From b9181abb24068881754eba3bc42b05d7a3b0a4d7 Mon Sep 17 00:00:00 2001 From: Helmut Wolf Date: Wed, 1 Jul 2026 09:22:32 +0200 Subject: [PATCH] fix(keycloak_quarkus): avoid leaking maven provider password in logs The Validate providers / Download custom providers via http / Copy local providers tasks loop over all providers and print the item (including maven.password) in cleartext, even for skipped iterations. Add the same conditional no_log the maven download/copy tasks already use so entries carrying a secret are censored while url/local providers stay visible. Refs ansible-middleware/keycloak#362 Co-Authored-By: Claude Opus 4.8 (1M context) --- roles/keycloak_quarkus/tasks/install.yml | 2 ++ roles/keycloak_quarkus/tasks/prereqs.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/roles/keycloak_quarkus/tasks/install.yml b/roles/keycloak_quarkus/tasks/install.yml index f141374..64d6fc8 100644 --- a/roles/keycloak_quarkus/tasks/install.yml +++ b/roles/keycloak_quarkus/tasks/install.yml @@ -246,6 +246,7 @@ become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" loop: "{{ keycloak_quarkus_providers }}" when: item.url is defined and item.url | length > 0 + no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}" notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}" # this requires the `lxml` package to be installed; we redirect this step to localhost such that we do need to install it on the remote hosts @@ -289,6 +290,7 @@ become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" loop: "{{ keycloak_quarkus_providers }}" when: item.local_path is defined + no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}" notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}" - name: Ensure required folder structure for policies exists diff --git a/roles/keycloak_quarkus/tasks/prereqs.yml b/roles/keycloak_quarkus/tasks/prereqs.yml index f3dd8a1..43c519c 100644 --- a/roles/keycloak_quarkus/tasks/prereqs.yml +++ b/roles/keycloak_quarkus/tasks/prereqs.yml @@ -123,6 +123,7 @@ fail_msg: > Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property loop: "{{ keycloak_quarkus_providers }}" + no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}" - name: "Validate policies" ansible.builtin.assert: