internet/ansible-middleware.keycloak
3
0
Fork 0
mirror of https://github.com/ansible-middleware/keycloak.git synced 2026-07-25 00:44:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(keycloak_quarkus): avoid leaking maven provider password in logs

Browse Source 
The Validate providers / Download custom providers via http / Copy local
providers tasks loop over all providers and print the item (including
maven.password) in cleartext, even for skipped iterations. Add the same
conditional no_log the maven download/copy tasks already use so entries
carrying a secret are censored while url/local providers stay visible.

Refs ansible-middleware/keycloak#362

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Helmut Wolf
2026-07-01 09:22:32 +02:00
parent d4eafe1b30
commit b9181abb24
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/keycloak_quarkus/tasks/install.yml
View File

@@ -246,6 +246,7 @@
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
loop: "{{ keycloak_quarkus_providers }}" loop: "{{ keycloak_quarkus_providers }}"
when: item.url is defined and item.url | length > 0 when: item.url is defined and item.url | length > 0
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}" notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
# this requires the `lxml` package to be installed; we redirect this step to localhost such that we do need to install it on the remote hosts # this requires the `lxml` package to be installed; we redirect this step to localhost such that we do need to install it on the remote hosts
@@ -289,6 +290,7 @@
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}" become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
loop: "{{ keycloak_quarkus_providers }}" loop: "{{ keycloak_quarkus_providers }}"
when: item.local_path is defined when: item.local_path is defined
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}" notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
- name: Ensure required folder structure for policies exists - name: Ensure required folder structure for policies exists

1
roles/keycloak_quarkus/tasks/prereqs.yml
View File

@@ -123,6 +123,7 @@
fail_msg: > fail_msg: >
Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property
loop: "{{ keycloak_quarkus_providers }}" loop: "{{ keycloak_quarkus_providers }}"
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
- name: "Validate policies" - name: "Validate policies"
ansible.builtin.assert: ansible.builtin.assert: