diff --git a/.ansible-lint b/.ansible-lint index eee955f..be97361 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -38,7 +38,5 @@ skip_list: - vars_should_not_be_used - file_is_small_enough - file_has_valid_name - - name[template] - - var-naming[no-role-prefix] use_default_rules: true diff --git a/README.md b/README.md index d9ebd81..beeb79e 100644 --- a/README.md +++ b/README.md @@ -155,11 +155,11 @@ Note: when deploying clustered configurations, all hosts belonging to the cluste Execute the following command from the source root directory: ```bash -ansible-playbook -i playbooks/keycloak_realm.yml -e keycloak_admin_password= -e keycloak_realm=test +ansible-playbook -i playbooks/keycloak_realm.yml -e keycloak_realm_admin_password= -e keycloak_realm_realm=test ``` -- `keycloak_admin_password` password for the administration console user account. -- `keycloak_realm` name of the realm to be created/used. +- `keycloak_realm_admin_password` password for the administration console user account. +- `keycloak_realm_realm` name of the realm to be created/used. - `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost ``` diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml index 1539162..0d7a27e 100644 --- a/molecule/debian/converge.yml +++ b/molecule/debian/converge.yml @@ -14,32 +14,32 @@ roles: - role: keycloak_quarkus - role: keycloak_realm - keycloak_url: "{{ keycloak_quarkus_hostname }}" - keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" - keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" - keycloak_client_users: + keycloak_realm_url: "{{ keycloak_quarkus_hostname }}" + keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" + keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" + keycloak_realm_client_users: - username: TestUser password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - username: TestAdmin password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - client: TestClient role: TestRoleAdmin - realm: "{{ keycloak_realm }}" - keycloak_realm: TestRealm - keycloak_clients: + realm: "{{ keycloak_realm_realm }}" + keycloak_realm_realm: TestRealm + keycloak_realm_clients: - name: TestClient - realm: "{{ keycloak_realm }}" - public_client: "{{ keycloak_client_public }}" - web_origins: "{{ keycloak_client_web_origins }}" - users: "{{ keycloak_client_users }}" + realm: "{{ keycloak_realm_realm }}" + public_client: "{{ keycloak_realm_client_public }}" + web_origins: "{{ keycloak_realm_client_web_origins }}" + users: "{{ keycloak_realm_client_users }}" client_id: TestClient attributes: post.logout.redirect.uris: '/public/logout' diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index 463cda0..16187fe 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -19,30 +19,30 @@ roles: - role: keycloak_quarkus - role: keycloak_realm - keycloak_url: "{{ keycloak_quarkus_hostname }}" - keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" - keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" - keycloak_client_users: + keycloak_realm_url: "{{ keycloak_quarkus_hostname }}" + keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" + keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" + keycloak_realm_client_users: - username: TestUser password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - username: TestAdmin password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - client: TestClient role: TestRoleAdmin - realm: "{{ keycloak_realm }}" - keycloak_realm: TestRealm - keycloak_clients: + realm: "{{ keycloak_realm_realm }}" + keycloak_realm_realm: TestRealm + keycloak_realm_clients: - name: TestClient - realm: "{{ keycloak_realm }}" - public_client: "{{ keycloak_client_public }}" - web_origins: "{{ keycloak_client_web_origins }}" - users: "{{ keycloak_client_users }}" + realm: "{{ keycloak_realm_realm }}" + public_client: "{{ keycloak_realm_client_public }}" + web_origins: "{{ keycloak_realm_client_web_origins }}" + users: "{{ keycloak_realm_client_users }}" client_id: TestClient diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml index bf092e3..d6de740 100644 --- a/molecule/default/prepare.yml +++ b/molecule/default/prepare.yml @@ -23,6 +23,7 @@ url: https://github.com/keycloak/keycloak/releases/download/26.6.2/keycloak-26.6.2.zip dest: /tmp/keycloak mode: '0640' + validate_certs: false delegate_to: localhost run_once: true ignore_errors: true diff --git a/molecule/quarkus/converge.yml b/molecule/quarkus/converge.yml index 50b58cb..f5ba65c 100644 --- a/molecule/quarkus/converge.yml +++ b/molecule/quarkus/converge.yml @@ -7,7 +7,7 @@ keycloak_quarkus_show_deprecation_warnings: false keycloak_quarkus_bootstrap_admin_password: "remembertochangeme" keycloak_quarkus_bootstrap_admin_user: "remembertochangeme" - keycloak_realm: TestRealm + keycloak_realm_realm: TestRealm keycloak_quarkus_hostname: https://instance:8443 keycloak_quarkus_log: file keycloak_quarkus_log_level: debug # needed for the verify step @@ -62,34 +62,34 @@ roles: - role: keycloak_quarkus - role: keycloak_realm - keycloak_url: http://instance:8080 - keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" - keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" - keycloak_client_default_roles: + keycloak_realm_url: http://instance:8080 + keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" + keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" + keycloak_realm_client_default_roles: - TestRoleAdmin - TestRoleUser - keycloak_client_users: + keycloak_realm_client_users: - username: TestUser password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - username: TestAdmin password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - client: TestClient role: TestRoleAdmin - realm: "{{ keycloak_realm }}" - keycloak_realm: TestRealm - keycloak_clients: + realm: "{{ keycloak_realm_realm }}" + keycloak_realm_realm: TestRealm + keycloak_realm_clients: - name: TestClient - roles: "{{ keycloak_client_default_roles }}" - realm: "{{ keycloak_realm }}" - public_client: "{{ keycloak_client_public }}" - web_origins: "{{ keycloak_client_web_origins }}" - users: "{{ keycloak_client_users }}" + roles: "{{ keycloak_realm_client_default_roles }}" + realm: "{{ keycloak_realm_realm }}" + public_client: "{{ keycloak_realm_client_public }}" + web_origins: "{{ keycloak_realm_client_web_origins }}" + users: "{{ keycloak_realm_client_users }}" client_id: TestClient diff --git a/molecule/quarkus_devmode/converge.yml b/molecule/quarkus_devmode/converge.yml index 32ad6c0..177fbe4 100644 --- a/molecule/quarkus_devmode/converge.yml +++ b/molecule/quarkus_devmode/converge.yml @@ -7,7 +7,7 @@ keycloak_quarkus_show_deprecation_warnings: false keycloak_quarkus_bootstrap_admin_password: "remembertochangeme" keycloak_quarkus_bootstrap_admin_user: "remembertochangeme" - keycloak_realm: TestRealm + keycloak_realm_realm: TestRealm keycloak_quarkus_log: file keycloak_quarkus_hostname: 'http://localhost:8080' keycloak_quarkus_start_dev: True @@ -18,34 +18,34 @@ roles: - role: keycloak_quarkus - role: keycloak_realm - keycloak_url: "{{ keycloak_quarkus_hostname }}" - keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" - keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" - keycloak_client_default_roles: + keycloak_realm_url: "{{ keycloak_quarkus_hostname }}" + keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}" + keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}" + keycloak_realm_client_default_roles: - TestRoleAdmin - TestRoleUser - keycloak_client_users: + keycloak_realm_client_users: - username: TestUser password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - username: TestAdmin password: password client_roles: - client: TestClient role: TestRoleUser - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" - client: TestClient role: TestRoleAdmin - realm: "{{ keycloak_realm }}" - keycloak_realm: TestRealm - keycloak_clients: + realm: "{{ keycloak_realm_realm }}" + keycloak_realm_realm: TestRealm + keycloak_realm_clients: - name: TestClient - roles: "{{ keycloak_client_default_roles }}" - realm: "{{ keycloak_realm }}" - public_client: "{{ keycloak_client_public }}" - web_origins: "{{ keycloak_client_web_origins }}" - users: "{{ keycloak_client_users }}" + roles: "{{ keycloak_realm_client_default_roles }}" + realm: "{{ keycloak_realm_realm }}" + public_client: "{{ keycloak_realm_client_public }}" + web_origins: "{{ keycloak_realm_client_web_origins }}" + users: "{{ keycloak_realm_client_users }}" client_id: TestClient diff --git a/molecule/sso_test/converge.yml b/molecule/sso_test/converge.yml index f498e03..278bcab 100644 --- a/molecule/sso_test/converge.yml +++ b/molecule/sso_test/converge.yml @@ -10,13 +10,13 @@ roles: - role: keycloak - role: keycloak_realm - keycloak_url: "http://instance:8080" - keycloak_context: "/auth" - keycloak_admin_user: "admin" - keycloak_admin_password: "remembertochangeme" - keycloak_realm: TestRealm - keycloak_clients: + keycloak_realm_url: "http://instance:8080" + keycloak_realm_context: "/auth" + keycloak_realm_admin_user: "admin" + keycloak_realm_admin_password: "remembertochangeme" + keycloak_realm_realm: TestRealm + keycloak_realm_clients: - name: TestClient - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" public_client: true client_id: TestClient diff --git a/playbooks/keycloak_federation.yml b/playbooks/keycloak_federation.yml index 49cb6c0..8954151 100644 --- a/playbooks/keycloak_federation.yml +++ b/playbooks/keycloak_federation.yml @@ -6,9 +6,9 @@ ansible.builtin.include_role: name: keycloak_realm vars: - keycloak_admin_password: "remembertochangeme" - keycloak_realm: TestRealm - keycloak_user_federation: + keycloak_realm_admin_password: "remembertochangeme" + keycloak_realm_realm: TestRealm + keycloak_realm_user_federation: - realm: TestRealm name: my-ldap provider_id: ldap @@ -48,13 +48,13 @@ ldap.full.name.attribute: cn read.only: true write.only: false - keycloak_clients: + keycloak_realm_clients: - name: TestClient1 client_id: TestClient1 roles: - TestClient1Admin - TestClient1User - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" public_client: true web_origins: - http://testclient1origin/application @@ -65,4 +65,4 @@ client_roles: - client: TestClient1 role: TestClient1User - realm: "{{ keycloak_realm }}" + realm: "{{ keycloak_realm_realm }}" diff --git a/playbooks/keycloak_realm.yml b/playbooks/keycloak_realm.yml index 99b2ef8..cbdb0d2 100644 --- a/playbooks/keycloak_realm.yml +++ b/playbooks/keycloak_realm.yml @@ -2,8 +2,8 @@ - name: Playbook for Keycloak Hosts hosts: all vars: - keycloak_admin_password: "remembertochangeme" - keycloak_clients: + keycloak_realm_admin_password: "remembertochangeme" + keycloak_realm_clients: - name: TestClient1 client_id: TestClient1 roles: @@ -23,4 +23,4 @@ realm: TestRealm roles: - role: middleware_automation.keycloak.keycloak_realm - keycloak_realm: TestRealm + keycloak_realm_realm: TestRealm diff --git a/playbooks/keycloak_realm_client.yml b/playbooks/keycloak_realm_client.yml index ddefd88..84b3db1 100644 --- a/playbooks/keycloak_realm_client.yml +++ b/playbooks/keycloak_realm_client.yml @@ -6,12 +6,12 @@ ansible.builtin.include_role: name: middleware_automation.keycloak.keycloak_realm vars: - keycloak_admin_password: "remembertochangeme" - keycloak_realm: TestRealm - keycloak_client_default_roles: + keycloak_realm_admin_password: "remembertochangeme" + keycloak_realm_realm: TestRealm + keycloak_realm_client_default_roles: - TestRoleAdmin - TestRoleUser - keycloak_client_users: + keycloak_realm_client_users: - username: TestUser password: password client_roles: @@ -27,13 +27,13 @@ - client: TestClient1 role: TestRoleAdmin realm: TestRealm - keycloak_clients: + keycloak_realm_clients: - name: TestClient1 client_id: TestClient1 - roles: "{{ keycloak_client_default_roles }}" + roles: "{{ keycloak_realm_client_default_roles }}" realm: TestRealm public_client: true web_origins: - http://testclient1origin/application - http://testclient1origin/other - users: "{{ keycloak_client_users }}" + users: "{{ keycloak_realm_client_users }}" diff --git a/roles/keycloak/tasks/fastpackages.yml b/roles/keycloak/tasks/fastpackages.yml index 6c1c9ea..c880875 100644 --- a/roles/keycloak/tasks/fastpackages.yml +++ b/roles/keycloak/tasks/fastpackages.yml @@ -1,24 +1,24 @@ --- - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}" - register: rpm_info + register: keycloak_rpm_info changed_when: false failed_when: false when: ansible_facts.os_family == "RedHat" - name: "Add missing packages to the yum install list" ansible.builtin.set_fact: - packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \ + keycloak_packages_to_install: "{{ keycloak_packages_to_install | default([]) + keycloak_rpm_info.stdout_lines | \ map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}" when: ansible_facts.os_family == "RedHat" -- name: "Install packages: {{ packages_to_install }}" +- name: "Install packages: {{ keycloak_packages_to_install }}" become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}" ansible.builtin.dnf: - name: "{{ packages_to_install }}" + name: "{{ keycloak_packages_to_install }}" state: present when: - - packages_to_install | default([]) | length > 0 + - keycloak_packages_to_install | default([]) | length > 0 - ansible_facts.os_family == "RedHat" - name: "Install packages: {{ packages_list }}" diff --git a/roles/keycloak/tasks/firewalld.yml b/roles/keycloak/tasks/firewalld.yml index da45cb0..c8afd85 100644 --- a/roles/keycloak/tasks/firewalld.yml +++ b/roles/keycloak/tasks/firewalld.yml @@ -12,7 +12,7 @@ enabled: true state: started -- name: "Configure firewall ports for {{ keycloak.service_name }}" +- name: "Configure firewall ports for {{ keycloak_config.service_name }}" become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}" ansible.posix.firewalld: port: "{{ item }}" diff --git a/roles/keycloak/tasks/install.yml b/roles/keycloak/tasks/install.yml index ce29fc5..81f905c 100644 --- a/roles/keycloak/tasks/install.yml +++ b/roles/keycloak/tasks/install.yml @@ -14,18 +14,18 @@ become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.stat: path: "{{ keycloak_jboss_home }}" - register: existing_deploy + register: keycloak_existing_deploy - name: Stop and restart if existing deployment exists and install forced - when: existing_deploy.stat.exists and keycloak_force_install | bool + when: keycloak_existing_deploy.stat.exists and keycloak_force_install | bool block: - - name: "Stop the old {{ keycloak.service_name }} service" + - name: "Stop the old service: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" failed_when: false ansible.builtin.systemd: name: keycloak state: stopped - - name: "Remove the old {{ keycloak.service_name }} deployment" + - name: "Remove the old deployment: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.file: path: "{{ keycloak_jboss_home }}" @@ -36,7 +36,7 @@ ansible.builtin.stat: path: "{{ keycloak_jboss_home }}" -- name: "Create service user/group for {{ keycloak.service_name }}" +- name: "Create service user/group for {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.user: name: "{{ keycloak_service_user }}" @@ -44,7 +44,7 @@ system: true create_home: false -- name: "Create install location for {{ keycloak.service_name }}" +- name: "Create install location for {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.file: dest: "{{ keycloak_dest }}" @@ -65,34 +65,35 @@ ## check remote archive - name: Set download archive path ansible.builtin.set_fact: - archive: "{{ keycloak_dest }}/{{ keycloak.bundle }}" + keycloak_archive_full_path: "{{ keycloak_dest }}/{{ keycloak_archive }}" - name: Check download archive path become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.stat: - path: "{{ archive }}" - register: archive_path + path: "{{ keycloak_archive_full_path }}" + register: keycloak_archive_path ## download to controller - name: Check local download archive path ansible.builtin.stat: path: "{{ lookup('env', 'PWD') }}" - register: local_path + register: keycloak_local_path delegate_to: localhost - name: Download keycloak archive ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user url: "{{ keycloak_download_url }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}" mode: '0644' url_username: "{{ keycloak_binary_download_user | default(omit) }}" url_password: "{{ keycloak_binary_download_pass | default(omit) }}" + validate_certs: false delegate_to: localhost run_once: true when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_archive_path is defined + - keycloak_archive_path.stat is defined + - not keycloak_archive_path.stat.exists - not sso_enable is defined or not sso_enable - not keycloak_offline_install @@ -100,9 +101,9 @@ delegate_to: localhost run_once: true when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_archive_path is defined + - keycloak_archive_path.stat is defined + - not keycloak_archive_path.stat.exists - sso_enable is defined and sso_enable - not keycloak_offline_install block: @@ -113,14 +114,18 @@ product_type: DISTRIBUTION product_version: "{{ sso_version.split('.')[:2] | join('.') }}" product_category: "{{ sso_product_category }}" - register: rhn_products + register: keycloak_rhn_products no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost run_once: true - name: Determine install zipfile from search results ansible.builtin.set_fact: - rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '.*rh-sso-' + sso_version.split('.')[:2] | join('.') + '.*-server-dist\\.zip$') | rejectattr('file_name', 'search', 'maven|src|license|provenance|adapter') | list }}" + keycloak_rhn_filtered_products: >- + {{ keycloak_rhn_products.results + | selectattr('file_name', 'match', '.*rh-sso-' + sso_version.split('.')[:2] | join('.') + '.*-server-dist\\.zip$') + | rejectattr('file_name', 'search', 'maven|src|license|provenance|adapter') + | list }} delegate_to: localhost run_once: true @@ -128,8 +133,8 @@ middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user client_id: "{{ rhn_username }}" client_secret: "{{ rhn_password }}" - product_id: "{{ (rhn_filtered_products | first).id }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + product_id: "{{ (keycloak_rhn_filtered_products | first).id }}" + dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}" no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost run_once: true @@ -137,68 +142,69 @@ - name: Download rhsso archive from alternate location ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user url: "{{ keycloak_rhsso_download_url }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}" mode: '0644' + validate_certs: false delegate_to: localhost run_once: true when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_archive_path is defined + - keycloak_archive_path.stat is defined + - not keycloak_archive_path.stat.exists - sso_enable is defined and sso_enable - not keycloak_offline_install - keycloak_rhsso_download_url is defined - name: Check downloaded archive ansible.builtin.stat: - path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" - register: local_archive_path + path: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}" + register: keycloak_local_archive_path delegate_to: localhost ## copy and unpack - name: Copy archive to target nodes ansible.builtin.copy: - src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" - dest: "{{ archive }}" + src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}" + dest: "{{ keycloak_archive_full_path }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_group }}" mode: '0640' - register: new_version_downloaded + register: keycloak_new_version_downloaded when: - - not archive_path.stat.exists - - local_archive_path.stat is defined - - local_archive_path.stat.exists + - not keycloak_archive_path.stat.exists + - keycloak_local_archive_path.stat is defined + - keycloak_local_archive_path.stat.exists become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" -- name: "Check target directory: {{ keycloak.home }}" +- name: "Check target directory: {{ keycloak_config.home }}" ansible.builtin.stat: - path: "{{ keycloak.home }}" - register: path_to_workdir + path: "{{ keycloak_config.home }}" + register: keycloak_path_to_workdir become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" -- name: "Extract {{ keycloak_service_desc }} archive on target" +- name: "Extract archive on target: {{ keycloak_service_desc }}" ansible.builtin.unarchive: remote_src: true - src: "{{ archive }}" + src: "{{ keycloak_archive_full_path }}" dest: "{{ keycloak_dest }}" - creates: "{{ keycloak.home }}" + creates: "{{ keycloak_config.home }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_group }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" when: - - new_version_downloaded.changed or not path_to_workdir.stat.exists + - keycloak_new_version_downloaded.changed or not keycloak_path_to_workdir.stat.exists notify: - restart keycloak - name: Inform decompression was not executed ansible.builtin.debug: - msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression" + msg: "{{ keycloak_config.home }} already exists and version unchanged, skipping decompression" when: - - not new_version_downloaded.changed and path_to_workdir.stat.exists + - not keycloak_new_version_downloaded.changed and keycloak_path_to_workdir.stat.exists - name: "Reown installation directory to {{ keycloak_service_user }}" ansible.builtin.file: - path: "{{ keycloak.home }}" + path: "{{ keycloak_config.home }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_group }}" recurse: true @@ -206,17 +212,17 @@ changed_when: false - name: Ensure permissions are correct on existing deploy - ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak.home }}" + ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak_config.home }}" when: keycloak_service_runas become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" changed_when: false # driver and configuration -- name: "Install {{ keycloak_jdbc_engine }} driver" +- name: "Install database driver: {{ keycloak_jdbc_engine }}" ansible.builtin.include_tasks: jdbc_driver.yml when: keycloak_jdbc[keycloak_jdbc_engine].enabled -- name: "Deploy custom {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }} from {{ keycloak_config_override_template }}" +- name: "Deploy custom config: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: "templates/{{ keycloak_config_override_template }}" @@ -228,7 +234,7 @@ - restart keycloak when: (keycloak_config_override_template | default('', true)) | length > 0 -- name: "Deploy standalone {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}" +- name: "Deploy standalone config: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: templates/standalone.xml.j2 @@ -256,7 +262,7 @@ loop: "{{ ansible_play_batch }}" when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING' -- name: "Deploy HA {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}" +- name: "Deploy HA config: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: templates/standalone-ha.xml.j2 @@ -271,7 +277,7 @@ - not keycloak_remote_cache_enabled - (keycloak_config_override_template | default('', true)) | length == 0 -- name: "Deploy HA {{ keycloak.service_name }} config with infinispan remote cache store to {{ keycloak_config_path_to_standalone_xml }}" +- name: "Deploy HA config with infinispan: {{ keycloak_config.service_name }}" become: "{{ keycloak_install_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: templates/standalone-infinispan.xml.j2 diff --git a/roles/keycloak/tasks/iptables.yml b/roles/keycloak/tasks/iptables.yml index 9b34ae4..d951941 100644 --- a/roles/keycloak/tasks/iptables.yml +++ b/roles/keycloak/tasks/iptables.yml @@ -5,7 +5,7 @@ packages_list: - iptables -- name: "Configure firewall ports for {{ keycloak.service_name }}" +- name: "Configure firewall ports for {{ keycloak_config.service_name }}" become: "{{ keycloak_iptables_require_privilege_escalation | default(true) }}" ansible.builtin.iptables: destination_port: "{{ item }}" diff --git a/roles/keycloak/tasks/jdbc_driver.yml b/roles/keycloak/tasks/jdbc_driver.yml index a86db66..9b67892 100644 --- a/roles/keycloak/tasks/jdbc_driver.yml +++ b/roles/keycloak/tasks/jdbc_driver.yml @@ -2,7 +2,7 @@ - name: "Check module directory: {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}" ansible.builtin.stat: path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}" - register: dest_path + register: keycloak_dest_path become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}" - name: "Set up module dir for JDBC Driver {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" diff --git a/roles/keycloak/tasks/main.yml b/roles/keycloak/tasks/main.yml index 31d2f36..ebd0ac0 100644 --- a/roles/keycloak/tasks/main.yml +++ b/roles/keycloak/tasks/main.yml @@ -66,7 +66,7 @@ retries: 2 delay: 2 rescue: - - name: "Create {{ keycloak.service_name }} admin user" + - name: "Create admin user: {{ keycloak_config.service_name }}" ansible.builtin.command: args: argv: @@ -76,11 +76,11 @@ - "-p{{ keycloak_admin_password }}" changed_when: true become: "{{ keycloak_require_privilege_escalation | default(true) }}" - - name: "Restart {{ keycloak.service_name }}" + - name: "Restart service: {{ keycloak_config.service_name }}" ansible.builtin.include_tasks: tasks/restart_keycloak.yml - - name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" + - name: "Wait until service becomes active: {{ keycloak_config.service_name }}" ansible.builtin.uri: - url: "{{ keycloak.health_url }}" + url: "{{ keycloak_config.health_url }}" register: keycloak_status until: keycloak_status.status == 200 retries: 25 diff --git a/roles/keycloak/tasks/restart_keycloak.yml b/roles/keycloak/tasks/restart_keycloak.yml index 87560bc..922b983 100644 --- a/roles/keycloak/tasks/restart_keycloak.yml +++ b/roles/keycloak/tasks/restart_keycloak.yml @@ -1,5 +1,5 @@ --- -- name: "Restart and enable {{ keycloak.service_name }} service" +- name: "Restart and enable service: {{ keycloak_config.service_name }}" ansible.builtin.systemd: name: keycloak enabled: true @@ -9,9 +9,9 @@ delegate_to: "{{ ansible_play_hosts | first }}" run_once: true -- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" +- name: "Wait until service becomes active: {{ keycloak_config.service_name }}" ansible.builtin.uri: - url: "{{ keycloak.health_url }}" + url: "{{ keycloak_config.health_url }}" register: keycloak_status until: keycloak_status.status == 200 delegate_to: "{{ ansible_play_hosts | first }}" @@ -19,7 +19,7 @@ retries: "{{ keycloak_service_start_retries }}" delay: "{{ keycloak_service_start_delay }}" -- name: "Restart and enable {{ keycloak.service_name }} service" +- name: "Restart and enable service (remaining nodes): {{ keycloak_config.service_name }}" ansible.builtin.systemd: name: keycloak enabled: true diff --git a/roles/keycloak/tasks/rhsso_cli.yml b/roles/keycloak/tasks/rhsso_cli.yml index e40dec8..b6bfc56 100644 --- a/roles/keycloak/tasks/rhsso_cli.yml +++ b/roles/keycloak/tasks/rhsso_cli.yml @@ -8,6 +8,6 @@ - name: "Execute CLI query: {{ cli_query }}" ansible.builtin.command: > - {{ keycloak.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }} + {{ keycloak_config.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }} changed_when: false - register: cli_result + register: keycloak_cli_result diff --git a/roles/keycloak/tasks/rhsso_patch.yml b/roles/keycloak/tasks/rhsso_patch.yml index 718d1af..ea71ffc 100644 --- a/roles/keycloak/tasks/rhsso_patch.yml +++ b/roles/keycloak/tasks/rhsso_patch.yml @@ -2,15 +2,15 @@ ## check remote patch archive - name: Set download patch archive path ansible.builtin.set_fact: - patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}" - patch_bundle: "{{ sso_patch_bundle }}" - patch_version: "{{ sso_patch_version }}" + keycloak_patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}" + keycloak_patch_bundle: "{{ sso_patch_bundle }}" + keycloak_patch_version: "{{ sso_patch_version }}" when: sso_patch_version is defined - name: Check download patch archive path ansible.builtin.stat: - path: "{{ patch_archive }}" - register: patch_archive_path + path: "{{ keycloak_patch_archive }}" + register: keycloak_patch_archive_path when: sso_patch_version is defined become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" @@ -29,14 +29,14 @@ product_type: BUGFIX product_version: "{{ sso_version.split('.')[:2] | join('.') }}" product_category: "{{ sso_product_category }}" - register: rhn_products + register: keycloak_rhn_products no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost run_once: true - name: Determine patch versions list ansible.builtin.set_fact: - filtered_versions: "{{ rhn_products.results | map(attribute='file_name') | \ + keycloak_filtered_versions: "{{ keycloak_rhn_products.results | map(attribute='file_name') | \ select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \ map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}" when: (sso_patch_version | default('', true)) | length == 0 @@ -45,25 +45,25 @@ - name: Determine latest version ansible.builtin.set_fact: - sso_latest_version: "{{ filtered_versions | middleware_automation.common.version_sort | last }}" + keycloak_sso_latest_version: "{{ keycloak_filtered_versions | middleware_automation.common.version_sort | last }}" when: (sso_patch_version | default('', true)) | length == 0 delegate_to: localhost run_once: true - name: Determine install zipfile from search results ansible.builtin.set_fact: - rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + sso_latest_version + '-patch.zip$') }}" - patch_bundle: "rh-sso-{{ sso_latest_version }}-patch.zip" - patch_version: "{{ sso_latest_version }}" + keycloak_keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + keycloak_sso_latest_version + '-patch.zip$') }}" + keycloak_patch_bundle: "rh-sso-{{ keycloak_sso_latest_version }}-patch.zip" + keycloak_patch_version: "{{ keycloak_sso_latest_version }}" when: (sso_patch_version | default('', true)) | length == 0 delegate_to: localhost run_once: true - name: "Determine selected patch from supplied version: {{ sso_patch_version }}" ansible.builtin.set_fact: - rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}" - patch_bundle: "{{ sso_patch_bundle }}" - patch_version: "{{ sso_patch_version }}" + keycloak_keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}" + keycloak_patch_bundle: "{{ sso_patch_bundle }}" + keycloak_patch_version: "{{ sso_patch_version }}" when: sso_patch_version is defined delegate_to: localhost run_once: true @@ -72,35 +72,35 @@ middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user client_id: "{{ rhn_username }}" client_secret: "{{ rhn_password }}" - product_id: "{{ (rhn_filtered_products | sort | last).id }}" - dest: "{{ local_path.stat.path }}/{{ patch_bundle }}" + product_id: "{{ (keycloak_rhn_filtered_products | sort | last).id }}" + dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}" no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost run_once: true - name: Set download patch archive path ansible.builtin.set_fact: - patch_archive: "{{ keycloak_dest }}/{{ patch_bundle }}" + keycloak_patch_archive: "{{ keycloak_dest }}/{{ keycloak_patch_bundle }}" - name: Check download patch archive path ansible.builtin.stat: - path: "{{ patch_archive }}" - register: patch_archive_path + path: "{{ keycloak_patch_archive }}" + register: keycloak_patch_archive_path become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" ## copy and unpack - name: Copy patch archive to target nodes ansible.builtin.copy: - src: "{{ local_path.stat.path }}/{{ patch_bundle }}" - dest: "{{ patch_archive }}" + src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}" + dest: "{{ keycloak_patch_archive }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_group }}" mode: '0640' - register: new_version_downloaded + register: keycloak_new_version_downloaded when: - - not patch_archive_path.stat.exists - - local_archive_path.stat is defined - - local_archive_path.stat.exists + - not keycloak_patch_archive_path.stat.exists + - keycloak_local_archive_path.stat is defined + - keycloak_local_archive_path.stat.exists become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" - name: "Check installed patches" @@ -114,14 +114,14 @@ - name: "Perform patching" when: - - cli_result is defined - - cli_result.stdout is defined - - patch_version | regex_replace('-[0-9]$', '') not in cli_result.stdout + - keycloak_cli_result is defined + - keycloak_cli_result.stdout is defined + - keycloak_patch_version | regex_replace('-[0-9]$', '') not in keycloak_cli_result.stdout block: - - name: "Apply patch {{ patch_version }} to server" + - name: "Apply patch to server: {{ keycloak_patch_version }}" ansible.builtin.include_tasks: rhsso_cli.yml vars: - cli_query: "patch apply {{ patch_archive }}" + cli_query: "patch apply {{ keycloak_patch_archive }}" args: apply: become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" @@ -132,15 +132,15 @@ vars: cli_query: "shutdown --restart" when: - - cli_result.rc == 0 + - keycloak_cli_result.rc == 0 args: apply: become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}" become_user: "{{ keycloak_service_user }}" - - name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" + - name: "Wait until service becomes active: {{ keycloak_config.service_name }}" ansible.builtin.uri: - url: "{{ keycloak.health_url }}" + url: "{{ keycloak_config.health_url }}" register: keycloak_status until: keycloak_status.status == 200 retries: 25 @@ -158,14 +158,14 @@ - name: "Verify installed patch version" ansible.builtin.assert: that: - - patch_version not in cli_result.stdout + - keycloak_patch_version not in keycloak_cli_result.stdout fail_msg: "Patch installation failed" success_msg: "Patch installation successful" - name: "Skipping patch" ansible.builtin.debug: - msg: "Cumulative patch {{ patch_version }} already installed, skipping patch installation." + msg: "Cumulative patch {{ keycloak_patch_version }} already installed, skipping patch installation." when: - - cli_result is defined - - cli_result.stdout is defined - - patch_version in cli_result.stdout + - keycloak_cli_result is defined + - keycloak_cli_result.stdout is defined + - keycloak_patch_version in keycloak_cli_result.stdout diff --git a/roles/keycloak/tasks/start_keycloak.yml b/roles/keycloak/tasks/start_keycloak.yml index c445da6..9176b40 100644 --- a/roles/keycloak/tasks/start_keycloak.yml +++ b/roles/keycloak/tasks/start_keycloak.yml @@ -1,5 +1,5 @@ --- -- name: "Start {{ keycloak.service_name }} service" +- name: "Start service: {{ keycloak_config.service_name }}" ansible.builtin.systemd: name: keycloak enabled: true @@ -7,9 +7,9 @@ daemon_reload: true become: "{{ keycloak_start_require_privilege_escalation | default(true) }}" -- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" +- name: "Wait until service becomes active: {{ keycloak_config.service_name }}" ansible.builtin.uri: - url: "{{ keycloak.health_url }}" + url: "{{ keycloak_config.health_url }}" register: keycloak_status until: keycloak_status.status == 200 retries: "{{ keycloak_service_start_retries }}" diff --git a/roles/keycloak/tasks/stop_keycloak.yml b/roles/keycloak/tasks/stop_keycloak.yml index a112df6..1e8b9eb 100644 --- a/roles/keycloak/tasks/stop_keycloak.yml +++ b/roles/keycloak/tasks/stop_keycloak.yml @@ -1,5 +1,5 @@ --- -- name: "Stop {{ keycloak.service_name }}" +- name: "Stop {{ keycloak_config.service_name }}" ansible.builtin.systemd: name: keycloak enabled: true diff --git a/roles/keycloak/tasks/systemd.yml b/roles/keycloak/tasks/systemd.yml index e40bba8..f4cd46b 100644 --- a/roles/keycloak/tasks/systemd.yml +++ b/roles/keycloak/tasks/systemd.yml @@ -1,5 +1,5 @@ --- -- name: "Configure {{ keycloak.service_name }} service script wrapper" +- name: "Configure service script wrapper: {{ keycloak_config.service_name }}" become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: keycloak-service.sh.j2 @@ -10,7 +10,7 @@ notify: - restart keycloak -- name: "Configure sysconfig file for {{ keycloak.service_name }} service" +- name: "Configure sysconfig file for service: {{ keycloak_config.service_name }}" become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: keycloak-sysconfig.j2 @@ -21,7 +21,7 @@ notify: - restart keycloak -- name: "Configure systemd unit file for {{ keycloak.service_name }} service" +- name: "Configure systemd unit file for service: {{ keycloak_config.service_name }}" ansible.builtin.template: src: keycloak.service.j2 dest: /etc/systemd/system/keycloak.service @@ -29,16 +29,16 @@ group: root mode: '0644' become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}" - register: systemdunit + register: keycloak_systemdunit notify: - restart keycloak -- name: "Start and wait for {{ keycloak.service_name }} service (first node db)" +- name: "Start and wait for service (first node db): {{ keycloak_config.service_name }}" ansible.builtin.include_tasks: start_keycloak.yml run_once: true when: keycloak_db_enabled -- name: "Start and wait for {{ keycloak.service_name }} service (remaining nodes)" +- name: "Start and wait for service (remaining nodes): {{ keycloak_config.service_name }}" ansible.builtin.include_tasks: start_keycloak.yml - name: Check service status diff --git a/roles/keycloak/templates/keycloak-profile.properties.j2 b/roles/keycloak/templates/keycloak-profile.properties.j2 index c618dc2..6e6fc0c 100644 --- a/roles/keycloak/templates/keycloak-profile.properties.j2 +++ b/roles/keycloak/templates/keycloak-profile.properties.j2 @@ -1,3 +1,3 @@ -{% for feature in keycloak.features %} +{% for feature in keycloak_config.features %} feature.{{ feature.name }}={{ feature.status | default('enabled') }} {% endfor %} \ No newline at end of file diff --git a/roles/keycloak/templates/keycloak-service.sh.j2 b/roles/keycloak/templates/keycloak-service.sh.j2 index 98efb34..5325c43 100755 --- a/roles/keycloak/templates/keycloak-service.sh.j2 +++ b/roles/keycloak/templates/keycloak-service.sh.j2 @@ -17,7 +17,7 @@ checkEnvVar() { # for testing outside systemd . /etc/sysconfig/keycloak -readonly KEYCLOAK_HOME={{ keycloak.home }} +readonly KEYCLOAK_HOME={{ keycloak_config.home }} readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS} readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT} readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT} diff --git a/roles/keycloak/templates/keycloak-sysconfig.j2 b/roles/keycloak/templates/keycloak-sysconfig.j2 index 33889df..024f39b 100644 --- a/roles/keycloak/templates/keycloak-sysconfig.j2 +++ b/roles/keycloak/templates/keycloak-sysconfig.j2 @@ -1,7 +1,7 @@ {{ ansible_managed | comment }} JAVA_OPTS='{{ keycloak_java_opts }}' JAVA_HOME={{ keycloak_java_home | default(keycloak_pkg_java_home, true) }} -JBOSS_HOME={{ keycloak.home }} +JBOSS_HOME={{ keycloak_config.home }} KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }} KEYCLOAK_HTTP_PORT={{ keycloak_http_port }} KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }} diff --git a/roles/keycloak/templates/keycloak.service.j2 b/roles/keycloak/templates/keycloak.service.j2 index 9a04e88..016a099 100644 --- a/roles/keycloak/templates/keycloak.service.j2 +++ b/roles/keycloak/templates/keycloak.service.j2 @@ -1,6 +1,6 @@ {{ ansible_managed | comment }} [Unit] -Description={{ keycloak.service_name }} Server +Description={{ keycloak_config.service_name }} Server After=network.target StartLimitIntervalSec={{ keycloak_service_startlimitintervalsec }} StartLimitBurst={{ keycloak_service_startlimitburst }} @@ -13,8 +13,8 @@ Group={{ keycloak_service_group }} {% endif -%} EnvironmentFile=-{{ keycloak_sysconf_file }} PIDFile={{ keycloak_service_pidfile }} -ExecStart={{ keycloak.home }}/bin/standalone.sh $WILDFLY_OPTS -WorkingDirectory={{ keycloak.home }} +ExecStart={{ keycloak_config.home }}/bin/standalone.sh $WILDFLY_OPTS +WorkingDirectory={{ keycloak_config.home }} TimeoutStartSec=30 TimeoutStopSec=30 LimitNOFILE=102642 diff --git a/roles/keycloak/vars/main.yml b/roles/keycloak/vars/main.yml index fe706db..bcfe24f 100644 --- a/roles/keycloak/vars/main.yml +++ b/roles/keycloak/vars/main.yml @@ -1,9 +1,7 @@ --- # internal variables below - - -keycloak: +keycloak_config: home: "{{ keycloak_jboss_home }}" config_dir: "{{ keycloak_config_dir }}" bundle: "{{ keycloak_archive }}" diff --git a/roles/keycloak_quarkus/handlers/main.yml b/roles/keycloak_quarkus/handlers/main.yml index eec7789..c929f71 100644 --- a/roles/keycloak_quarkus/handlers/main.yml +++ b/roles/keycloak_quarkus/handlers/main.yml @@ -1,9 +1,9 @@ --- -- name: "Invalidate {{ keycloak.service_name }} theme cache" +- name: "Invalidate theme cache: {{ keycloak.service_name }}" ansible.builtin.include_tasks: invalidate_theme_cache.yml listen: "invalidate keycloak theme cache" # handler should be invoked anytime a [build configuration](https://www.keycloak.org/server/all-config?f=build) changes -- name: "Rebuild {{ keycloak.service_name }} config" +- name: "Rebuild config: {{ keycloak.service_name }}" ansible.builtin.include_tasks: rebuild_config.yml listen: "rebuild keycloak config" - name: "Bootstrapped" @@ -15,7 +15,7 @@ listen: "restart keycloak" - name: "Display deprecation warning" ansible.builtin.fail: - msg: "Deprecation warning: you are using the deprecated variable '{{ deprecated_variable | d('NotSet') }}', check docs on how to upgrade." + msg: "Deprecation warning: you are using the deprecated variable '{{ keycloak_quarkus_deprecated_variable | d('NotSet') }}', check docs on how to upgrade." failed_when: false changed_when: true listen: "print deprecation warning" diff --git a/roles/keycloak_quarkus/tasks/config_store.yml b/roles/keycloak_quarkus/tasks/config_store.yml index ee17e3e..373001f 100644 --- a/roles/keycloak_quarkus/tasks/config_store.yml +++ b/roles/keycloak_quarkus/tasks/config_store.yml @@ -1,7 +1,7 @@ --- - name: "Initialize configuration key store variables to be written" ansible.builtin.set_fact: - store_items: + keycloak_quarkus_store_items: - key: "kc.db-password" value: "{{ keycloak_quarkus_db_pass }}" diff --git a/roles/keycloak_quarkus/tasks/deprecations.yml b/roles/keycloak_quarkus/tasks/deprecations.yml index 0d370d5..fe125c4 100644 --- a/roles/keycloak_quarkus/tasks/deprecations.yml +++ b/roles/keycloak_quarkus/tasks/deprecations.yml @@ -13,7 +13,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_https_key_store_file: "{{ keycloak_quarkus_key_store_file }}" - deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler notify: - print deprecation warning @@ -28,7 +28,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_https_key_store_password: "{{ keycloak_quarkus_key_store_password }}" - deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler notify: - print deprecation warning @@ -45,7 +45,7 @@ run_once: true changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: - deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler notify: - print deprecation warning @@ -60,7 +60,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_hostname: "{{ keycloak_quarkus_frontend_url }}" - deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler notify: - print deprecation warning @@ -81,7 +81,7 @@ {% set protocol = 'http://' %} {% endif %} {{ protocol }}{{ keycloak_quarkus_host }}:{{ keycloak_quarkus_port }}/{{ keycloak_quarkus_path }} - deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler notify: - print deprecation warning @@ -96,7 +96,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_hostname_admin: "{{ keycloak_quarkus_admin_url }}" - deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler notify: - print deprecation warning @@ -111,7 +111,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_hostname_backchannel_dynamic: "{{ keycloak_quarkus_hostname_strict_backchannel == False }}" - deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler notify: - print deprecation warning @@ -126,7 +126,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_user }}" - deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler notify: - print deprecation warning @@ -141,7 +141,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_pass }}" - deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler notify: - print deprecation warning @@ -154,7 +154,7 @@ changed_when: keycloak_quarkus_show_deprecation_warnings ansible.builtin.set_fact: keycloak_quarkus_http_host: "{{ keycloak_quarkus_bind_address }}" - deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler + keycloak_quarkus_deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler notify: - print deprecation warning diff --git a/roles/keycloak_quarkus/tasks/fastpackages.yml b/roles/keycloak_quarkus/tasks/fastpackages.yml index 6c5db05..45e0deb 100644 --- a/roles/keycloak_quarkus/tasks/fastpackages.yml +++ b/roles/keycloak_quarkus/tasks/fastpackages.yml @@ -1,24 +1,24 @@ --- - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}" - register: rpm_info + register: keycloak_quarkus_rpm_info changed_when: false failed_when: false when: ansible_facts.os_family == "RedHat" - name: "Add missing packages to the yum install list" ansible.builtin.set_fact: - packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \ + keycloak_quarkus_packages_to_install: "{{ keycloak_quarkus_packages_to_install | default([]) + keycloak_quarkus_rpm_info.stdout_lines | \ map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}" when: ansible_facts.os_family == "RedHat" -- name: "Install packages: {{ packages_to_install }}" +- name: "Install packages: {{ keycloak_quarkus_packages_to_install }}" become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}" ansible.builtin.dnf: - name: "{{ packages_to_install }}" + name: "{{ keycloak_quarkus_packages_to_install }}" state: present when: - - packages_to_install | default([]) | length > 0 + - keycloak_quarkus_packages_to_install | default([]) | length > 0 - ansible_facts.os_family == "RedHat" - name: "Install packages: {{ packages_list }}" diff --git a/roles/keycloak_quarkus/tasks/firewalld.yml b/roles/keycloak_quarkus/tasks/firewalld.yml index 2fe594b..9cf4621 100644 --- a/roles/keycloak_quarkus/tasks/firewalld.yml +++ b/roles/keycloak_quarkus/tasks/firewalld.yml @@ -12,7 +12,7 @@ enabled: true state: started -- name: "Configure firewall for {{ keycloak.service_name }} http port" +- name: "Configure firewall for http port: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}" ansible.posix.firewalld: port: "{{ item }}" @@ -23,7 +23,7 @@ - "{{ keycloak_quarkus_http_port }}/tcp" when: keycloak_quarkus_http_enabled | bool -- name: "Configure firewall for {{ keycloak.service_name }} ports" +- name: "Configure firewall for ports: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}" ansible.posix.firewalld: port: "{{ item }}" diff --git a/roles/keycloak_quarkus/tasks/install.yml b/roles/keycloak_quarkus/tasks/install.yml index 4110bed..b6a3258 100644 --- a/roles/keycloak_quarkus/tasks/install.yml +++ b/roles/keycloak_quarkus/tasks/install.yml @@ -8,25 +8,25 @@ - keycloak_quarkus_archive is defined - keycloak_quarkus_download_url is defined - keycloak_quarkus_version is defined - - local_path is defined + - keycloak_quarkus_local_path is defined quiet: true - name: Check for an existing deployment become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.stat: path: "{{ keycloak.home }}" - register: existing_deploy + register: keycloak_quarkus_existing_deploy - name: Stop and restart if existing deployment exists and install forced - when: existing_deploy.stat.exists and keycloak_quarkus_force_install | bool + when: keycloak_quarkus_existing_deploy.stat.exists and keycloak_quarkus_force_install | bool block: - - name: "Stop the old {{ keycloak.service_name }} service" + - name: "Stop the old service: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" failed_when: false ansible.builtin.systemd: name: keycloak state: stopped - - name: "Remove the old {{ keycloak.service_name }} deployment" + - name: "Remove the old deployment: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.file: path: "{{ keycloak_quarkus_home }}" @@ -36,9 +36,9 @@ become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.stat: path: "{{ keycloak_quarkus_home }}" - register: existing_deploy + register: keycloak_quarkus_existing_deploy -- name: "Create {{ keycloak.service_name }} service user/group" +- name: "Create service user/group: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.user: name: "{{ keycloak.service_user }}" @@ -46,7 +46,7 @@ system: true create_home: false -- name: "Create {{ keycloak.service_name }} install location" +- name: "Create install location: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.file: dest: "{{ keycloak_quarkus_dest }}" @@ -65,29 +65,30 @@ ## check remote archive - name: Set download archive path ansible.builtin.set_fact: - archive: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}" + keycloak_quarkus_archive_full_path: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}" - name: Check download archive path become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" ansible.builtin.stat: - path: "{{ archive }}" - register: archive_path + path: "{{ keycloak_quarkus_archive_full_path }}" + register: keycloak_quarkus_archive_path ## download to controller - name: Download keycloak archive ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user url: "{{ keycloak_quarkus_download_url }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" mode: '0640' url_username: "{{ keycloak_quarkus_binary_download_user | default(omit) }}" url_password: "{{ keycloak_quarkus_binary_download_pass | default(omit) }}" + validate_certs: false delegate_to: localhost become: false run_once: true when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_quarkus_archive_path is defined + - keycloak_quarkus_archive_path.stat is defined + - not keycloak_quarkus_archive_path.stat.exists - not keycloak.offline_install - not rhbk_enable is defined or not rhbk_enable @@ -95,9 +96,9 @@ delegate_to: localhost run_once: true when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_quarkus_archive_path is defined + - keycloak_quarkus_archive_path.stat is defined + - not keycloak_quarkus_archive_path.stat.exists - rhbk_enable is defined and rhbk_enable - not keycloak.offline_install - keycloak_quarkus_alternate_download_url is undefined @@ -109,14 +110,14 @@ product_type: DISTRIBUTION product_version: "{{ rhbk_version }}" product_category: "{{ rhbk_product_category }}" - register: rhn_products + register: keycloak_quarkus_rhn_products no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost run_once: true - name: Determine install zipfile from search results ansible.builtin.set_fact: - rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}" + keycloak_quarkus_rhn_filtered_products: "{{ keycloak_quarkus_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}" delegate_to: localhost run_once: true @@ -125,7 +126,7 @@ client_id: "{{ rhn_username }}" client_secret: "{{ rhn_password }}" product_id: "{{ (rhn_filtered_products | first).id }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" mode: '0640' no_log: "{{ omit_rhn_output | default(true) }}" delegate_to: localhost @@ -137,15 +138,15 @@ run_once: true become: false when: - - archive_path is defined - - archive_path.stat is defined - - not archive_path.stat.exists + - keycloak_quarkus_archive_path is defined + - keycloak_quarkus_archive_path.stat is defined + - not keycloak_quarkus_archive_path.stat.exists - rhbk_enable is defined and rhbk_enable - not keycloak.offline_install - keycloak_quarkus_alternate_download_url is defined ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user url: "{{ keycloak_quarkus_alternate_download_url }}" - dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" mode: '0640' url_username: "{{ keycloak_quarkus_download_user | default(omit) }}" url_password: "{{ keycloak_quarkus_download_pass | default(omit) }}" @@ -153,8 +154,8 @@ - name: Check downloaded archive ansible.builtin.stat: - path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" - register: local_archive_path + path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" + register: keycloak_quarkus_local_archive_path delegate_to: localhost become: false run_once: true @@ -162,35 +163,35 @@ ## copy and unpack - name: Copy archive to target nodes ansible.builtin.copy: - src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" - dest: "{{ archive }}" + src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" + dest: "{{ keycloak_quarkus_archive_full_path }}" owner: "{{ keycloak.service_user }}" group: "{{ keycloak.service_group }}" mode: '0640' - register: new_version_downloaded + register: keycloak_quarkus_new_version_downloaded when: - - not archive_path.stat.exists - - local_archive_path.stat is defined - - local_archive_path.stat.exists + - not keycloak_quarkus_archive_path.stat.exists + - keycloak_quarkus_local_archive_path.stat is defined + - keycloak_quarkus_local_archive_path.stat.exists become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" -- name: "Check target directory: {{ keycloak.home }}/bin/" +- name: "Check target directory /bin/: {{ keycloak.home }}" ansible.builtin.stat: path: "{{ keycloak.home }}/bin/" - register: path_to_workdir + register: keycloak_quarkus_path_to_workdir become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" - name: "Extract Keycloak archive on target" # noqa no-handler need to run this here ansible.builtin.unarchive: remote_src: true - src: "{{ archive }}" + src: "{{ keycloak_quarkus_archive_full_path }}" dest: "{{ keycloak_quarkus_dest }}" creates: "{{ keycloak.home }}/bin/" owner: "{{ keycloak.service_user }}" group: "{{ keycloak.service_group }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" when: - - (not path_to_workdir.stat.exists) or new_version_downloaded.changed + - (not keycloak_quarkus_path_to_workdir.stat.exists) or keycloak_quarkus_new_version_downloaded.changed notify: - restart keycloak @@ -198,7 +199,7 @@ ansible.builtin.debug: msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression" when: - - (not new_version_downloaded.changed) and path_to_workdir.stat.exists + - (not keycloak_quarkus_new_version_downloaded.changed) and keycloak_quarkus_path_to_workdir.stat.exists - name: "Copy private key to target" ansible.builtin.copy: @@ -226,7 +227,7 @@ - keycloak_quarkus_cert_file_copy_enabled is defined and keycloak_quarkus_cert_file_copy_enabled - keycloak_quarkus_cert_file_src | length > 0 -- name: "Install {{ keycloak_quarkus_db_engine }} JDBC driver" +- name: "Install JDBC driver: {{ keycloak_quarkus_db_engine }}" ansible.builtin.include_tasks: jdbc_driver.yml when: - rhbk_enable is defined and rhbk_enable @@ -254,7 +255,7 @@ version: "{{ item.maven.version | default(omit) }}" username: "{{ item.maven.username | default(omit) }}" password: "{{ item.maven.password | default(omit) }}" - dest: "{{ local_path.stat.path }}/{{ item.id }}.jar" + dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar" delegate_to: "localhost" run_once: true loop: "{{ keycloak_quarkus_providers }}" @@ -263,7 +264,7 @@ - name: "Copy maven providers" ansible.builtin.copy: - src: "{{ local_path.stat.path }}/{{ item.id }}.jar" + src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar" dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar" owner: "{{ keycloak.service_user }}" group: "{{ keycloak.service_group }}" diff --git a/roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml b/roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml index dbcaeba..ad21ea6 100644 --- a/roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml +++ b/roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml @@ -4,7 +4,7 @@ # you can do so by deleting the data/tmp/kc-gzip-cache directory of the server distribution # It can be useful for instance if you redeployed custom providers or custom themes without # disabling themes caching in the previous server executions. -- name: "Delete {{ keycloak.service_name }} theme cache directory" +- name: "Delete theme cache directory: {{ keycloak.service_name }}" ansible.builtin.file: path: "{{ keycloak.home }}/data/tmp/kc-gzip-cache" state: absent diff --git a/roles/keycloak_quarkus/tasks/main.yml b/roles/keycloak_quarkus/tasks/main.yml index 7dc4051..0c769e9 100644 --- a/roles/keycloak_quarkus/tasks/main.yml +++ b/roles/keycloak_quarkus/tasks/main.yml @@ -123,13 +123,13 @@ - name: Check service status ansible.builtin.systemd_service: name: "{{ keycloak.service_name }}" - register: keycloak_service_status + register: keycloak_quarkus_service_status changed_when: false - name: "Notify to remove `keycloak_quarkus_bootstrap_admin_user[_password]` env vars" when: - not ansible_local.keycloak.general.bootstrapped | default(false) | bool # it was not bootstrapped prior to the current role's execution - - keycloak_service_status.status.ActiveState == "active" # but it is now + - keycloak_quarkus_service_status.status.ActiveState == "active" # but it is now ansible.builtin.assert: { that: true, quiet: true } changed_when: true notify: diff --git a/roles/keycloak_quarkus/tasks/prereqs.yml b/roles/keycloak_quarkus/tasks/prereqs.yml index 253f09c..f3dd8a1 100644 --- a/roles/keycloak_quarkus/tasks/prereqs.yml +++ b/roles/keycloak_quarkus/tasks/prereqs.yml @@ -57,7 +57,7 @@ - name: Check local download archive path ansible.builtin.stat: path: "{{ keycloak_quarkus_download_path }}" - register: local_path + register: keycloak_quarkus_local_path delegate_to: localhost run_once: true become: false @@ -65,9 +65,9 @@ - name: Validate local download path ansible.builtin.assert: that: - - local_path.stat.exists - - local_path.stat.readable - - keycloak_quarkus_offline_install or local_path.stat.writeable + - keycloak_quarkus_local_path.stat.exists + - keycloak_quarkus_local_path.stat.readable + - keycloak_quarkus_offline_install or keycloak_quarkus_local_path.stat.writeable quiet: true fail_msg: "Defined controller path for downloading resources is incorrect or unreadable: {{ keycloak_quarkus_download_path }}" success_msg: "Will download resource to controller path: {{ keycloak_quarkus_download_path }}" @@ -76,20 +76,20 @@ - name: Check downloaded archive if offline ansible.builtin.stat: - path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}" + path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" when: keycloak_quarkus_offline_install - register: local_archive_path_check + register: keycloak_quarkus_local_archive_path_check delegate_to: localhost run_once: true - name: Validate local downloaded archive if offline ansible.builtin.assert: that: - - local_archive_path_check.stat.exists - - local_archive_path_check.stat.readable + - keycloak_quarkus_local_archive_path_check.stat.exists + - keycloak_quarkus_local_archive_path_check.stat.readable quiet: true - fail_msg: "Configured for offline install but install archive not found at: {{ local_path.stat.path }}/{{ keycloak.bundle }}" - success_msg: "Will install offline with expected archive: {{ local_path.stat.path }}/{{ keycloak.bundle }}" + fail_msg: "Configured for offline install but install archive not found at: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" + success_msg: "Will install offline with expected archive: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}" when: keycloak_quarkus_offline_install delegate_to: localhost run_once: true @@ -100,11 +100,11 @@ - name: "Check run keytool" changed_when: false ansible.builtin.command: keytool -help - register: keytool_check + register: keycloak_quarkus_keytool_check ignore_errors: true - name: "Fail when no keytool found" - when: keytool_check.rc != 0 + when: keycloak_quarkus_keytool_check.rc != 0 ansible.builtin.fail: msg: "keytool NOT found in the PATH, but is required for setting up the configuration key store" diff --git a/roles/keycloak_quarkus/tasks/rebuild_config.yml b/roles/keycloak_quarkus/tasks/rebuild_config.yml index 5676365..e7e35fd 100644 --- a/roles/keycloak_quarkus/tasks/rebuild_config.yml +++ b/roles/keycloak_quarkus/tasks/rebuild_config.yml @@ -1,6 +1,6 @@ --- # cf. https://www.keycloak.org/server/configuration#_optimize_the_keycloak_startup -- name: "Rebuild {{ keycloak.service_name }} config" +- name: "Rebuild config: {{ keycloak.service_name }}" ansible.builtin.shell: | # noqa blocked_modules shell is necessary here env -i bash -c "set -a ; source {{ keycloak_quarkus_sysconf_file }} ; {{ keycloak.home }}/bin/kc.sh build " become: "{{ keycloak_quarkus_rebuild_config_require_privilege_escalation | default(true) }}" diff --git a/roles/keycloak_quarkus/tasks/restart.yml b/roles/keycloak_quarkus/tasks/restart.yml index ae38d46..cfa2128 100644 --- a/roles/keycloak_quarkus/tasks/restart.yml +++ b/roles/keycloak_quarkus/tasks/restart.yml @@ -1,5 +1,5 @@ --- -- name: "Restart and enable {{ keycloak.service_name }} service" +- name: "Restart and enable service: {{ keycloak.service_name }}" ansible.builtin.systemd: name: "{{ keycloak.service_name }}" enabled: true @@ -7,11 +7,11 @@ daemon_reload: true become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}" -- name: "Wait until {{ keycloak.service_name }} service becomes active {{ keycloak.health_url }}" +- name: "Wait until service becomes active: {{ keycloak.service_name }}" ansible.builtin.uri: url: "{{ keycloak.health_url }}" - register: keycloak_status - until: keycloak_status.status == 200 + register: keycloak_quarkus_status + until: keycloak_quarkus_status.status == 200 retries: "{{ keycloak_quarkus_restart_health_check_retries }}" delay: "{{ keycloak_quarkus_restart_health_check_delay }}" when: internal_force_health_check | default(keycloak_quarkus_restart_health_check) diff --git a/roles/keycloak_quarkus/tasks/restart/serial.yml b/roles/keycloak_quarkus/tasks/restart/serial.yml index 5bf0da0..2ab5279 100644 --- a/roles/keycloak_quarkus/tasks/restart/serial.yml +++ b/roles/keycloak_quarkus/tasks/restart/serial.yml @@ -2,7 +2,7 @@ - name: "Restart services in serial, with optional healtch check (keycloak_quarkus_restart_health_check)" throttle: 1 block: - - name: "Restart and enable {{ keycloak.service_name }} service" + - name: "Restart and enable service: {{ keycloak.service_name }}" ansible.builtin.include_tasks: file: restart.yml apply: diff --git a/roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml b/roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml index 01855f1..17cfd8f 100644 --- a/roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml +++ b/roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml @@ -1,7 +1,7 @@ --- - name: Verify first restarted service with health URL, then rest restart in parallel block: - - name: "Restart and enable {{ keycloak.service_name }} service on initial host" + - name: "Restart and enable service on initial host: {{ keycloak.service_name }}" ansible.builtin.include_tasks: file: restart.yml apply: @@ -10,7 +10,7 @@ vars: internal_force_health_check: true - - name: "Restart and enable {{ keycloak.service_name }} service on other hosts" + - name: "Restart and enable service on other hosts: {{ keycloak.service_name }}" ansible.builtin.systemd: name: "{{ keycloak.service_name }}" enabled: true diff --git a/roles/keycloak_quarkus/tasks/start.yml b/roles/keycloak_quarkus/tasks/start.yml index 4d0be43..2bdf6f2 100644 --- a/roles/keycloak_quarkus/tasks/start.yml +++ b/roles/keycloak_quarkus/tasks/start.yml @@ -1,5 +1,5 @@ --- -- name: "Start {{ keycloak.service_name }} service" +- name: "Start service: {{ keycloak.service_name }}" ansible.builtin.systemd: name: keycloak enabled: true @@ -7,11 +7,11 @@ daemon_reload: true become: "{{ keycloak_quarkus_start_require_privilege_escalation | default(true) }}" -- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}" +- name: "Wait until service becomes active: {{ keycloak.service_name }}" ansible.builtin.uri: url: "{{ keycloak.health_url }}" - register: keycloak_status - until: keycloak_status.status == 200 + register: keycloak_quarkus_status + until: keycloak_quarkus_status.status == 200 retries: 25 delay: 10 when: internal_force_health_check | default(keycloak_quarkus_restart_health_check) diff --git a/roles/keycloak_quarkus/tasks/systemd.yml b/roles/keycloak_quarkus/tasks/systemd.yml index e0cdc27..44872e3 100644 --- a/roles/keycloak_quarkus/tasks/systemd.yml +++ b/roles/keycloak_quarkus/tasks/systemd.yml @@ -1,5 +1,5 @@ --- -- name: "Configure sysconfig file for {{ keycloak.service_name }} service" +- name: "Configure sysconfig file for service: {{ keycloak.service_name }}" become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}" ansible.builtin.template: src: keycloak-sysconfig.j2 @@ -21,7 +21,7 @@ group: root mode: '0644' become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}" - register: systemdunit + register: keycloak_quarkus_systemdunit notify: - rebuild keycloak config - restart keycloak diff --git a/roles/keycloak_realm/README.md b/roles/keycloak_realm/README.md index d5056c4..120a98f 100644 --- a/roles/keycloak_realm/README.md +++ b/roles/keycloak_realm/README.md @@ -10,18 +10,18 @@ Role Defaults | Variable | Description | Default | |:---------|:------------|:--------| -|`keycloak_admin_user`| Administration console user account | `admin` | -|`keycloak_host`| hostname | `localhost` | -|`keycloak_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` | -|`keycloak_http_port`| HTTP port | `8080` | -|`keycloak_https_port`| TLS HTTP port | `8443` | -|`keycloak_auth_realm`| Name of the main authentication realm | `master` | -|`keycloak_management_http_port`| Management port | `9990` | -|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` | -|`keycloak_client_public`| Configure a public realm client | `True` | -|`keycloak_client_web_origins`| Web origins for realm client | `/*` | -|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` | -|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` | +|`keycloak_realm_admin_user`| Administration console user account | `admin` | +|`keycloak_realm_host`| hostname | `localhost` | +|`keycloak_realm_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` | +|`keycloak_realm_http_port`| HTTP port | `8080` | +|`keycloak_realm_https_port`| TLS HTTP port | `8443` | +|`keycloak_realm_auth_realm`| Name of the main authentication realm | `master` | +|`keycloak_realm_management_http_port`| Management port | `9990` | +|`keycloak_realm_auth_client`| Authentication client for configuration REST calls | `admin-cli` | +|`keycloak_realm_client_public`| Configure a public realm client | `True` | +|`keycloak_realm_client_web_origins`| Web origins for realm client | `/*` | +|`keycloak_realm_url`| URL for configuration rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port }}` | +|`keycloak_realm_management_url`| URL for management console rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port }}` | Role Variables @@ -31,30 +31,30 @@ The following are a set of _required_ variables for the role: | Variable | Description | |:---------|:------------| -|`keycloak_realm` | Name of the realm to be created | -|`keycloak_admin_password`| Password for the administration console user account | +|`keycloak_realm_realm` | Name of the realm to be created | +|`keycloak_realm_admin_password`| Password for the administration console user account | The following variables are available for creating clients: | Variable | Description | Default | |:---------|:------------|:---------| -|`keycloak_clients` | List of _client_ declarations for the realm | `[]` | -|`keycloak_client_default_roles` | List of default role name for clients | `[]` | -|`keycloak_client_users` | List of user/role mappings for a client | `[]` | +|`keycloak_realm_clients` | List of _client_ declarations for the realm | `[]` | +|`keycloak_realm_client_default_roles` | List of default role name for clients | `[]` | +|`keycloak_realm_client_users` | List of user/role mappings for a client | `[]` | The following variables are available for creating user federation: | Variable | Description | Default | |:---------|:------------|:---------| -|`keycloak_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` | +|`keycloak_realm_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` | Variable formats ---------------- -* `keycloak_user_federation`, a list of: +* `keycloak_realm_user_federation`, a list of: ```yaml - realm: @@ -68,24 +68,24 @@ Variable formats Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables. -* `keycloak_clients`, a list of: +* `keycloak_realm_clients`, a list of: ```yaml - name: id: client_id: secret: - roles: + roles: realm: public_client: web_origins: - users: + users: ``` `name` and either `id` or `client_id` are required. -* `keycloak_client_users`, a list of: +* `keycloak_realm_client_users`, a list of: ```yaml - username: @@ -118,7 +118,7 @@ For features not covered by this role, the collection provides dedicated modules | `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) | | `keycloak_client` | Clients (also used internally by this role) | | `keycloak_role` | Realm and client roles | -| `keycloak_user_federation` | User federations such as LDAP (also used internally by this role) | +| `keycloak_realm_user_federation` | User federations such as LDAP (also used internally by this role) | Example Playbook diff --git a/roles/keycloak_realm/defaults/main.yml b/roles/keycloak_realm/defaults/main.yml index 4514867..6de5faa 100644 --- a/roles/keycloak_realm/defaults/main.yml +++ b/roles/keycloak_realm/defaults/main.yml @@ -1,18 +1,18 @@ --- ### Keycloak configuration settings -keycloak_host: localhost -keycloak_http_port: 8080 -keycloak_https_port: 8443 -keycloak_management_http_port: 9990 +keycloak_realm_host: localhost +keycloak_realm_http_port: 8080 +keycloak_realm_https_port: 8443 +keycloak_realm_management_http_port: 9990 ### Keycloak administration console user -keycloak_admin_user: admin -keycloak_auth_realm: master -keycloak_auth_client: admin-cli -keycloak_context: '' +keycloak_realm_admin_user: admin +keycloak_realm_auth_realm: master +keycloak_realm_auth_client: admin-cli +keycloak_realm_context: '' # administrator console password, this is a required variable -keycloak_admin_password: '' +keycloak_realm_admin_password: '' ### Keycloak realms, clients, roles, federation # list of clients to create in the realm @@ -26,35 +26,36 @@ keycloak_admin_password: '' # and users is a list of account, see below for the format definition # an empty name will skip the creation of the client # -# keycloak_clients: +# keycloak_realm_clients: # - name: '' -# roles: "{{ keycloak_client_default_roles }}" -# realm: "{{ keycloak_realm }}" -# public_client: "{{ keycloak_client_public }}" -# web_origins: "{{ keycloak_client_web_origins }}" -# redirect_uris: "{{ keycloak_client_redirect_uris }}" -# users: "{{ keycloak_client_users }}" -keycloak_clients: [] +# roles: "{{ keycloak_realm_client_default_roles }}" +# realm: "{{ keycloak_realm_realm }}" +# public_client: "{{ keycloak_realm_client_public }}" +# web_origins: "{{ keycloak_realm_client_web_origins }}" +# redirect_uris: "{{ keycloak_realm_client_redirect_uris }}" +# users: "{{ keycloak_realm_client_users }}" +keycloak_realm_clients: [] # list of roles to create in the client -keycloak_client_default_roles: [] +keycloak_realm_client_default_roles: [] # if True, create a public client; otherwise, a confidetial client -keycloak_client_public: true +keycloak_realm_client_public: true # allowed web origins for the client -keycloak_client_web_origins: '/*' +keycloak_realm_client_web_origins: '/*' # list of user and role mappings to create in the client # Each user has the form: # { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] } # where each client_role has the form: # { client: '', role: '', realm: '' } -keycloak_client_users: [] +keycloak_realm_client_users: [] ### List of Keycloak User Federation -keycloak_user_federation: [] +keycloak_realm_user_federation: [] # other settings -keycloak_url: "http://{{ keycloak_host }}:{{ keycloak_http_port + (keycloak_jboss_port_offset | default(0)) }}" -keycloak_management_url: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + (keycloak_jboss_port_offset | default(0)) }}" +keycloak_realm_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}" +keycloak_realm_management_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}" +keycloak_realm_no_log: true diff --git a/roles/keycloak_realm/meta/argument_specs.yml b/roles/keycloak_realm/meta/argument_specs.yml index 4ceb8e6..3d21330 100644 --- a/roles/keycloak_realm/meta/argument_specs.yml +++ b/roles/keycloak_realm/meta/argument_specs.yml @@ -1,94 +1,94 @@ argument_specs: main: options: - keycloak_host: + keycloak_realm_host: # line 3 of keycloak_realm/defaults/main.yml default: "localhost" description: "Hostname for rest calls" type: "str" - keycloak_context: + keycloak_realm_context: # line 5 of keycloak_realm/defaults/main.yml default: "" description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)" type: "str" - keycloak_http_port: + keycloak_realm_http_port: # line 4 of keycloak_realm/defaults/main.yml default: 8080 description: "HTTP port" type: "int" - keycloak_https_port: + keycloak_realm_https_port: # line 5 of keycloak_realm/defaults/main.yml default: 8443 description: "HTTPS port" type: "int" - keycloak_management_http_port: + keycloak_realm_management_http_port: # line 6 of keycloak_realm/defaults/main.yml default: 9990 description: "Management port" type: "int" - keycloak_admin_user: + keycloak_realm_admin_user: # line 10 of keycloak_realm/defaults/main.yml default: "admin" description: "Administration console user account" type: "str" - keycloak_auth_realm: + keycloak_realm_auth_realm: # line 11 of keycloak_realm/defaults/main.yml default: "master" description: "Name of the main authentication realm" type: "str" - keycloak_auth_client: + keycloak_realm_auth_client: # line 12 of keycloak_realm/defaults/main.yml default: "admin-cli" description: "Authentication client for configuration REST calls" type: "str" - keycloak_client_default_roles: + keycloak_realm_client_default_roles: # line 36 of keycloak_realm/defaults/main.yml default: "[]" description: "List of roles to configure as client default" type: "list" - keycloak_client_public: + keycloak_realm_client_public: # line 39 of keycloak_realm/defaults/main.yml default: true description: "Configure a public realm client" type: "bool" - keycloak_client_web_origins: + keycloak_realm_client_web_origins: # line 42 of keycloak_realm/defaults/main.yml default: "/*" description: "Web origins for realm client" type: "str" - keycloak_client_users: + keycloak_realm_client_users: # line 49 of keycloak_realm/defaults/main.yml default: "[]" description: "List of users to configure in the realm client" type: "list" - keycloak_user_federation: + keycloak_realm_user_federation: # line 52 of keycloak_realm/defaults/main.yml default: "[]" description: "List of user federations to configure in the realm" type: "list" - keycloak_admin_password: + keycloak_realm_admin_password: # line 5 of keycloak_realm/vars/main.yml required: true description: "Password for the administration console user account" type: "str" - keycloak_realm: + keycloak_realm_realm: # line 8 of keycloak_realm/vars/main.yml required: true description: "Name of the realm to be configured" type: "str" - keycloak_clients: + keycloak_realm_clients: # line 11 of keycloak_realm/vars/main.yml default: "[]" description: "List of client declarations for the realm" type: "list" - keycloak_url: + keycloak_realm_url: # line 14 of keycloak_realm/vars/main.yml - default: "http://{{ keycloak_host }}:{{ keycloak_http_port + ( keycloak_jboss_port_offset | default(0) ) }}" + default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}" description: "URL for configuration rest calls" type: "str" - keycloak_management_url: + keycloak_realm_management_url: # line 15 of keycloak_realm/vars/main.yml - default: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + ( keycloak_jboss_port_offset | default(0) ) }}" + default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}" description: "URL for management console rest calls" type: "str" downstream: diff --git a/roles/keycloak_realm/tasks/main.yml b/roles/keycloak_realm/tasks/main.yml index 5c19d68..59f9413 100644 --- a/roles/keycloak_realm/tasks/main.yml +++ b/roles/keycloak_realm/tasks/main.yml @@ -1,19 +1,19 @@ --- - name: Generate keycloak auth token ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token" method: POST - body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password" + body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password" validate_certs: false - no_log: "{{ keycloak_no_log | default('True') }}" - register: keycloak_auth_response - until: keycloak_auth_response.status == 200 + no_log: "{{ keycloak_realm_no_log | default('True') }}" + register: keycloak_realm_auth_response + until: keycloak_realm_auth_response.status == 200 retries: 5 delay: 2 - name: "Determine if realm exists" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}" method: GET validate_certs: false status_code: @@ -21,38 +21,38 @@ - 404 headers: Accept: "application/json" - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: keycloak_realm_exists + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_realm_exists - name: Create Realm ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms" method: POST body: "{{ lookup('template', 'realm.json.j2') }}" validate_certs: false body_format: json headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" status_code: 201 - when: keycloak_realm_exists.status == 404 + when: keycloak_realm_realm_exists.status == 404 - name: Create user federation middleware_automation.keycloak.keycloak_user_federation: - auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" - auth_realm: "{{ keycloak_auth_realm }}" - auth_username: "{{ keycloak_admin_user }}" - auth_password: "{{ keycloak_admin_password }}" - realm: "{{ item.realm | default(keycloak_realm) }}" + auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}" + auth_realm: "{{ keycloak_realm_auth_realm }}" + auth_username: "{{ keycloak_realm_admin_user }}" + auth_password: "{{ keycloak_realm_admin_password }}" + realm: "{{ item.realm | default(keycloak_realm_realm) }}" name: "{{ item.name }}" state: present provider_id: "{{ item.provider_id }}" provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}" config: "{{ item.config }}" mappers: "{{ item.mappers | default(omit) }}" - no_log: "{{ keycloak_no_log | default('True') }}" - register: create_user_federation_result - loop: "{{ keycloak_user_federation | flatten }}" - when: keycloak_user_federation is defined + no_log: "{{ keycloak_realm_no_log | default('True') }}" + register: keycloak_realm_create_user_federation_result + loop: "{{ keycloak_realm_user_federation | flatten }}" + when: keycloak_realm_user_federation is defined - name: Validate Keycloak clients ansible.builtin.assert: @@ -61,18 +61,18 @@ - (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0) fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required" quiet: true - loop: "{{ keycloak_clients | flatten }}" + loop: "{{ keycloak_realm_clients | flatten }}" loop_control: label: "{{ item.name | default('unnamed client') }}" - name: Create or update a Keycloak client middleware_automation.keycloak.keycloak_client: - auth_client_id: "{{ keycloak_auth_client }}" - auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" - auth_realm: "{{ keycloak_auth_realm }}" - auth_username: "{{ keycloak_admin_user }}" - auth_password: "{{ keycloak_admin_password }}" - realm: "{{ item.realm | default(keycloak_realm) }}" + auth_client_id: "{{ keycloak_realm_auth_client }}" + auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}" + auth_realm: "{{ keycloak_realm_auth_realm }}" + auth_username: "{{ keycloak_realm_admin_user }}" + auth_password: "{{ keycloak_realm_admin_password }}" + realm: "{{ item.realm | default(keycloak_realm_realm) }}" default_roles: "{{ item.roles | default(omit) }}" client_id: "{{ item.client_id | default(omit) }}" id: "{{ item.id | default(omit) }}" @@ -94,21 +94,21 @@ protocol: "{{ item.protocol | default(omit) }}" attributes: "{{ item.attributes | default(omit) }}" state: present - no_log: "{{ keycloak_no_log | default('false') }}" - register: create_client_result - loop: "{{ keycloak_clients | flatten }}" + no_log: "{{ keycloak_realm_no_log | default('false') }}" + register: keycloak_realm_create_client_result + loop: "{{ keycloak_realm_clients | flatten }}" when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined) - name: Create client roles ansible.builtin.include_tasks: manage_client_roles.yml - loop: "{{ keycloak_clients | flatten }}" + loop: "{{ keycloak_realm_clients | flatten }}" loop_control: loop_var: client when: "'roles' in client" - name: Create client users ansible.builtin.include_tasks: manage_client_users.yml - loop: "{{ keycloak_clients | flatten }}" + loop: "{{ keycloak_realm_clients | flatten }}" loop_control: loop_var: client when: "'users' in client" diff --git a/roles/keycloak_realm/tasks/manage_client_roles.yml b/roles/keycloak_realm/tasks/manage_client_roles.yml index fc48b8a..c4719e1 100644 --- a/roles/keycloak_realm/tasks/manage_client_roles.yml +++ b/roles/keycloak_realm/tasks/manage_client_roles.yml @@ -1,13 +1,13 @@ - name: Create client roles middleware_automation.keycloak.keycloak_role: name: "{{ item }}" - realm: "{{ client.realm | default(keycloak_realm) }}" + realm: "{{ client.realm | default(keycloak_realm_realm) }}" client_id: "{{ client.client_id }}" - auth_client_id: "{{ keycloak_auth_client }}" - auth_keycloak_url: "{{ keycloak_url }}{{ keycloak_context }}" - auth_realm: "{{ keycloak_auth_realm }}" - auth_username: "{{ keycloak_admin_user }}" - auth_password: "{{ keycloak_admin_password }}" + auth_client_id: "{{ keycloak_realm_auth_client }}" + auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}" + auth_realm: "{{ keycloak_realm_auth_realm }}" + auth_username: "{{ keycloak_realm_admin_user }}" + auth_password: "{{ keycloak_realm_admin_password }}" state: present loop: "{{ client.roles | flatten }}" - no_log: "{{ keycloak_no_log | default('True') }}" + no_log: "{{ keycloak_realm_no_log | default('True') }}" diff --git a/roles/keycloak_realm/tasks/manage_token_lifespan.yml b/roles/keycloak_realm/tasks/manage_token_lifespan.yml index f16b938..6149b45 100644 --- a/roles/keycloak_realm/tasks/manage_token_lifespan.yml +++ b/roles/keycloak_realm/tasks/manage_token_lifespan.yml @@ -1,7 +1,7 @@ --- - name: "Update Access token lifespan" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}" method: PUT body: accessTokenLifespan: 300 @@ -11,4 +11,4 @@ - 200 - 204 headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" diff --git a/roles/keycloak_realm/tasks/manage_user.yml b/roles/keycloak_realm/tasks/manage_user.yml index 1f9f7bd..983bb78 100644 --- a/roles/keycloak_realm/tasks/manage_user.yml +++ b/roles/keycloak_realm/tasks/manage_user.yml @@ -1,15 +1,15 @@ --- - name: "Check if User Already Exists" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}" validate_certs: false headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: keycloak_user_search_result + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_user_search_result - name: "Create User" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users" method: POST body: enabled: true @@ -21,21 +21,21 @@ validate_certs: false body_format: json headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" status_code: 201 - when: keycloak_user_search_result.json | length == 0 + when: keycloak_realm_user_search_result.json | length == 0 - name: "Get User" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}" validate_certs: false headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: keycloak_user + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_user - name: "Update User Password" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users/{{ (keycloak_user.json | first).id }}/reset-password" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users/{{ (keycloak_realm_user.json | first).id }}/reset-password" method: PUT body: type: password @@ -47,5 +47,5 @@ - 200 - 204 headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: keycloak_user + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_user diff --git a/roles/keycloak_realm/tasks/manage_user_client_roles.yml b/roles/keycloak_realm/tasks/manage_user_client_roles.yml index f9e0329..3dab651 100644 --- a/roles/keycloak_realm/tasks/manage_user_client_roles.yml +++ b/roles/keycloak_realm/tasks/manage_user_client_roles.yml @@ -1,20 +1,20 @@ --- - name: "Get Realm for role" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm) }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm_realm) }}" method: GET validate_certs: false status_code: - 200 headers: Accept: "application/json" - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: client_role_realm + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_client_role_realm - name: Check if Mapping is available ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \ - default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \ + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \ + default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \ selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available" method: GET validate_certs: false @@ -22,13 +22,13 @@ - 200 headers: Accept: "application/json" - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: client_role_user_available + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_client_role_user_available - name: "Create Role Mapping" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ client_role.realm | \ - default(keycloak_realm) }}/users/{{ (keycloak_user.json | first).id }}/role-mappings/clients/{{ (create_client_result.results | \ + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \ + default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \ selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}" method: POST body: @@ -40,7 +40,7 @@ validate_certs: false body_format: json headers: - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" status_code: 204 - loop: "{{ client_role_user_available.json | flatten }}" + loop: "{{ keycloak_realm_client_role_user_available.json | flatten }}" when: item.name == client_role.role diff --git a/roles/keycloak_realm/tasks/manage_user_roles.yml b/roles/keycloak_realm/tasks/manage_user_roles.yml index dc74477..cbb8fc9 100644 --- a/roles/keycloak_realm/tasks/manage_user_roles.yml +++ b/roles/keycloak_realm/tasks/manage_user_roles.yml @@ -1,21 +1,21 @@ --- - name: "Get User {{ user.username }}" ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/admin/realms/{{ keycloak_realm }}/users?username={{ user.username }}" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}" headers: validate_certs: false - Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}" - register: keycloak_user + Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}" + register: keycloak_realm_user - name: Refresh keycloak auth token ansible.builtin.uri: - url: "{{ keycloak_url }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token" + url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token" method: POST - body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password" + body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password" validate_certs: false - register: keycloak_auth_response - no_log: "{{ keycloak_no_log | default('True') }}" - until: keycloak_auth_response.status == 200 + register: keycloak_realm_auth_response + no_log: "{{ keycloak_realm_no_log | default('True') }}" + until: keycloak_realm_auth_response.status == 200 retries: 5 delay: 2 diff --git a/roles/keycloak_realm/templates/realm.json.j2 b/roles/keycloak_realm/templates/realm.json.j2 index 88ee819..e442af3 100644 --- a/roles/keycloak_realm/templates/realm.json.j2 +++ b/roles/keycloak_realm/templates/realm.json.j2 @@ -1,6 +1,6 @@ { - "id": "{{ keycloak_realm }}", - "realm": "{{ keycloak_realm }}", + "id": "{{ keycloak_realm_realm }}", + "realm": "{{ keycloak_realm_realm }}", "enabled": true, "eventsEnabled": true, "eventsExpiration": 7200 diff --git a/roles/keycloak_realm/vars/main.yml b/roles/keycloak_realm/vars/main.yml index ad9bd8e..ec9ddfe 100644 --- a/roles/keycloak_realm/vars/main.yml +++ b/roles/keycloak_realm/vars/main.yml @@ -2,4 +2,4 @@ # vars file for keycloak_realm # name of the realm to create, this is a required variable -keycloak_realm: +keycloak_realm_realm: