Merge pull request #363 from world-direct/fix/no_log-provider-secrets

fix(keycloak_quarkus): avoid leaking maven provider password in logs

roles/keycloak_quarkus/tasks/install.yml

@@ -246,6 +246,7 @@
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   loop: "{{ keycloak_quarkus_providers }}"
   when: item.url is defined and item.url | length > 0
+  no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
   notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
 
 # this requires the `lxml` package to be installed; we redirect this step to localhost such that we do need to install it on the remote hosts
@@ -289,6 +290,7 @@
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   loop: "{{ keycloak_quarkus_providers }}"
   when: item.local_path is defined
+  no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
   notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
 
 - name: Ensure required folder structure for policies exists

roles/keycloak_quarkus/tasks/prereqs.yml

@@ -123,6 +123,7 @@
     fail_msg: >
       Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property
   loop: "{{ keycloak_quarkus_providers }}"
+  no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
 
 - name: "Validate policies"
   ansible.builtin.assert: