fix(keycloak_quarkus): avoid leaking maven provider password in logs

The Validate providers / Download custom providers via http / Copy local
providers tasks loop over all providers and print the item (including
maven.password) in cleartext, even for skipped iterations. Add the same
conditional no_log the maven download/copy tasks already use so entries
carrying a secret are censored while url/local providers stay visible.

Refs ansible-middleware/keycloak#362

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Helmut Wolf
2026-07-01 09:22:32 +02:00
parent d4eafe1b30
commit b9181abb24
2 changed files with 3 additions and 0 deletions

View File

@@ -123,6 +123,7 @@
fail_msg: >
Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property
loop: "{{ keycloak_quarkus_providers }}"
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
- name: "Validate policies"
ansible.builtin.assert: