Update changelog for release 3.0.10

Signed-off-by: ansible-middleware-core <ansible-middleware-core@redhat.com>

.ansible-lint

@@ -38,7 +38,5 @@ skip_list:
   - vars_should_not_be_used
   - file_is_small_enough
   - file_has_valid_name
-  - name[template]
-  - var-naming[no-role-prefix]
 
 use_default_rules: true

.github/workflows/ci.yml

@@ -22,4 +22,4 @@ jobs:
       root_permission_varname: 'keycloak_install_requires_become'
       debug_verbosity: "${{ github.event.inputs.debug_verbosity }}"
       molecule_tests: >-
-        [ "debian", "quarkus", "quarkus_ha", "quarkus_ha_remote", "quarkus_ha_26.4_below", "default", "quarkus_devmode", "quarkus_upgrade", "keycloak_modules" ]
+        [ "debian", "sso_test", "quarkus", "quarkus_ha", "quarkus_ha_remote", "quarkus_ha_26.4_below", "default", "quarkus_devmode", "quarkus_upgrade", "keycloak_modules" ]

CHANGELOG.rst

@@ -6,6 +6,21 @@ middleware\_automation.keycloak Release Notes
 
 This changelog describes changes after version 0.2.6.
 
+v3.0.10
+=======
+
+Major Changes
+-------------
+
+- Fixing linting issues `#357 <https://github.com/ansible-middleware/keycloak/pull/357>`_
+
+Minor Changes
+-------------
+
+- AMW-571 keycloak_identity_provider hide_on_login_page not working `#356 <https://github.com/ansible-middleware/keycloak/pull/356>`_
+- Fixing vars naming issue `#359 <https://github.com/ansible-middleware/keycloak/pull/359>`_
+- Removing from __future__ import annotations broke runtime type hints using Sequence and union syntax, causing sanity import failures and molecule module errors `#358 <https://github.com/ansible-middleware/keycloak/pull/358>`_
+
 v3.0.9
 ======
 

README.md

@@ -155,11 +155,11 @@ Note: when deploying clustered configurations, all hosts belonging to the cluste
 Execute the following command from the source root directory:
 
 ```bash
-ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_admin_password=<changeme> -e keycloak_realm=test
+ansible-playbook -i <ansible_hosts> playbooks/keycloak_realm.yml -e keycloak_realm_admin_password=<changeme> -e keycloak_realm_realm=test
 ```
 
-- `keycloak_admin_password` password for the administration console user account.
+- `keycloak_realm_admin_password` password for the administration console user account.
-- `keycloak_realm` name of the realm to be created/used.
+- `keycloak_realm_realm` name of the realm to be created/used.
 - `ansible_hosts` is the inventory, below is an example inventory for deploying to localhost
 
   ```

changelogs/changelog.yaml

@@ -674,6 +674,30 @@ releases:
     - 276.yaml
     - 277.yaml
     release_date: '2025-05-02'
+  3.0.10:
+    changes:
+      major_changes:
+      - 'Fixing linting issues `#357 <https://github.com/ansible-middleware/keycloak/pull/357>`_
+
+        '
+      minor_changes:
+      - 'AMW-571 keycloak_identity_provider hide_on_login_page not working `#356 <https://github.com/ansible-middleware/keycloak/pull/356>`_
+
+        '
+      - 'Fixing vars naming issue `#359 <https://github.com/ansible-middleware/keycloak/pull/359>`_
+
+        '
+      - 'Removing from __future__ import annotations broke runtime type hints using
+        Sequence and union syntax, causing sanity import failures and molecule module
+        errors `#358 <https://github.com/ansible-middleware/keycloak/pull/358>`_
+
+        '
+    fragments:
+    - 356.yaml
+    - 357.yaml
+    - 358.yaml
+    - 359.yaml
+    release_date: '2026-06-25'
   3.0.2:
     changes:
       bugfixes:

docs/conf.py

@@ -44,7 +44,6 @@ extensions = [
     'sphinx.ext.autodoc',
     'sphinx.ext.intersphinx',
     'sphinx_antsibull_ext',
-    'ansible_basic_sphinx_ext',
 ]
 
 # Add any paths that contain templates here, relative to this directory.

docs/requirements.txt

@@ -1,10 +1,7 @@
-# ansible_basic_sphinx_ext still imports pkg_resources (removed in setuptools 82+).
-setuptools>=70.0.0,<81.0.0
 antsibull>=0.17.0
 antsibull-docs
 antsibull-changelog
 ansible-core>=2.16.0
 ansible-pygments
 sphinx-rtd-theme
-git+https://github.com/felixfontein/ansible-basic-sphinx-ext
 myst-parser

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: middleware_automation
 name: keycloak
-version: "3.0.9"
+version: "3.0.10"
 readme: README.md
 authors:
   - Romain Pelisse <rpelisse@redhat.com>

molecule/debian/converge.yml

@@ -14,32 +14,32 @@
   roles:
     - role: keycloak_quarkus
     - role: keycloak_realm
-      keycloak_url: "{{ keycloak_quarkus_hostname }}"
+      keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
-      keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
+      keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
-      keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
+      keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
-      keycloak_client_users:
+      keycloak_realm_client_users:
         - username: TestUser
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
         - username: TestAdmin
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
             - client: TestClient
               role: TestRoleAdmin
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
-      keycloak_realm: TestRealm
+      keycloak_realm_realm: TestRealm
-      keycloak_clients:
+      keycloak_realm_clients:
         - name: TestClient
-          realm: "{{ keycloak_realm }}"
+          realm: "{{ keycloak_realm_realm }}"
-          public_client: "{{ keycloak_client_public }}"
+          public_client: "{{ keycloak_realm_client_public }}"
-          web_origins: "{{ keycloak_client_web_origins }}"
+          web_origins: "{{ keycloak_realm_client_web_origins }}"
-          users: "{{ keycloak_client_users }}"
+          users: "{{ keycloak_realm_client_users }}"
           client_id: TestClient
           attributes:
             post.logout.redirect.uris: '/public/logout'

molecule/default/converge.yml

@@ -19,30 +19,30 @@
   roles:
     - role: keycloak_quarkus
     - role: keycloak_realm
-      keycloak_url: "{{ keycloak_quarkus_hostname }}"
+      keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
-      keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
+      keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
-      keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
+      keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
-      keycloak_client_users:
+      keycloak_realm_client_users:
         - username: TestUser
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
         - username: TestAdmin
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
             - client: TestClient
               role: TestRoleAdmin
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
-      keycloak_realm: TestRealm
+      keycloak_realm_realm: TestRealm
-      keycloak_clients:
+      keycloak_realm_clients:
         - name: TestClient
-          realm: "{{ keycloak_realm }}"
+          realm: "{{ keycloak_realm_realm }}"
-          public_client: "{{ keycloak_client_public }}"
+          public_client: "{{ keycloak_realm_client_public }}"
-          web_origins: "{{ keycloak_client_web_origins }}"
+          web_origins: "{{ keycloak_realm_client_web_origins }}"
-          users: "{{ keycloak_client_users }}"
+          users: "{{ keycloak_realm_client_users }}"
           client_id: TestClient

molecule/default/prepare.yml

@@ -23,6 +23,7 @@
         url: https://github.com/keycloak/keycloak/releases/download/26.6.2/keycloak-26.6.2.zip
         dest: /tmp/keycloak
         mode: '0640'
+        validate_certs: false
       delegate_to: localhost
       run_once: true
       ignore_errors: true

molecule/keycloak_modules/verify.yml

@@ -253,6 +253,50 @@
               clientId: molecule-idp-client
             state: present
 
+        - name: keycloak_identity_provider — set hide_on_login via top-level param
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: true
+            state: present
+          register: idp_hide_on_login_result
+
+        - name: Assert hide_on_login is set correctly in end_state
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_result is changed
+              - idp_hide_on_login_result.end_state.hideOnLogin == true
+              - "'hide_on_login' not in (idp_hide_on_login_result.end_state.config | default({}))"
+
+        - name: keycloak_identity_provider — set hide_on_login idempotency check
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: true
+            state: present
+          register: idp_hide_on_login_idempotent_result
+
+        - name: Assert hide_on_login idempotency (no change)
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_idempotent_result is not changed
+              - idp_hide_on_login_idempotent_result.end_state.hideOnLogin == true
+
+        - name: keycloak_identity_provider — set hide_on_login via legacy config key (backward compat)
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: false
+            state: present
+          register: idp_hide_on_login_off_result
+
+        - name: Assert hide_on_login can be toggled off via top-level param
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_off_result is changed
+              - idp_hide_on_login_off_result.end_state.hideOnLogin == false
+              - "'hide_on_login_page' not in (idp_hide_on_login_off_result.end_state.config | default({}))"
+
         - name: keycloak_clienttemplate — create client template
           middleware_automation.keycloak.keycloak_clienttemplate:
             realm: "{{ target_realm }}"

molecule/overridexml/converge.yml

@@ -4,8 +4,6 @@
   vars_files:
     - ../group_vars/all/vars.yml
   vars:
-    rhn_username: "{{ lookup('env', 'rhn_username') | default('4278e994-7f90-46eb-b99c-90f2815b845f', true) }}"
-    rhn_password: "{{ lookup('env', 'rhn_password') | default('AHOLJo08ursGdWVm0F66iDR5Owk0CwpL', true) }}"
     keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
     keycloak_admin_password: "remembertochangeme"
     keycloak_quarkus_hostname: "http://instance:8080"

molecule/quarkus/converge.yml

@@ -7,7 +7,7 @@
     keycloak_quarkus_show_deprecation_warnings: false
     keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
     keycloak_quarkus_bootstrap_admin_user: "remembertochangeme"
-    keycloak_realm: TestRealm
+    keycloak_realm_realm: TestRealm
     keycloak_quarkus_hostname: https://instance:8443
     keycloak_quarkus_log: file
     keycloak_quarkus_log_level: debug # needed for the verify step
@@ -62,34 +62,34 @@
   roles:
     - role: keycloak_quarkus
     - role: keycloak_realm
-      keycloak_url: http://instance:8080
+      keycloak_realm_url: http://instance:8080
-      keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
+      keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
-      keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
+      keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
-      keycloak_client_default_roles:
+      keycloak_realm_client_default_roles:
         - TestRoleAdmin
         - TestRoleUser
-      keycloak_client_users:
+      keycloak_realm_client_users:
         - username: TestUser
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
         - username: TestAdmin
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
             - client: TestClient
               role: TestRoleAdmin
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
-      keycloak_realm: TestRealm
+      keycloak_realm_realm: TestRealm
-      keycloak_clients:
+      keycloak_realm_clients:
         - name: TestClient
-          roles: "{{ keycloak_client_default_roles }}"
+          roles: "{{ keycloak_realm_client_default_roles }}"
-          realm: "{{ keycloak_realm }}"
+          realm: "{{ keycloak_realm_realm }}"
-          public_client: "{{ keycloak_client_public }}"
+          public_client: "{{ keycloak_realm_client_public }}"
-          web_origins: "{{ keycloak_client_web_origins }}"
+          web_origins: "{{ keycloak_realm_client_web_origins }}"
-          users: "{{ keycloak_client_users }}"
+          users: "{{ keycloak_realm_client_users }}"
           client_id: TestClient

molecule/quarkus_devmode/converge.yml

@@ -7,7 +7,7 @@
     keycloak_quarkus_show_deprecation_warnings: false
     keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
     keycloak_quarkus_bootstrap_admin_user: "remembertochangeme"
-    keycloak_realm: TestRealm
+    keycloak_realm_realm: TestRealm
     keycloak_quarkus_log: file
     keycloak_quarkus_hostname: 'http://localhost:8080'
     keycloak_quarkus_start_dev: True
@@ -18,34 +18,34 @@
   roles:
     - role: keycloak_quarkus
     - role: keycloak_realm
-      keycloak_url: "{{ keycloak_quarkus_hostname }}"
+      keycloak_realm_url: "{{ keycloak_quarkus_hostname }}"
-      keycloak_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
+      keycloak_realm_admin_user: "{{ keycloak_quarkus_bootstrap_admin_user }}"
-      keycloak_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
+      keycloak_realm_admin_password: "{{ keycloak_quarkus_bootstrap_admin_password }}"
-      keycloak_client_default_roles:
+      keycloak_realm_client_default_roles:
         - TestRoleAdmin
         - TestRoleUser
-      keycloak_client_users:
+      keycloak_realm_client_users:
         - username: TestUser
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
         - username: TestAdmin
           password: password
           client_roles:
             - client: TestClient
               role: TestRoleUser
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
             - client: TestClient
               role: TestRoleAdmin
-              realm: "{{ keycloak_realm }}"
+              realm: "{{ keycloak_realm_realm }}"
-      keycloak_realm: TestRealm
+      keycloak_realm_realm: TestRealm
-      keycloak_clients:
+      keycloak_realm_clients:
         - name: TestClient
-          roles: "{{ keycloak_client_default_roles }}"
+          roles: "{{ keycloak_realm_client_default_roles }}"
-          realm: "{{ keycloak_realm }}"
+          realm: "{{ keycloak_realm_realm }}"
-          public_client: "{{ keycloak_client_public }}"
+          public_client: "{{ keycloak_realm_client_public }}"
-          web_origins: "{{ keycloak_client_web_origins }}"
+          web_origins: "{{ keycloak_realm_client_web_origins }}"
-          users: "{{ keycloak_client_users }}"
+          users: "{{ keycloak_realm_client_users }}"
           client_id: TestClient

molecule/sso_test/converge.yml

@@ -0,0 +1,22 @@
+---
+- name: Converge
+  hosts: all
+  vars_files:
+    - ../group_vars/all/vars.yml
+  vars:
+    keycloak_admin_password: "remembertochangeme"
+    keycloak_enable: true
+    keycloak_offline_install: false
+  roles:
+    - role: keycloak
+    - role: keycloak_realm
+      keycloak_realm_url: "http://instance:8080"
+      keycloak_realm_context: "/auth"
+      keycloak_realm_admin_user: "admin"
+      keycloak_realm_admin_password: "remembertochangeme"
+      keycloak_realm_realm: TestRealm
+      keycloak_realm_clients:
+        - name: TestClient
+          realm: "{{ keycloak_realm_realm }}"
+          public_client: true
+          client_id: TestClient

molecule/sso_test/molecule.yml

@@ -0,0 +1,31 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: registry.access.redhat.com/ubi9/ubi-init:latest
+    command: /usr/sbin/init
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+      callbacks_enabled: profile_tasks, timer, yaml
+    ssh_connection:
+      pipelining: false
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  inventory:
+    host_vars:
+      instance:
+        ansible_user: root
+verifier:
+  name: ansible

molecule/sso_test/prepare.yml

@@ -0,0 +1,11 @@
+---
+- name: Prepare
+  hosts: all
+  vars_files:
+    - ../group_vars/all/vars.yml
+  gather_facts: yes
+  vars:
+    sudo_pkg_name: sudo
+  tasks:
+    - name: "Run preparation common to all scenario"
+      ansible.builtin.include_tasks: ../prepare.yml

molecule/sso_test/verify.yml

@@ -0,0 +1,26 @@
+---
+- name: Verify
+  hosts: all
+  vars:
+    keycloak_admin_password: "remembertochangeme"
+    keycloak_admin_user: "admin"
+    keycloak_uri: "http://localhost:8080"
+    keycloak_context: "/auth"
+  tasks:
+    - name: Populate service facts
+      ansible.builtin.service_facts:
+    - name: Check if keycloak service started
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.services["keycloak.service"]["state"] == "running"
+          - ansible_facts.services["keycloak.service"]["status"] == "enabled"
+    - name: Verify token api call
+      ansible.builtin.uri:
+        url: "{{ keycloak_uri }}{{ keycloak_context }}/realms/master/protocol/openid-connect/token"
+        method: POST
+        body: "client_id=admin-cli&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password"
+        validate_certs: no
+      register: keycloak_auth_response
+      until: keycloak_auth_response.status == 200
+      retries: 2
+      delay: 2

playbooks/keycloak_federation.yml

@@ -6,9 +6,9 @@
       ansible.builtin.include_role:
         name: keycloak_realm
       vars:
-        keycloak_admin_password: "remembertochangeme"
+        keycloak_realm_admin_password: "remembertochangeme"
-        keycloak_realm: TestRealm
+        keycloak_realm_realm: TestRealm
-        keycloak_user_federation:
+        keycloak_realm_user_federation:
           - realm: TestRealm
             name: my-ldap
             provider_id: ldap
@@ -48,13 +48,13 @@
                   ldap.full.name.attribute: cn
                   read.only: true
                   write.only: false
-        keycloak_clients:
+        keycloak_realm_clients:
           - name: TestClient1
             client_id: TestClient1
             roles:
               - TestClient1Admin
               - TestClient1User
-            realm: "{{ keycloak_realm }}"
+            realm: "{{ keycloak_realm_realm }}"
             public_client: true
             web_origins:
               - http://testclient1origin/application
@@ -65,4 +65,4 @@
                 client_roles:
                   - client: TestClient1
                     role: TestClient1User
-                    realm: "{{ keycloak_realm }}"
+                    realm: "{{ keycloak_realm_realm }}"

playbooks/keycloak_realm.yml

@@ -2,8 +2,8 @@
 - name: Playbook for Keycloak Hosts
   hosts: all
   vars:
-    keycloak_admin_password: "remembertochangeme"
+    keycloak_realm_admin_password: "remembertochangeme"
-    keycloak_clients:
+    keycloak_realm_clients:
       - name: TestClient1
         client_id: TestClient1
         roles:
@@ -23,4 +23,4 @@
                 realm: TestRealm
   roles:
     - role: middleware_automation.keycloak.keycloak_realm
-      keycloak_realm: TestRealm
+      keycloak_realm_realm: TestRealm

playbooks/keycloak_realm_client.yml

@@ -6,12 +6,12 @@
       ansible.builtin.include_role:
         name: middleware_automation.keycloak.keycloak_realm
       vars:
-        keycloak_admin_password: "remembertochangeme"
+        keycloak_realm_admin_password: "remembertochangeme"
-        keycloak_realm: TestRealm
+        keycloak_realm_realm: TestRealm
-        keycloak_client_default_roles:
+        keycloak_realm_client_default_roles:
           - TestRoleAdmin
           - TestRoleUser
-        keycloak_client_users:
+        keycloak_realm_client_users:
           - username: TestUser
             password: password
             client_roles:
@@ -27,13 +27,13 @@
               - client: TestClient1
                 role: TestRoleAdmin
                 realm: TestRealm
-        keycloak_clients:
+        keycloak_realm_clients:
           - name: TestClient1
             client_id: TestClient1
-            roles: "{{ keycloak_client_default_roles }}"
+            roles: "{{ keycloak_realm_client_default_roles }}"
             realm: TestRealm
             public_client: true
             web_origins:
               - http://testclient1origin/application
               - http://testclient1origin/other
-            users: "{{ keycloak_client_users }}"
+            users: "{{ keycloak_realm_client_users }}"

plugins/doc_fragments/actiongroup_keycloak.py

@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from __future__ import (absolute_import, division, print_function)
+from __future__ import annotations
 __metaclass__ = type
 
 

plugins/doc_fragments/attributes.py

@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from __future__ import (absolute_import, division, print_function)
+from __future__ import annotations
 __metaclass__ = type
 
 

plugins/doc_fragments/keycloak.py

@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from __future__ import (absolute_import, division, print_function)
+from __future__ import annotations
 __metaclass__ = type
 
 

plugins/module_utils/identity/keycloak/_keycloak_utils.py

@@ -5,7 +5,9 @@
 # Note that this module util is **PRIVATE** to the collection. It can have breaking changes at any time.
 # Do not use this from other collections or standalone plugins/modules!
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 import typing as t
 

plugins/module_utils/identity/keycloak/keycloak.py

@@ -2,7 +2,9 @@
 # BSD 2-Clause license (see LICENSES/BSD-2-Clause.txt)
 # SPDX-License-Identifier: BSD-2-Clause
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 import copy
 import json

plugins/module_utils/identity/keycloak/keycloak_clientsecret.py

@@ -2,7 +2,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 import typing as t
 

plugins/modules/keycloak_authentication.py

@@ -2,7 +2,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authentication

plugins/modules/keycloak_authentication_flow.py

@@ -5,7 +5,8 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from __future__ import absolute_import, division, print_function
+from __future__ import (absolute_import, division, print_function)
+from __future__ import annotations
 __metaclass__ = type
 
 DOCUMENTATION = '''

plugins/modules/keycloak_authentication_required_actions.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authentication_required_actions

plugins/modules/keycloak_authentication_v2.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authentication_v2

plugins/modules/keycloak_authz_authorization_scope.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authz_authorization_scope

plugins/modules/keycloak_authz_custom_policy.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authz_custom_policy

plugins/modules/keycloak_authz_permission.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authz_permission

plugins/modules/keycloak_authz_permission_info.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_authz_permission_info

plugins/modules/keycloak_client.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_client

plugins/modules/keycloak_client_rolemapping.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_client_rolemapping

plugins/modules/keycloak_client_rolescope.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_client_rolescope

plugins/modules/keycloak_client_scope.py

@@ -5,7 +5,8 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from __future__ import absolute_import, division, print_function
+from __future__ import (absolute_import, division, print_function)
+from __future__ import annotations
 __metaclass__ = type
 
 DOCUMENTATION = '''

plugins/modules/keycloak_client_scope_rolemappings.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_client_scope_rolemappings

plugins/modules/keycloak_client_scope_type.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_client_scope_type

plugins/modules/keycloak_clientsecret_info.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_clientsecret_info

plugins/modules/keycloak_clientsecret_regenerate.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_clientsecret_regenerate

plugins/modules/keycloak_clienttemplate.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_clienttemplate

plugins/modules/keycloak_component.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_component

plugins/modules/keycloak_component_info.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_component_info

plugins/modules/keycloak_group.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_group

plugins/modules/keycloak_identity_provider.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_identity_provider
@@ -115,6 +117,15 @@ options:
       - authenticateByDefault
     type: bool
 
+  hide_on_login:
+    description:
+      - If hidden, login with this provider is possible only if requested explicitly, for example using the C(kc_idp_hint)
+        parameter.
+    aliases:
+      - hideOnLogin
+      - hide_on_login_page
+    type: bool
+
   provider_id:
     description:
       - Protocol used by this provider (supported values are V(oidc) or V(saml)).
@@ -129,14 +140,6 @@ options:
         identity provider configuration through check-mode in the RV(existing) field.
     type: dict
     suboptions:
-      hide_on_login_page:
-        description:
-          - If hidden, login with this provider is possible only if requested explicitly, for example using the C(kc_idp_hint)
-            parameter.
-        aliases:
-          - hideOnLoginPage
-        type: bool
-
       gui_order:
         description:
           - Number defining order of the provider in GUI (for example, on Login page).
@@ -569,6 +572,7 @@ def main():
         alias=dict(type="str", required=True),
         add_read_token_role_on_create=dict(type="bool", aliases=["addReadTokenRoleOnCreate"]),
         authenticate_by_default=dict(type="bool", aliases=["authenticateByDefault"]),
+        hide_on_login=dict(type="bool", aliases=["hideOnLogin", "hide_on_login_page"]),
         config=dict(type="dict"),
         display_name=dict(type="str", aliases=["displayName"]),
         enabled=dict(type="bool"),
@@ -608,6 +612,20 @@ def main():
     state = module.params.get("state")
     config = module.params.get("config")
 
+    if config is not None:
+        for legacy_key in ("hide_on_login_page", "hideOnLoginPage"):
+            if legacy_key in config:
+                module.deprecate(
+                    f"Passing '{legacy_key}' inside 'config' is deprecated. "
+                    "Use the top-level 'hide_on_login' parameter instead.",
+                    version="4.0.0",
+                    collection_name="middleware_automation.keycloak",
+                )
+                if module.params.get("hide_on_login") is None:
+                    module.params["hide_on_login"] = config.pop(legacy_key)
+                else:
+                    config.pop(legacy_key)
+
     fetch_identity_provider_wellknown_config(kc, config)
 
     # Filter and map the parameters names that apply to the identity provider.

plugins/modules/keycloak_realm.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm

plugins/modules/keycloak_realm_info.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm_info

plugins/modules/keycloak_realm_key.py

@@ -4,7 +4,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm_key

plugins/modules/keycloak_realm_keys_metadata_info.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm_keys_metadata_info

plugins/modules/keycloak_realm_localization.py

@@ -4,7 +4,9 @@
 # https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm_localization

plugins/modules/keycloak_realm_rolemapping.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_realm_rolemapping

plugins/modules/keycloak_role.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_role

plugins/modules/keycloak_user.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_user

plugins/modules/keycloak_user_execute_actions_email.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_user_execute_actions_email

plugins/modules/keycloak_user_federation.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_user_federation

plugins/modules/keycloak_user_rolemapping.py

@@ -2,7 +2,9 @@
 # Copyright (c) 2022, Dušan Marković (@bratwurzt)
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_user_rolemapping

plugins/modules/keycloak_userprofile.py

@@ -3,7 +3,9 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from __future__ import (absolute_import, division, print_function)
 from __future__ import annotations
+__metaclass__ = type
 
 DOCUMENTATION = r"""
 module: keycloak_userprofile

roles/keycloak/meta/argument_specs.yml

@@ -388,6 +388,6 @@ argument_specs:
                 description: "Red Hat SSO patch archive filename"
                 type: "str"
             sso_product_category:
-                default: "core.service.rhsso"
+                default: "CORE.SERVICE.RHSSO"
-                description: "JBossNetwork API category for Single Sign-On"
+                description: "Unified Downloads API category for Single Sign-On"
                 type: "str"

roles/keycloak/tasks/fastpackages.yml

@@ -1,24 +1,24 @@
 ---
 - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
   ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
-  register: rpm_info
+  register: keycloak_rpm_info
   changed_when: false
   failed_when: false
   when: ansible_facts.os_family == "RedHat"
 
 - name: "Add missing packages to the yum install list"
   ansible.builtin.set_fact:
-    packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \
+    keycloak_packages_to_install: "{{ keycloak_packages_to_install | default([]) + keycloak_rpm_info.stdout_lines | \
                           map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
   when: ansible_facts.os_family == "RedHat"
 
-- name: "Install packages: {{ packages_to_install }}"
+- name: "Install packages: {{ keycloak_packages_to_install }}"
   become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}"
   ansible.builtin.dnf:
-    name: "{{ packages_to_install }}"
+    name: "{{ keycloak_packages_to_install }}"
     state: present
   when:
-    - packages_to_install | default([]) | length > 0
+    - keycloak_packages_to_install | default([]) | length > 0
     - ansible_facts.os_family == "RedHat"
 
 - name: "Install packages: {{ packages_list }}"

roles/keycloak/tasks/firewalld.yml

@@ -12,7 +12,7 @@
     enabled: true
     state: started
 
-- name: "Configure firewall ports for {{ keycloak.service_name }}"
+- name: "Configure firewall ports for {{ keycloak_config.service_name }}"
   become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}"
   ansible.posix.firewalld:
     port: "{{ item }}"

roles/keycloak/tasks/install.yml

@@ -14,18 +14,18 @@
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.stat:
     path: "{{ keycloak_jboss_home }}"
-  register: existing_deploy
+  register: keycloak_existing_deploy
 
 - name: Stop and restart if existing deployment exists and install forced
-  when: existing_deploy.stat.exists and keycloak_force_install | bool
+  when: keycloak_existing_deploy.stat.exists and keycloak_force_install | bool
   block:
-    - name: "Stop the old {{ keycloak.service_name }} service"
+    - name: "Stop the old service: {{ keycloak_config.service_name }}"
       become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
       failed_when: false
       ansible.builtin.systemd:
         name: keycloak
         state: stopped
-    - name: "Remove the old {{ keycloak.service_name }} deployment"
+    - name: "Remove the old deployment: {{ keycloak_config.service_name }}"
       become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
       ansible.builtin.file:
         path: "{{ keycloak_jboss_home }}"
@@ -36,7 +36,7 @@
   ansible.builtin.stat:
     path: "{{ keycloak_jboss_home }}"
 
-- name: "Create service user/group for {{ keycloak.service_name }}"
+- name: "Create service user/group for {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.user:
     name: "{{ keycloak_service_user }}"
@@ -44,7 +44,7 @@
     system: true
     create_home: false
 
-- name: "Create install location for {{ keycloak.service_name }}"
+- name: "Create install location for {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.file:
     dest: "{{ keycloak_dest }}"
@@ -65,34 +65,35 @@
 ## check remote archive
 - name: Set download archive path
   ansible.builtin.set_fact:
-    archive: "{{ keycloak_dest }}/{{ keycloak.bundle }}"
+    keycloak_archive_full_path: "{{ keycloak_dest }}/{{ keycloak_archive }}"
 
 - name: Check download archive path
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.stat:
-    path: "{{ archive }}"
+    path: "{{ keycloak_archive_full_path }}"
-  register: archive_path
+  register: keycloak_archive_path
 
 ## download to controller
 - name: Check local download archive path
   ansible.builtin.stat:
     path: "{{ lookup('env', 'PWD') }}"
-  register: local_path
+  register: keycloak_local_path
   delegate_to: localhost
 
 - name: Download keycloak archive
   ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
     url: "{{ keycloak_download_url }}"
-    dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
     mode: '0644'
     url_username: "{{ keycloak_binary_download_user | default(omit) }}"
     url_password: "{{ keycloak_binary_download_pass | default(omit) }}"
+    validate_certs: false
   delegate_to: localhost
   run_once: true
   when:
-    - archive_path is defined
+    - keycloak_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_archive_path.stat.exists
     - not sso_enable is defined or not sso_enable
     - not keycloak_offline_install
 
@@ -100,9 +101,9 @@
   delegate_to: localhost
   run_once: true
   when:
-    - archive_path is defined
+    - keycloak_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_archive_path.stat.exists
     - sso_enable is defined and sso_enable
     - not keycloak_offline_install
   block:
@@ -113,14 +114,18 @@
         product_type: DISTRIBUTION
         product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
         product_category: "{{ sso_product_category }}"
-      register: rhn_products
+        validate_certs: false
+      register: keycloak_rhn_products
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
 
     - name: Determine install zipfile from search results
       ansible.builtin.set_fact:
-        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_archive + '$') }}"
+        keycloak_rhn_filtered_products: >-
+          {{ keycloak_rhn_products.results
+          | selectattr('file_name', 'search', 'rh-sso-' + sso_version + '-server-dist.zip$')
+          | list }}
       delegate_to: localhost
       run_once: true
 
@@ -128,8 +133,9 @@
       middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
         client_id: "{{ rhn_username }}"
         client_secret: "{{ rhn_password }}"
-        product_id: "{{ (rhn_filtered_products | first).id }}"
+        product_id: "{{ (keycloak_rhn_filtered_products | first).id }}"
-        dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+        dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
+        validate_certs: false
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
@@ -137,68 +143,69 @@
 - name: Download rhsso archive from alternate location
   ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
     url: "{{ keycloak_rhsso_download_url }}"
-    dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
     mode: '0644'
+    validate_certs: false
   delegate_to: localhost
   run_once: true
   when:
-    - archive_path is defined
+    - keycloak_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_archive_path.stat.exists
     - sso_enable is defined and sso_enable
     - not keycloak_offline_install
     - keycloak_rhsso_download_url is defined
 
 - name: Check downloaded archive
   ansible.builtin.stat:
-    path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    path: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
-  register: local_archive_path
+  register: keycloak_local_archive_path
   delegate_to: localhost
 
 ## copy and unpack
 - name: Copy archive to target nodes
   ansible.builtin.copy:
-    src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
-    dest: "{{ archive }}"
+    dest: "{{ keycloak_archive_full_path }}"
     owner: "{{ keycloak_service_user }}"
     group: "{{ keycloak_service_group }}"
     mode: '0640'
-  register: new_version_downloaded
+  register: keycloak_new_version_downloaded
   when:
-    - not archive_path.stat.exists
+    - not keycloak_archive_path.stat.exists
-    - local_archive_path.stat is defined
+    - keycloak_local_archive_path.stat is defined
-    - local_archive_path.stat.exists
+    - keycloak_local_archive_path.stat.exists
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
 
-- name: "Check target directory: {{ keycloak.home }}"
+- name: "Check target directory: {{ keycloak_config.home }}"
   ansible.builtin.stat:
-    path: "{{ keycloak.home }}"
+    path: "{{ keycloak_config.home }}"
-  register: path_to_workdir
+  register: keycloak_path_to_workdir
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
 
-- name: "Extract {{ keycloak_service_desc }} archive on target"
+- name: "Extract archive on target: {{ keycloak_service_desc }}"
   ansible.builtin.unarchive:
     remote_src: true
-    src: "{{ archive }}"
+    src: "{{ keycloak_archive_full_path }}"
     dest: "{{ keycloak_dest }}"
-    creates: "{{ keycloak.home }}"
+    creates: "{{ keycloak_config.home }}"
     owner: "{{ keycloak_service_user }}"
     group: "{{ keycloak_service_group }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   when:
-    - new_version_downloaded.changed or not path_to_workdir.stat.exists
+    - keycloak_new_version_downloaded.changed or not keycloak_path_to_workdir.stat.exists
   notify:
     - restart keycloak
 
 - name: Inform decompression was not executed
   ansible.builtin.debug:
-    msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression"
+    msg: "{{ keycloak_config.home }} already exists and version unchanged, skipping decompression"
   when:
-    - not new_version_downloaded.changed and path_to_workdir.stat.exists
+    - not keycloak_new_version_downloaded.changed and keycloak_path_to_workdir.stat.exists
 
 - name: "Reown installation directory to {{ keycloak_service_user }}"
   ansible.builtin.file:
-    path: "{{ keycloak.home }}"
+    path: "{{ keycloak_config.home }}"
     owner: "{{ keycloak_service_user }}"
     group: "{{ keycloak_service_group }}"
     recurse: true
@@ -206,17 +213,17 @@
   changed_when: false
 
 - name: Ensure permissions are correct on existing deploy
-  ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak.home }}"
+  ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak_config.home }}"
   when: keycloak_service_runas
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   changed_when: false
 
 # driver and configuration
-- name: "Install {{ keycloak_jdbc_engine }} driver"
+- name: "Install database driver: {{ keycloak_jdbc_engine }}"
   ansible.builtin.include_tasks: jdbc_driver.yml
   when: keycloak_jdbc[keycloak_jdbc_engine].enabled
 
-- name: "Deploy custom {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }} from {{ keycloak_config_override_template }}"
+- name: "Deploy custom config: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: "templates/{{ keycloak_config_override_template }}"
@@ -226,9 +233,9 @@
     mode: '0640'
   notify:
     - restart keycloak
-  when: keycloak_config_override_template | length > 0
+  when: (keycloak_config_override_template | default('', true)) | length > 0
 
-- name: "Deploy standalone {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}"
+- name: "Deploy standalone config: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: templates/standalone.xml.j2
@@ -240,7 +247,7 @@
     - restart keycloak
   when:
     - not keycloak_ha_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
 - name: Create tcpping cluster node list
   ansible.builtin.set_fact:
@@ -256,7 +263,7 @@
   loop: "{{ ansible_play_batch }}"
   when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING'
 
-- name: "Deploy HA {{ keycloak.service_name }} config to {{ keycloak_config_path_to_standalone_xml }}"
+- name: "Deploy HA config: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: templates/standalone-ha.xml.j2
@@ -269,9 +276,9 @@
   when:
     - keycloak_ha_enabled
     - not keycloak_remote_cache_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
-- name: "Deploy HA {{ keycloak.service_name }} config with infinispan remote cache store to {{ keycloak_config_path_to_standalone_xml }}"
+- name: "Deploy HA config with infinispan: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: templates/standalone-infinispan.xml.j2
@@ -284,7 +291,7 @@
   when:
     - keycloak_ha_enabled
     - keycloak_remote_cache_enabled
-    - keycloak_config_override_template | length == 0
+    - (keycloak_config_override_template | default('', true)) | length == 0
 
 - name: "Deploy profile.properties file to {{ keycloak_config_path_to_properties }}"
   become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
@@ -296,4 +303,4 @@
     mode: '0640'
   notify:
     - restart keycloak
-  when: keycloak_features | length > 0
+  when: (keycloak_features | default([], true)) | length > 0

roles/keycloak/tasks/iptables.yml

@@ -5,7 +5,7 @@
     packages_list:
       - iptables
 
-- name: "Configure firewall ports for {{ keycloak.service_name }}"
+- name: "Configure firewall ports for {{ keycloak_config.service_name }}"
   become: "{{ keycloak_iptables_require_privilege_escalation | default(true) }}"
   ansible.builtin.iptables:
     destination_port: "{{ item }}"

roles/keycloak/tasks/jdbc_driver.yml

@@ -2,7 +2,7 @@
 - name: "Check module directory: {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
   ansible.builtin.stat:
     path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
-  register: dest_path
+  register: keycloak_dest_path
   become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
 
 - name: "Set up module dir for JDBC Driver {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}"

roles/keycloak/tasks/main.yml

@@ -66,7 +66,7 @@
       retries: 2
       delay: 2
   rescue:
-    - name: "Create {{ keycloak.service_name }} admin user"
+    - name: "Create admin user: {{ keycloak_config.service_name }}"
       ansible.builtin.command:
       args:
         argv:
@@ -76,11 +76,11 @@
           - "-p{{ keycloak_admin_password }}"
       changed_when: true
       become: "{{ keycloak_require_privilege_escalation | default(true) }}"
-    - name: "Restart {{ keycloak.service_name }}"
+    - name: "Restart service: {{ keycloak_config.service_name }}"
       ansible.builtin.include_tasks: tasks/restart_keycloak.yml
-    - name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}"
+    - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
       ansible.builtin.uri:
-        url: "{{ keycloak.health_url }}"
+        url: "{{ keycloak_config.health_url }}"
       register: keycloak_status
       until: keycloak_status.status == 200
       retries: 25

roles/keycloak/tasks/prereqs.yml

@@ -2,7 +2,7 @@
 - name: Validate admin console password
   ansible.builtin.assert:
     that:
-      - keycloak_admin_password | length > 12
+      - (keycloak_admin_password | default('', true)) | length > 12
     quiet: true
     fail_msg: >
       The console administrator password is empty or invalid. Please set the keycloak_admin_password variable to a 12+ char long string
@@ -31,9 +31,9 @@
   ansible.builtin.assert:
     that:
       - keycloak_jdbc_engine is defined and keycloak_jdbc_engine in [ 'postgres', 'mariadb', 'sqlserver' ]
-      - keycloak_jdbc_url | length > 0
+      - (keycloak_jdbc_url | default('', true)) | length > 0
-      - keycloak_db_user | length > 0
+      - (keycloak_db_user | default('', true)) | length > 0
-      - keycloak_db_pass | length > 0
+      - (keycloak_db_pass | default('', true)) | length > 0
     quiet: true
     fail_msg: "Configuration for the JDBC persistence is invalid or incomplete"
     success_msg: "Configuring JDBC persistence using {{ keycloak_jdbc_engine }} database"

roles/keycloak/tasks/restart_keycloak.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Restart and enable {{ keycloak.service_name }} service"
+- name: "Restart and enable service: {{ keycloak_config.service_name }}"
   ansible.builtin.systemd:
     name: keycloak
     enabled: true
@@ -9,9 +9,9 @@
   delegate_to: "{{ ansible_play_hosts | first }}"
   run_once: true
 
-- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}"
+- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
   ansible.builtin.uri:
-    url: "{{ keycloak.health_url }}"
+    url: "{{ keycloak_config.health_url }}"
   register: keycloak_status
   until: keycloak_status.status == 200
   delegate_to: "{{ ansible_play_hosts | first }}"
@@ -19,7 +19,7 @@
   retries: "{{ keycloak_service_start_retries }}"
   delay: "{{ keycloak_service_start_delay }}"
 
-- name: "Restart and enable {{ keycloak.service_name }} service"
+- name: "Restart and enable service (remaining nodes): {{ keycloak_config.service_name }}"
   ansible.builtin.systemd:
     name: keycloak
     enabled: true

roles/keycloak/tasks/rhsso_cli.yml

@@ -8,6 +8,6 @@
 
 - name: "Execute CLI query: {{ cli_query }}"
   ansible.builtin.command: >
-    {{ keycloak.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }}
+    {{ keycloak_config.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }}
   changed_when: false
-  register: cli_result
+  register: keycloak_cli_result

roles/keycloak/tasks/rhsso_patch.yml

@@ -2,15 +2,15 @@
 ## check remote patch archive
 - name: Set download patch archive path
   ansible.builtin.set_fact:
-    patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}"
+    keycloak_patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}"
-    patch_bundle: "{{ sso_patch_bundle }}"
+    keycloak_patch_bundle: "{{ sso_patch_bundle }}"
-    patch_version: "{{ sso_patch_version }}"
+    keycloak_patch_version: "{{ sso_patch_version }}"
   when: sso_patch_version is defined
 
 - name: Check download patch archive path
   ansible.builtin.stat:
-    path: "{{ patch_archive }}"
+    path: "{{ keycloak_patch_archive }}"
-  register: patch_archive_path
+  register: keycloak_patch_archive_path
   when: sso_patch_version is defined
   become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
 
@@ -29,41 +29,42 @@
         product_type: BUGFIX
         product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
         product_category: "{{ sso_product_category }}"
-      register: rhn_products
+        validate_certs: false
+      register: keycloak_rhn_products
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
 
     - name: Determine patch versions list
       ansible.builtin.set_fact:
-        filtered_versions: "{{ rhn_products.results | map(attribute='file_name') | \
+        keycloak_filtered_versions: "{{ keycloak_rhn_products.results | map(attribute='file_name') | \
                                select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \
                                map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
     - name: Determine latest version
       ansible.builtin.set_fact:
-        sso_latest_version: "{{ filtered_versions | middleware_automation.common.version_sort | last }}"
+        keycloak_sso_latest_version: "{{ keycloak_filtered_versions | middleware_automation.common.version_sort | last }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
     - name: Determine install zipfile from search results
       ansible.builtin.set_fact:
-        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + sso_latest_version + '-patch.zip$') }}"
+        keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + keycloak_sso_latest_version + '-patch.zip$') }}"
-        patch_bundle: "rh-sso-{{ sso_latest_version }}-patch.zip"
+        keycloak_patch_bundle: "rh-sso-{{ keycloak_sso_latest_version }}-patch.zip"
-        patch_version: "{{ sso_latest_version }}"
+        keycloak_patch_version: "{{ keycloak_sso_latest_version }}"
-      when: sso_patch_version is not defined or sso_patch_version | length == 0
+      when: (sso_patch_version | default('', true)) | length == 0
       delegate_to: localhost
       run_once: true
 
     - name: "Determine selected patch from supplied version: {{ sso_patch_version }}"
       ansible.builtin.set_fact:
-        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}"
+        keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}"
-        patch_bundle: "{{ sso_patch_bundle }}"
+        keycloak_patch_bundle: "{{ sso_patch_bundle }}"
-        patch_version: "{{ sso_patch_version }}"
+        keycloak_patch_version: "{{ sso_patch_version }}"
       when: sso_patch_version is defined
       delegate_to: localhost
       run_once: true
@@ -72,35 +73,36 @@
       middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
         client_id: "{{ rhn_username }}"
         client_secret: "{{ rhn_password }}"
-        product_id: "{{ (rhn_filtered_products | sort | last).id }}"
+        product_id: "{{ (keycloak_rhn_filtered_products | sort | last).id }}"
-        dest: "{{ local_path.stat.path }}/{{ patch_bundle }}"
+        dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
+        validate_certs: false
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
 
 - name: Set download patch archive path
   ansible.builtin.set_fact:
-    patch_archive: "{{ keycloak_dest }}/{{ patch_bundle }}"
+    keycloak_patch_archive: "{{ keycloak_dest }}/{{ keycloak_patch_bundle }}"
 
 - name: Check download patch archive path
   ansible.builtin.stat:
-    path: "{{ patch_archive }}"
+    path: "{{ keycloak_patch_archive }}"
-  register: patch_archive_path
+  register: keycloak_patch_archive_path
   become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
 
 ## copy and unpack
 - name: Copy patch archive to target nodes
   ansible.builtin.copy:
-    src: "{{ local_path.stat.path }}/{{ patch_bundle }}"
+    src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
-    dest: "{{ patch_archive }}"
+    dest: "{{ keycloak_patch_archive }}"
     owner: "{{ keycloak_service_user }}"
     group: "{{ keycloak_service_group }}"
     mode: '0640'
-  register: new_version_downloaded
+  register: keycloak_new_version_downloaded
   when:
-    - not patch_archive_path.stat.exists
+    - not keycloak_patch_archive_path.stat.exists
-    - local_archive_path.stat is defined
+    - keycloak_local_archive_path.stat is defined
-    - local_archive_path.stat.exists
+    - keycloak_local_archive_path.stat.exists
   become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
 
 - name: "Check installed patches"
@@ -114,14 +116,14 @@
 
 - name: "Perform patching"
   when:
-    - cli_result is defined
+    - keycloak_cli_result is defined
-    - cli_result.stdout is defined
+    - keycloak_cli_result.stdout is defined
-    - patch_version | regex_replace('-[0-9]$', '') not in cli_result.stdout
+    - keycloak_patch_version | regex_replace('-[0-9]$', '') not in keycloak_cli_result.stdout
   block:
-    - name: "Apply patch {{ patch_version }} to server"
+    - name: "Apply patch to server: {{ keycloak_patch_version }}"
       ansible.builtin.include_tasks: rhsso_cli.yml
       vars:
-        cli_query: "patch apply {{ patch_archive }}"
+        cli_query: "patch apply {{ keycloak_patch_archive }}"
       args:
         apply:
           become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
@@ -132,15 +134,15 @@
       vars:
         cli_query: "shutdown --restart"
       when:
-        - cli_result.rc == 0
+        - keycloak_cli_result.rc == 0
       args:
         apply:
           become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
           become_user: "{{ keycloak_service_user }}"
 
-    - name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}"
+    - name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
       ansible.builtin.uri:
-        url: "{{ keycloak.health_url }}"
+        url: "{{ keycloak_config.health_url }}"
       register: keycloak_status
       until: keycloak_status.status == 200
       retries: 25
@@ -158,14 +160,14 @@
     - name: "Verify installed patch version"
       ansible.builtin.assert:
         that:
-          - patch_version not in cli_result.stdout
+          - keycloak_patch_version not in keycloak_cli_result.stdout
         fail_msg: "Patch installation failed"
         success_msg: "Patch installation successful"
 
 - name: "Skipping patch"
   ansible.builtin.debug:
-    msg: "Cumulative patch {{ patch_version }} already installed, skipping patch installation."
+    msg: "Cumulative patch {{ keycloak_patch_version }} already installed, skipping patch installation."
   when:
-    - cli_result is defined
+    - keycloak_cli_result is defined
-    - cli_result.stdout is defined
+    - keycloak_cli_result.stdout is defined
-    - patch_version in cli_result.stdout
+    - keycloak_patch_version in keycloak_cli_result.stdout

roles/keycloak/tasks/start_keycloak.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Start {{ keycloak.service_name }} service"
+- name: "Start service: {{ keycloak_config.service_name }}"
   ansible.builtin.systemd:
     name: keycloak
     enabled: true
@@ -7,9 +7,9 @@
     daemon_reload: true
   become: "{{ keycloak_start_require_privilege_escalation | default(true) }}"
 
-- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}"
+- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
   ansible.builtin.uri:
-    url: "{{ keycloak.health_url }}"
+    url: "{{ keycloak_config.health_url }}"
   register: keycloak_status
   until: keycloak_status.status == 200
   retries: "{{ keycloak_service_start_retries }}"

roles/keycloak/tasks/stop_keycloak.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Stop {{ keycloak.service_name }}"
+- name: "Stop {{ keycloak_config.service_name }}"
   ansible.builtin.systemd:
     name: keycloak
     enabled: true

roles/keycloak/tasks/systemd.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Configure {{ keycloak.service_name }} service script wrapper"
+- name: "Configure service script wrapper: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: keycloak-service.sh.j2
@@ -10,7 +10,7 @@
   notify:
     - restart keycloak
 
-- name: "Configure sysconfig file for {{ keycloak.service_name }} service"
+- name: "Configure sysconfig file for service: {{ keycloak_config.service_name }}"
   become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: keycloak-sysconfig.j2
@@ -21,7 +21,7 @@
   notify:
     - restart keycloak
 
-- name: "Configure systemd unit file for {{ keycloak.service_name }} service"
+- name: "Configure systemd unit file for service: {{ keycloak_config.service_name }}"
   ansible.builtin.template:
     src: keycloak.service.j2
     dest: /etc/systemd/system/keycloak.service
@@ -29,16 +29,16 @@
     group: root
     mode: '0644'
   become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
-  register: systemdunit
+  register: keycloak_systemdunit
   notify:
     - restart keycloak
 
-- name: "Start and wait for {{ keycloak.service_name }} service (first node db)"
+- name: "Start and wait for service (first node db): {{ keycloak_config.service_name }}"
   ansible.builtin.include_tasks: start_keycloak.yml
   run_once: true
   when: keycloak_db_enabled
 
-- name: "Start and wait for {{ keycloak.service_name }} service (remaining nodes)"
+- name: "Start and wait for service (remaining nodes): {{ keycloak_config.service_name }}"
   ansible.builtin.include_tasks: start_keycloak.yml
 
 - name: Check service status

roles/keycloak/templates/keycloak-profile.properties.j2

@@ -1,3 +1,3 @@
-{% for feature in keycloak.features %}
+{% for feature in keycloak_config.features %}
 feature.{{ feature.name }}={{ feature.status | default('enabled') }}
 {% endfor %}

roles/keycloak/templates/keycloak-service.sh.j2

@@ -17,7 +17,7 @@ checkEnvVar() {
 #  for testing outside systemd
 . /etc/sysconfig/keycloak
 
-readonly KEYCLOAK_HOME={{ keycloak.home }}
+readonly KEYCLOAK_HOME={{ keycloak_config.home }}
 readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS}
 readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT}
 readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT}

roles/keycloak/templates/keycloak-sysconfig.j2

@@ -1,7 +1,7 @@
 {{ ansible_managed | comment }}
 JAVA_OPTS='{{ keycloak_java_opts }}'
 JAVA_HOME={{ keycloak_java_home | default(keycloak_pkg_java_home, true) }}
-JBOSS_HOME={{ keycloak.home }}
+JBOSS_HOME={{ keycloak_config.home }}
 KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }}
 KEYCLOAK_HTTP_PORT={{ keycloak_http_port }}
 KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }}

roles/keycloak/templates/keycloak.service.j2

@@ -1,6 +1,6 @@
 {{ ansible_managed | comment }}
 [Unit]
-Description={{ keycloak.service_name }} Server
+Description={{ keycloak_config.service_name }} Server
 After=network.target
 StartLimitIntervalSec={{ keycloak_service_startlimitintervalsec }}
 StartLimitBurst={{ keycloak_service_startlimitburst }}
@@ -13,8 +13,8 @@ Group={{ keycloak_service_group }}
 {% endif -%}
 EnvironmentFile=-{{ keycloak_sysconf_file }}
 PIDFile={{ keycloak_service_pidfile }}
-ExecStart={{ keycloak.home }}/bin/standalone.sh $WILDFLY_OPTS
+ExecStart={{ keycloak_config.home }}/bin/standalone.sh $WILDFLY_OPTS
-WorkingDirectory={{ keycloak.home }}
+WorkingDirectory={{ keycloak_config.home }}
 TimeoutStartSec=30
 TimeoutStopSec=30
 LimitNOFILE=102642

roles/keycloak/templates/standalone.xml.j2

@@ -526,7 +526,7 @@
                     <properties>
                         <property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
                         <property name="forceBackendUrlToFrontendUrl" value="{{ keycloak_modcluster.force_frontend_url }}"/>
-{% if keycloak_modcluster.admin_url | length > 0 %}
+{% if (keycloak_modcluster.admin_url | default('', true)) | length > 0 %}
                         <property name="adminUrl" value="{{ keycloak_modcluster.admin_url }}" />
 {% endif %}
                     </properties>
@@ -541,7 +541,7 @@
         <subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
 {% if keycloak_modcluster.enabled %}
         <subsystem xmlns="urn:jboss:domain:modcluster:5.0">
-            <proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product(keycloak_modcluster.reverse_proxy_urls | map(attribute='host')) | map('join') | list | join(' ') }}">
+            <proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product((keycloak_modcluster.reverse_proxy_urls | default([])) | map(attribute='host')) | map('join') | list | join(' ') }}">
                 <dynamic-load-provider>
                     <load-metric type="cpu"/>
                 </dynamic-load-provider>

roles/keycloak/vars/main.yml

@@ -1,9 +1,7 @@
 ---
 # internal variables below
 
-
+keycloak_config:
-
-keycloak:
   home: "{{ keycloak_jboss_home }}"
   config_dir: "{{ keycloak_config_dir }}"
   bundle: "{{ keycloak_archive }}"

roles/keycloak_quarkus/handlers/main.yml

@@ -1,9 +1,9 @@
 ---
-- name: "Invalidate {{ keycloak.service_name }} theme cache"
+- name: "Invalidate theme cache: {{ keycloak.service_name }}"
   ansible.builtin.include_tasks: invalidate_theme_cache.yml
   listen: "invalidate keycloak theme cache"
 # handler should be invoked anytime a [build configuration](https://www.keycloak.org/server/all-config?f=build) changes
-- name: "Rebuild {{ keycloak.service_name }} config"
+- name: "Rebuild config: {{ keycloak.service_name }}"
   ansible.builtin.include_tasks: rebuild_config.yml
   listen: "rebuild keycloak config"
 - name: "Bootstrapped"
@@ -15,7 +15,7 @@
   listen: "restart keycloak"
 - name: "Display deprecation warning"
   ansible.builtin.fail:
-    msg: "Deprecation warning: you are using the deprecated variable '{{ deprecated_variable | d('NotSet') }}', check docs on how to upgrade."
+    msg: "Deprecation warning: you are using the deprecated variable '{{ keycloak_quarkus_deprecated_variable | d('NotSet') }}', check docs on how to upgrade."
   failed_when: false
   changed_when: true
   listen: "print deprecation warning"

roles/keycloak_quarkus/meta/argument_specs.yml

@@ -564,5 +564,5 @@ argument_specs:
                 type: "str"
             rhbk_product_category:
                 default: "RHBK"
-                description: "JBossNetwork API category for Red Hat Build of Keycloak"
+                description: "Unified Downloads API category for Red Hat Build of Keycloak"
                 type: "str"

roles/keycloak_quarkus/tasks/config_store.yml

@@ -1,7 +1,7 @@
 ---
 - name: "Initialize configuration key store variables to be written"
   ansible.builtin.set_fact:
-    store_items:
+    keycloak_quarkus_store_items:
       - key: "kc.db-password"
         value: "{{ keycloak_quarkus_db_pass }}"
 

roles/keycloak_quarkus/tasks/deprecations.yml

@@ -13,7 +13,7 @@
       changed_when: keycloak_quarkus_show_deprecation_warnings
       ansible.builtin.set_fact:
         keycloak_quarkus_https_key_store_file: "{{ keycloak_quarkus_key_store_file }}"
-        deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler
+        keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler
       notify:
         - print deprecation warning
 
@@ -28,7 +28,7 @@
       changed_when: keycloak_quarkus_show_deprecation_warnings
       ansible.builtin.set_fact:
         keycloak_quarkus_https_key_store_password: "{{ keycloak_quarkus_key_store_password }}"
-        deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler
+        keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler
       notify:
         - print deprecation warning
 
@@ -45,7 +45,7 @@
   run_once: true
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
-    deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -60,7 +60,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_hostname: "{{ keycloak_quarkus_frontend_url }}"
-    deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -81,7 +81,7 @@
         {% set protocol = 'http://' %}
       {% endif %}
       {{ protocol }}{{ keycloak_quarkus_host }}:{{ keycloak_quarkus_port }}/{{ keycloak_quarkus_path }}
-    deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -96,7 +96,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_hostname_admin: "{{ keycloak_quarkus_admin_url }}"
-    deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -111,7 +111,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_hostname_backchannel_dynamic: "{{ keycloak_quarkus_hostname_strict_backchannel == False }}"
-    deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -126,7 +126,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_user }}"
-    deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -141,7 +141,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_pass }}"
-    deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler
   notify:
     - print deprecation warning
 
@@ -154,7 +154,7 @@
   changed_when: keycloak_quarkus_show_deprecation_warnings
   ansible.builtin.set_fact:
     keycloak_quarkus_http_host: "{{ keycloak_quarkus_bind_address }}"
-    deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler
+    keycloak_quarkus_deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler
   notify:
     - print deprecation warning
   

roles/keycloak_quarkus/tasks/fastpackages.yml

@@ -1,24 +1,24 @@
 ---
 - name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
   ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
-  register: rpm_info
+  register: keycloak_quarkus_rpm_info
   changed_when: false
   failed_when: false
   when: ansible_facts.os_family == "RedHat"
 
 - name: "Add missing packages to the yum install list"
   ansible.builtin.set_fact:
-    packages_to_install: "{{ packages_to_install | default([]) + rpm_info.stdout_lines | \
+    keycloak_quarkus_packages_to_install: "{{ keycloak_quarkus_packages_to_install | default([]) + keycloak_quarkus_rpm_info.stdout_lines | \
                              map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
   when: ansible_facts.os_family == "RedHat"
 
-- name: "Install packages: {{ packages_to_install }}"
+- name: "Install packages: {{ keycloak_quarkus_packages_to_install }}"
   become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}"
   ansible.builtin.dnf:
-    name: "{{ packages_to_install }}"
+    name: "{{ keycloak_quarkus_packages_to_install }}"
     state: present
   when:
-    - packages_to_install | default([]) | length > 0
+    - keycloak_quarkus_packages_to_install | default([]) | length > 0
     - ansible_facts.os_family == "RedHat"
 
 - name: "Install packages: {{ packages_list }}"

roles/keycloak_quarkus/tasks/firewalld.yml

@@ -12,7 +12,7 @@
     enabled: true
     state: started
 
-- name: "Configure firewall for {{ keycloak.service_name }} http port"
+- name: "Configure firewall for http port: {{ keycloak.service_name }}"
   become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
   ansible.posix.firewalld:
     port: "{{ item }}"
@@ -23,7 +23,7 @@
     - "{{ keycloak_quarkus_http_port }}/tcp"
   when: keycloak_quarkus_http_enabled | bool
 
-- name: "Configure firewall for {{ keycloak.service_name }} ports"
+- name: "Configure firewall for ports: {{ keycloak.service_name }}"
   become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
   ansible.posix.firewalld:
     port: "{{ item }}"

roles/keycloak_quarkus/tasks/install.yml

@@ -8,25 +8,25 @@
       - keycloak_quarkus_archive is defined
       - keycloak_quarkus_download_url is defined
       - keycloak_quarkus_version is defined
-      - local_path is defined
+      - keycloak_quarkus_local_path is defined
     quiet: true
 
 - name: Check for an existing deployment
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.stat:
     path: "{{ keycloak.home }}"
-  register: existing_deploy
+  register: keycloak_quarkus_existing_deploy
 
 - name: Stop and restart if existing deployment exists and install forced
-  when: existing_deploy.stat.exists and keycloak_quarkus_force_install | bool
+  when: keycloak_quarkus_existing_deploy.stat.exists and keycloak_quarkus_force_install | bool
   block:
-    - name: "Stop the old {{ keycloak.service_name }} service"
+    - name: "Stop the old service: {{ keycloak.service_name }}"
       become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
       failed_when: false
       ansible.builtin.systemd:
         name: keycloak
         state: stopped
-    - name: "Remove the old {{ keycloak.service_name }} deployment"
+    - name: "Remove the old deployment: {{ keycloak.service_name }}"
       become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
       ansible.builtin.file:
         path: "{{ keycloak_quarkus_home }}"
@@ -36,9 +36,9 @@
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.stat:
     path: "{{ keycloak_quarkus_home }}"
-  register: existing_deploy
+  register: keycloak_quarkus_existing_deploy
 
-- name: "Create {{ keycloak.service_name }} service user/group"
+- name: "Create service user/group: {{ keycloak.service_name }}"
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.user:
     name: "{{ keycloak.service_user }}"
@@ -46,7 +46,7 @@
     system: true
     create_home: false
 
-- name: "Create {{ keycloak.service_name }} install location"
+- name: "Create install location: {{ keycloak.service_name }}"
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.file:
     dest: "{{ keycloak_quarkus_dest }}"
@@ -65,29 +65,30 @@
 ## check remote archive
 - name: Set download archive path
   ansible.builtin.set_fact:
-    archive: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}"
+    keycloak_quarkus_archive_full_path: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}"
 
 - name: Check download archive path
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   ansible.builtin.stat:
-    path: "{{ archive }}"
+    path: "{{ keycloak_quarkus_archive_full_path }}"
-  register: archive_path
+  register: keycloak_quarkus_archive_path
 
 ## download to controller
 - name: Download keycloak archive
   ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
     url: "{{ keycloak_quarkus_download_url }}"
-    dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
     mode: '0640'
     url_username: "{{ keycloak_quarkus_binary_download_user | default(omit) }}"
     url_password: "{{ keycloak_quarkus_binary_download_pass | default(omit) }}"
+    validate_certs: false
   delegate_to: localhost
   become: false
   run_once: true
   when:
-    - archive_path is defined
+    - keycloak_quarkus_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_quarkus_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_quarkus_archive_path.stat.exists
     - not keycloak.offline_install
     - not rhbk_enable is defined or not rhbk_enable
 
@@ -95,9 +96,9 @@
   delegate_to: localhost
   run_once: true
   when:
-    - archive_path is defined
+    - keycloak_quarkus_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_quarkus_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_quarkus_archive_path.stat.exists
     - rhbk_enable is defined and rhbk_enable
     - not keycloak.offline_install
     - keycloak_quarkus_alternate_download_url is undefined
@@ -109,14 +110,15 @@
         product_type: DISTRIBUTION
         product_version: "{{ rhbk_version }}"
         product_category: "{{ rhbk_product_category }}"
-      register: rhn_products
+        validate_certs: false
+      register: keycloak_quarkus_rhn_products
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
 
     - name: Determine install zipfile from search results
       ansible.builtin.set_fact:
-        rhn_filtered_products: "{{ rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}"
+        keycloak_quarkus_rhn_filtered_products: "{{ keycloak_quarkus_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}"
       delegate_to: localhost
       run_once: true
 
@@ -124,9 +126,10 @@
       middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
         client_id: "{{ rhn_username }}"
         client_secret: "{{ rhn_password }}"
-        product_id: "{{ (rhn_filtered_products | first).id }}"
+        product_id: "{{ (keycloak_quarkus_rhn_filtered_products | first).id }}"
-        dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+        dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
         mode: '0640'
+        validate_certs: false
       no_log: "{{ omit_rhn_output | default(true) }}"
       delegate_to: localhost
       run_once: true
@@ -137,15 +140,15 @@
   run_once: true
   become: false
   when:
-    - archive_path is defined
+    - keycloak_quarkus_archive_path is defined
-    - archive_path.stat is defined
+    - keycloak_quarkus_archive_path.stat is defined
-    - not archive_path.stat.exists
+    - not keycloak_quarkus_archive_path.stat.exists
     - rhbk_enable is defined and rhbk_enable
     - not keycloak.offline_install
     - keycloak_quarkus_alternate_download_url is defined
   ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
     url: "{{ keycloak_quarkus_alternate_download_url }}"
-    dest: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
     mode: '0640'
     url_username: "{{ keycloak_quarkus_download_user | default(omit) }}"
     url_password: "{{ keycloak_quarkus_download_pass | default(omit) }}"
@@ -153,8 +156,8 @@
 
 - name: Check downloaded archive
   ansible.builtin.stat:
-    path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
-  register: local_archive_path
+  register: keycloak_quarkus_local_archive_path
   delegate_to: localhost
   become: false
   run_once: true
@@ -162,35 +165,35 @@
 ## copy and unpack
 - name: Copy archive to target nodes
   ansible.builtin.copy:
-    src: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
-    dest: "{{ archive }}"
+    dest: "{{ keycloak_quarkus_archive_full_path }}"
     owner: "{{ keycloak.service_user }}"
     group: "{{ keycloak.service_group }}"
     mode: '0640'
-  register: new_version_downloaded
+  register: keycloak_quarkus_new_version_downloaded
   when:
-    - not archive_path.stat.exists
+    - not keycloak_quarkus_archive_path.stat.exists
-    - local_archive_path.stat is defined
+    - keycloak_quarkus_local_archive_path.stat is defined
-    - local_archive_path.stat.exists
+    - keycloak_quarkus_local_archive_path.stat.exists
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
 
-- name: "Check target directory: {{ keycloak.home }}/bin/"
+- name: "Check target directory /bin/: {{ keycloak.home }}"
   ansible.builtin.stat:
     path: "{{ keycloak.home }}/bin/"
-  register: path_to_workdir
+  register: keycloak_quarkus_path_to_workdir
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
 
 - name: "Extract Keycloak archive on target" # noqa no-handler need to run this here
   ansible.builtin.unarchive:
     remote_src: true
-    src: "{{ archive }}"
+    src: "{{ keycloak_quarkus_archive_full_path }}"
     dest: "{{ keycloak_quarkus_dest }}"
     creates: "{{ keycloak.home }}/bin/"
     owner: "{{ keycloak.service_user }}"
     group: "{{ keycloak.service_group }}"
   become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
   when:
-    - (not path_to_workdir.stat.exists) or new_version_downloaded.changed
+    - (not keycloak_quarkus_path_to_workdir.stat.exists) or keycloak_quarkus_new_version_downloaded.changed
   notify:
     - restart keycloak
 
@@ -198,7 +201,7 @@
   ansible.builtin.debug:
     msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression"
   when:
-    - (not new_version_downloaded.changed) and path_to_workdir.stat.exists
+    - (not keycloak_quarkus_new_version_downloaded.changed) and keycloak_quarkus_path_to_workdir.stat.exists
 
 - name: "Copy private key to target"
   ansible.builtin.copy:
@@ -226,7 +229,7 @@
     - keycloak_quarkus_cert_file_copy_enabled is defined and keycloak_quarkus_cert_file_copy_enabled
     - keycloak_quarkus_cert_file_src | length > 0
 
-- name: "Install {{ keycloak_quarkus_db_engine }} JDBC driver"
+- name: "Install JDBC driver: {{ keycloak_quarkus_db_engine }}"
   ansible.builtin.include_tasks: jdbc_driver.yml
   when:
     - rhbk_enable is defined and rhbk_enable
@@ -254,7 +257,7 @@
     version: "{{ item.maven.version | default(omit) }}"
     username: "{{ item.maven.username | default(omit) }}"
     password: "{{ item.maven.password | default(omit) }}"
-    dest: "{{ local_path.stat.path }}/{{ item.id }}.jar"
+    dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
   delegate_to: "localhost"
   run_once: true
   loop: "{{ keycloak_quarkus_providers }}"
@@ -263,7 +266,7 @@
 
 - name: "Copy maven providers"
   ansible.builtin.copy:
-    src: "{{ local_path.stat.path }}/{{ item.id }}.jar"
+    src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
     dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar"
     owner: "{{ keycloak.service_user }}"
     group: "{{ keycloak.service_group }}"

roles/keycloak_quarkus/tasks/invalidate_theme_cache.yml

@@ -4,7 +4,7 @@
 # you can do so by deleting the data/tmp/kc-gzip-cache directory of the server distribution
 # It can be useful for instance if you redeployed custom providers or custom themes without
 # disabling themes caching in the previous server executions.
-- name: "Delete {{ keycloak.service_name }} theme cache directory"
+- name: "Delete theme cache directory: {{ keycloak.service_name }}"
   ansible.builtin.file:
     path: "{{ keycloak.home }}/data/tmp/kc-gzip-cache"
     state: absent

roles/keycloak_quarkus/tasks/main.yml

@@ -123,13 +123,13 @@
 - name: Check service status
   ansible.builtin.systemd_service:
     name: "{{ keycloak.service_name }}"
-  register: keycloak_service_status
+  register: keycloak_quarkus_service_status
   changed_when: false
 
 - name: "Notify to remove `keycloak_quarkus_bootstrap_admin_user[_password]` env vars"
   when:
     - not ansible_local.keycloak.general.bootstrapped | default(false) | bool # it was not bootstrapped prior to the current role's execution
-    - keycloak_service_status.status.ActiveState == "active"                  # but it is now
+    - keycloak_quarkus_service_status.status.ActiveState == "active"                  # but it is now
   ansible.builtin.assert: { that: true, quiet: true }
   changed_when: true
   notify:

roles/keycloak_quarkus/tasks/prereqs.yml

@@ -57,7 +57,7 @@
 - name: Check local download archive path
   ansible.builtin.stat:
     path: "{{ keycloak_quarkus_download_path }}"
-  register: local_path
+  register: keycloak_quarkus_local_path
   delegate_to: localhost
   run_once: true
   become: false
@@ -65,9 +65,9 @@
 - name: Validate local download path
   ansible.builtin.assert:
     that:
-      - local_path.stat.exists
+      - keycloak_quarkus_local_path.stat.exists
-      - local_path.stat.readable
+      - keycloak_quarkus_local_path.stat.readable
-      - keycloak_quarkus_offline_install or local_path.stat.writeable
+      - keycloak_quarkus_offline_install or keycloak_quarkus_local_path.stat.writeable
     quiet: true
     fail_msg: "Defined controller path for downloading resources is incorrect or unreadable: {{ keycloak_quarkus_download_path }}"
     success_msg: "Will download resource to controller path: {{ keycloak_quarkus_download_path }}"
@@ -76,20 +76,20 @@
 
 - name: Check downloaded archive if offline
   ansible.builtin.stat:
-    path: "{{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
   when: keycloak_quarkus_offline_install
-  register: local_archive_path_check
+  register: keycloak_quarkus_local_archive_path_check
   delegate_to: localhost
   run_once: true
 
 - name: Validate local downloaded archive if offline
   ansible.builtin.assert:
     that:
-      - local_archive_path_check.stat.exists
+      - keycloak_quarkus_local_archive_path_check.stat.exists
-      - local_archive_path_check.stat.readable
+      - keycloak_quarkus_local_archive_path_check.stat.readable
     quiet: true
-    fail_msg: "Configured for offline install but install archive not found at: {{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    fail_msg: "Configured for offline install but install archive not found at: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
-    success_msg: "Will install offline with expected archive: {{ local_path.stat.path }}/{{ keycloak.bundle }}"
+    success_msg: "Will install offline with expected archive: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
   when: keycloak_quarkus_offline_install
   delegate_to: localhost
   run_once: true
@@ -100,11 +100,11 @@
     - name: "Check run keytool"
       changed_when: false
       ansible.builtin.command: keytool -help
-      register: keytool_check
+      register: keycloak_quarkus_keytool_check
       ignore_errors: true
 
     - name: "Fail when no keytool found"
-      when: keytool_check.rc != 0
+      when: keycloak_quarkus_keytool_check.rc != 0
       ansible.builtin.fail:
         msg: "keytool NOT found in the PATH, but is required for setting up the configuration key store"
 

roles/keycloak_quarkus/tasks/rebuild_config.yml

@@ -1,6 +1,6 @@
 ---
 # cf. https://www.keycloak.org/server/configuration#_optimize_the_keycloak_startup
-- name: "Rebuild {{ keycloak.service_name }} config"
+- name: "Rebuild config: {{ keycloak.service_name }}"
   ansible.builtin.shell: | # noqa blocked_modules shell is necessary here
     env -i bash -c "set -a ; source {{ keycloak_quarkus_sysconf_file }} ; {{ keycloak.home }}/bin/kc.sh build "
   become: "{{ keycloak_quarkus_rebuild_config_require_privilege_escalation | default(true) }}"

roles/keycloak_quarkus/tasks/restart.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Restart and enable {{ keycloak.service_name }} service"
+- name: "Restart and enable service: {{ keycloak.service_name }}"
   ansible.builtin.systemd:
     name: "{{ keycloak.service_name }}"
     enabled: true
@@ -7,11 +7,11 @@
     daemon_reload: true
   become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}"
 
-- name: "Wait until {{ keycloak.service_name }} service becomes active {{ keycloak.health_url }}"
+- name: "Wait until service becomes active: {{ keycloak.service_name }}"
   ansible.builtin.uri:
     url: "{{ keycloak.health_url }}"
-  register: keycloak_status
+  register: keycloak_quarkus_status
-  until: keycloak_status.status == 200
+  until: keycloak_quarkus_status.status == 200
   retries: "{{ keycloak_quarkus_restart_health_check_retries }}"
   delay: "{{ keycloak_quarkus_restart_health_check_delay }}"
   when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)

roles/keycloak_quarkus/tasks/restart/serial.yml

@@ -2,7 +2,7 @@
 - name: "Restart services in serial, with optional healtch check (keycloak_quarkus_restart_health_check)"
   throttle: 1
   block:
-    - name: "Restart and enable {{ keycloak.service_name }} service"
+    - name: "Restart and enable service: {{ keycloak.service_name }}"
       ansible.builtin.include_tasks:
         file: restart.yml
         apply:

roles/keycloak_quarkus/tasks/restart/serial_then_parallel.yml

@@ -1,7 +1,7 @@
 ---
 - name: Verify first restarted service with health URL, then rest restart in parallel
   block:
-    - name: "Restart and enable {{ keycloak.service_name }} service on initial host"
+    - name: "Restart and enable service on initial host: {{ keycloak.service_name }}"
       ansible.builtin.include_tasks:
         file: restart.yml
         apply:
@@ -10,7 +10,7 @@
       vars:
         internal_force_health_check: true
 
-    - name: "Restart and enable {{ keycloak.service_name }} service on other hosts"
+    - name: "Restart and enable service on other hosts: {{ keycloak.service_name }}"
       ansible.builtin.systemd:
         name: "{{ keycloak.service_name }}"
         enabled: true

roles/keycloak_quarkus/tasks/start.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Start {{ keycloak.service_name }} service"
+- name: "Start service: {{ keycloak.service_name }}"
   ansible.builtin.systemd:
     name: keycloak
     enabled: true
@@ -7,11 +7,11 @@
     daemon_reload: true
   become: "{{ keycloak_quarkus_start_require_privilege_escalation | default(true) }}"
 
-- name: "Wait until {{ keycloak.service_name }} becomes active {{ keycloak.health_url }}"
+- name: "Wait until service becomes active: {{ keycloak.service_name }}"
   ansible.builtin.uri:
     url: "{{ keycloak.health_url }}"
-  register: keycloak_status
+  register: keycloak_quarkus_status
-  until: keycloak_status.status == 200
+  until: keycloak_quarkus_status.status == 200
   retries: 25
   delay: 10
   when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)

roles/keycloak_quarkus/tasks/systemd.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Configure sysconfig file for {{ keycloak.service_name }} service"
+- name: "Configure sysconfig file for service: {{ keycloak.service_name }}"
   become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
   ansible.builtin.template:
     src: keycloak-sysconfig.j2
@@ -21,7 +21,7 @@
     group: root
     mode: '0644'
   become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
-  register: systemdunit
+  register: keycloak_quarkus_systemdunit
   notify:
     - rebuild keycloak config
     - restart keycloak

roles/keycloak_realm/README.md

@@ -10,18 +10,18 @@ Role Defaults
 
 | Variable | Description | Default |
 |:---------|:------------|:--------|
-|`keycloak_admin_user`| Administration console user account | `admin` |
+|`keycloak_realm_admin_user`| Administration console user account | `admin` |
-|`keycloak_host`| hostname | `localhost` |
+|`keycloak_realm_host`| hostname | `localhost` |
-|`keycloak_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
+|`keycloak_realm_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
-|`keycloak_http_port`| HTTP port | `8080` |
+|`keycloak_realm_http_port`| HTTP port | `8080` |
-|`keycloak_https_port`| TLS HTTP port | `8443` |
+|`keycloak_realm_https_port`| TLS HTTP port | `8443` |
-|`keycloak_auth_realm`| Name of the main authentication realm | `master` |
+|`keycloak_realm_auth_realm`| Name of the main authentication realm | `master` |
-|`keycloak_management_http_port`| Management port | `9990` |
+|`keycloak_realm_management_http_port`| Management port | `9990` |
-|`keycloak_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
+|`keycloak_realm_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
-|`keycloak_client_public`| Configure a public realm client | `True` |
+|`keycloak_realm_client_public`| Configure a public realm client | `True` |
-|`keycloak_client_web_origins`| Web origins for realm client | `/*` |
+|`keycloak_realm_client_web_origins`| Web origins for realm client | `/*` |
-|`keycloak_url`| URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port }}` |
+|`keycloak_realm_url`| URL for configuration rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port }}` |
-|`keycloak_management_url`| URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port }}` |
+|`keycloak_realm_management_url`| URL for management console rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port }}` |
 
 
 Role Variables
@@ -31,30 +31,30 @@ The following are a set of _required_ variables for the role:
 
 | Variable | Description |
 |:---------|:------------|
-|`keycloak_realm` | Name of the realm to be created |
+|`keycloak_realm_realm` | Name of the realm to be created |
-|`keycloak_admin_password`| Password for the administration console user account |
+|`keycloak_realm_admin_password`| Password for the administration console user account |
 
 
 The following variables are available for creating clients:
 
 | Variable | Description | Default |
 |:---------|:------------|:---------|
-|`keycloak_clients` | List of _client_ declarations for the realm | `[]` |
+|`keycloak_realm_clients` | List of _client_ declarations for the realm | `[]` |
-|`keycloak_client_default_roles` | List of default role name for clients | `[]` |
+|`keycloak_realm_client_default_roles` | List of default role name for clients | `[]` |
-|`keycloak_client_users` | List of user/role mappings for a client | `[]` |
+|`keycloak_realm_client_users` | List of user/role mappings for a client | `[]` |
 
 
 The following variables are available for creating user federation:
 
 | Variable | Description | Default |
 |:---------|:------------|:---------|
-|`keycloak_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
+|`keycloak_realm_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
 
 
 Variable formats
 ----------------
 
-* `keycloak_user_federation`, a list of:
+* `keycloak_realm_user_federation`, a list of:
 
 ```yaml
     - realm:  <name of the realm in which user federation should be configured, required>
@@ -68,24 +68,24 @@ Variable formats
 Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables.
 
 
-* `keycloak_clients`, a list of:
+* `keycloak_realm_clients`, a list of:
 
 ```yaml
     - name: <name of the client>
       id: <id of the client>
       client_id: <id of the client>
       secret: <secret of the client (Optional)>
-      roles: <keycloak_client_default_roles>
+      roles: <keycloak_realm_client_default_roles>
       realm: <name of the realm that contains the client>
       public_client: <true for public, false for confidential>
       web_origins: <list of allowed we origins for the client>
-      users: <keycloak_client_users>
+      users: <keycloak_realm_client_users>
 ```
 
 `name` and either `id` or `client_id` are required.
 
 
-* `keycloak_client_users`, a list of:
+* `keycloak_realm_client_users`, a list of:
 
 ```yaml
     - username: <username, required>
@@ -118,7 +118,7 @@ For features not covered by this role, the collection provides dedicated modules
 | `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) |
 | `keycloak_client` | Clients (also used internally by this role) |
 | `keycloak_role` | Realm and client roles |
-| `keycloak_user_federation` | User federations such as LDAP (also used internally by this role) |
+| `keycloak_realm_user_federation` | User federations such as LDAP (also used internally by this role) |
 
 
 Example Playbook

roles/keycloak_realm/defaults/main.yml

@@ -1,18 +1,18 @@
 ---
 ### Keycloak configuration settings
-keycloak_host: localhost
+keycloak_realm_host: localhost
-keycloak_http_port: 8080
+keycloak_realm_http_port: 8080
-keycloak_https_port: 8443
+keycloak_realm_https_port: 8443
-keycloak_management_http_port: 9990
+keycloak_realm_management_http_port: 9990
 
 ### Keycloak administration console user
-keycloak_admin_user: admin
+keycloak_realm_admin_user: admin
-keycloak_auth_realm: master
+keycloak_realm_auth_realm: master
-keycloak_auth_client: admin-cli
+keycloak_realm_auth_client: admin-cli
-keycloak_context: ''
+keycloak_realm_context: ''
 
 # administrator console password, this is a required variable
-keycloak_admin_password: ''
+keycloak_realm_admin_password: ''
 
 ### Keycloak realms, clients, roles, federation
 # list of clients to create in the realm
@@ -26,35 +26,36 @@ keycloak_admin_password: ''
 # and users is a list of account, see below for the format definition
 # an empty name will skip the creation of the client
 #
-# keycloak_clients:
+# keycloak_realm_clients:
 #   - name: ''
-#     roles: "{{ keycloak_client_default_roles }}"
+#     roles: "{{ keycloak_realm_client_default_roles }}"
-#     realm: "{{ keycloak_realm }}"
+#     realm: "{{ keycloak_realm_realm }}"
-#     public_client: "{{ keycloak_client_public }}"
+#     public_client: "{{ keycloak_realm_client_public }}"
-#     web_origins: "{{ keycloak_client_web_origins }}"
+#     web_origins: "{{ keycloak_realm_client_web_origins }}"
-#     redirect_uris: "{{ keycloak_client_redirect_uris }}"
+#     redirect_uris: "{{ keycloak_realm_client_redirect_uris }}"
-#     users: "{{ keycloak_client_users }}"
+#     users: "{{ keycloak_realm_client_users }}"
-keycloak_clients: []
+keycloak_realm_clients: []
 
 # list of roles to create in the client
-keycloak_client_default_roles: []
+keycloak_realm_client_default_roles: []
 
 # if True, create a public client; otherwise, a confidetial client
-keycloak_client_public: true
+keycloak_realm_client_public: true
 
 # allowed web origins for the client
-keycloak_client_web_origins: '/*'
+keycloak_realm_client_web_origins: '/*'
 
 # list of user and role mappings to create in the client
 # Each user has the form:
 #    { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] }
 # where each client_role has the form:
 #    { client: '', role: '', realm: '' }
-keycloak_client_users: []
+keycloak_realm_client_users: []
 
 ### List of Keycloak User Federation
-keycloak_user_federation: []
+keycloak_realm_user_federation: []
 
 # other settings
-keycloak_url: "http://{{ keycloak_host }}:{{ keycloak_http_port + (keycloak_jboss_port_offset | default(0)) }}"
+keycloak_realm_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
-keycloak_management_url: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + (keycloak_jboss_port_offset | default(0)) }}"
+keycloak_realm_management_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
+keycloak_realm_no_log: true

roles/keycloak_realm/meta/argument_specs.yml

@@ -1,94 +1,94 @@
 argument_specs:
     main:
         options:
-            keycloak_host:
+            keycloak_realm_host:
                 # line 3 of keycloak_realm/defaults/main.yml
                 default: "localhost"
                 description: "Hostname for rest calls"
                 type: "str"
-            keycloak_context:
+            keycloak_realm_context:
                 # line 5 of keycloak_realm/defaults/main.yml
                 default: ""
                 description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)"
                 type: "str"
-            keycloak_http_port:
+            keycloak_realm_http_port:
                 # line 4 of keycloak_realm/defaults/main.yml
                 default: 8080
                 description: "HTTP port"
                 type: "int"
-            keycloak_https_port:
+            keycloak_realm_https_port:
                 # line 5 of keycloak_realm/defaults/main.yml
                 default: 8443
                 description: "HTTPS port"
                 type: "int"
-            keycloak_management_http_port:
+            keycloak_realm_management_http_port:
                 # line 6 of keycloak_realm/defaults/main.yml
                 default: 9990
                 description: "Management port"
                 type: "int"
-            keycloak_admin_user:
+            keycloak_realm_admin_user:
                 # line 10 of keycloak_realm/defaults/main.yml
                 default: "admin"
                 description: "Administration console user account"
                 type: "str"
-            keycloak_auth_realm:
+            keycloak_realm_auth_realm:
                 # line 11 of keycloak_realm/defaults/main.yml
                 default: "master"
                 description: "Name of the main authentication realm"
                 type: "str"
-            keycloak_auth_client:
+            keycloak_realm_auth_client:
                 # line 12 of keycloak_realm/defaults/main.yml
                 default: "admin-cli"
                 description: "Authentication client for configuration REST calls"
                 type: "str"
-            keycloak_client_default_roles:
+            keycloak_realm_client_default_roles:
                 # line 36 of keycloak_realm/defaults/main.yml
                 default: "[]"
                 description: "List of roles to configure as client default"
                 type: "list"
-            keycloak_client_public:
+            keycloak_realm_client_public:
                 # line 39 of keycloak_realm/defaults/main.yml
                 default: true
                 description: "Configure a public realm client"
                 type: "bool"
-            keycloak_client_web_origins:
+            keycloak_realm_client_web_origins:
                 # line 42 of keycloak_realm/defaults/main.yml
                 default: "/*"
                 description: "Web origins for realm client"
                 type: "str"
-            keycloak_client_users:
+            keycloak_realm_client_users:
                 # line 49 of keycloak_realm/defaults/main.yml
                 default: "[]"
                 description: "List of users to configure in the realm client"
                 type: "list"
-            keycloak_user_federation:
+            keycloak_realm_user_federation:
                 # line 52 of keycloak_realm/defaults/main.yml
                 default: "[]"
                 description: "List of user federations to configure in the realm"
                 type: "list"
-            keycloak_admin_password:
+            keycloak_realm_admin_password:
                 # line 5 of keycloak_realm/vars/main.yml
                 required: true
                 description: "Password for the administration console user account"
                 type: "str"
-            keycloak_realm:
+            keycloak_realm_realm:
                 # line 8 of keycloak_realm/vars/main.yml
                 required: true
                 description: "Name of the realm to be configured"
                 type: "str"
-            keycloak_clients:
+            keycloak_realm_clients:
                 # line 11 of keycloak_realm/vars/main.yml
                 default: "[]"
                 description: "List of client declarations for the realm"
                 type: "list"
-            keycloak_url:
+            keycloak_realm_url:
                 # line 14 of keycloak_realm/vars/main.yml
-                default: "http://{{ keycloak_host }}:{{ keycloak_http_port + ( keycloak_jboss_port_offset | default(0) ) }}"
+                default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
                 description: "URL for configuration rest calls"
                 type: "str"
-            keycloak_management_url:
+            keycloak_realm_management_url:
                 # line 15 of keycloak_realm/vars/main.yml
-                default: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + ( keycloak_jboss_port_offset | default(0) ) }}"
+                default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
                 description: "URL for management console rest calls"
                 type: "str"
     downstream: