{ client.realm | default(keycloak_realm_realm) }}"
client_id: "{{ client.client_id }}" client_id: "{{ client.client_id }}"
auth_client_id: "{{ keycloak_auth_client }}" auth_client_id: "{{ keycloak_realm_auth_client }}"
auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
auth_realm: "{{ keycloak_auth_realm }}" auth_realm: "{{ keycloak_realm_auth_realm }}"
auth_username: "{{ keycloak_admin_user }}" auth_username: "{{ keycloak_realm_admin_user }}"
auth_password: "{{ keycloak_admin_password }}" auth_password: "{{ keycloak_realm_admin_password }}"
state: present state: present
loop: "{{ client.roles | flatten }}" loop: "{{ client.roles | flatten }}"
no_log: "{{ keycloak_no_log | default('True') }}" no_log: "{{ keycloak_realm_no_log | default('True') }}"

4
roles/keycloak_realm/tasks/manage_token_lifespan.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: "Update Access token lifespan" - name: "Update Access token lifespan"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
method: PUT method: PUT
body: body:
accessTokenLifespan: 300 accessTokenLifespan: 300
@@ -11,4 +11,4 @@
- 200 - 200
- 204 - 204
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"

24
roles/keycloak_realm/tasks/manage_user.yml
View File

@@ -1,15 +1,15 @@
--- ---
- name: "Check if User Already Exists" - name: "Check if User Already Exists"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
validate_certs: false validate_certs: false
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_user_search_result register: keycloak_realm_user_search_result
- name: "Create User" - name: "Create User"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users"
method: POST method: POST
body: body:
enabled: true enabled: true
@@ -21,21 +21,21 @@
validate_certs: false validate_certs: false
body_format: json body_format: json
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 201 status_code: 201
when: keycloak_user_search_result.json | length == 0 when: keycloak_realm_user_search_result.json | length == 0
- name: "Get User" - name: "Get User"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
validate_certs: false validate_certs: false
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_user register: keycloak_realm_user
- name: "Update User Password" - name: "Update User Password"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users/{{ (keycloak_user.json | first).id }}/reset-password" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users/{{ (keycloak_realm_user.json | first).id }}/reset-password"
method: PUT method: PUT
body: body:
type: password type: password
@@ -47,5 +47,5 @@
- 200 - 200
- 204 - 204
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_user register: keycloak_realm_user

22
roles/keycloak_realm/tasks/manage_user_client_roles.yml
View File

@@ -1,20 +1,20 @@
--- ---
- name: "Get Realm for role" - name: "Get Realm for role"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm) }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm_realm) }}"
method: GET method: GET
validate_certs: false validate_certs: false
status_code: status_code:
- 200 - 200
headers: headers:
Accept: "application/json" Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: client_role_realm register: keycloak_realm_client_role_realm
- name: Check if Mapping is available - name: Check if Mapping is available
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \ url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \ default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available" selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available"
method: GET method: GET
validate_certs: false validate_certs: false
@@ -22,13 +22,13 @@
- 200 - 200
headers: headers:
Accept: "application/json" Accept: "application/json"
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: client_role_user_available register: keycloak_realm_client_role_user_available
- name: "Create Role Mapping" - name: "Create Role Mapping"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \ url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \ default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}" selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}"
method: POST method: POST
body: body:
@@ -40,7 +40,7 @@
validate_certs: false validate_certs: false
body_format: json body_format: json
headers: headers:
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
status_code: 204 status_code: 204
loop: "{{ client_role_user_available.json | flatten }}" loop: "{{ keycloak_realm_client_role_user_available.json | flatten }}"
when: item.name == client_role.role when: item.name == client_role.role

16
roles/keycloak_realm/tasks/manage_user_roles.yml
View File

@@ -1,21 +1,21 @@
--- ---
- name: "Get User {{ user.username }}" - name: "Get User {{ user.username }}"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
headers: headers:
validate_certs: false validate_certs: false
Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
register: keycloak_user register: keycloak_realm_user
- name: Refresh keycloak auth token - name: Refresh keycloak auth token
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token" url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
method: POST method: POST
body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password" body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
validate_certs: false validate_certs: false
register: keycloak_auth_response register: keycloak_realm_auth_response
no_log: "{{ keycloak_no_log | default('True') }}" no_log: "{{ keycloak_realm_no_log | default('True') }}"
until: keycloak_auth_response.status == 200 until: keycloak_realm_auth_response.status == 200
retries: 5 retries: 5
delay: 2 delay: 2

4
roles/keycloak_realm/templates/realm.json.j2
View File

@@ -1,6 +1,6 @@
{ {
"id": "{{ keycloak_realm }}", "id": "{{ keycloak_realm_realm }}",
"realm": "{{ keycloak_realm }}", "realm": "{{ keycloak_realm_realm }}",
"enabled": true, "enabled": true,
"eventsEnabled": true, "eventsEnabled": true,
"eventsExpiration": 7200 "eventsExpiration": 7200

2
roles/keycloak_realm/vars/main.yml
View File

@@ -2,4 +2,4 @@
# vars file for keycloak_realm # vars file for keycloak_realm
# name of the realm to create, this is a required variable # name of the realm to create, this is a required variable
keycloak_realm: keycloak_realm_realm: