CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 19 Pull requests 18 Wiki Activity Actions

Update to new manually created flow

Browse source
This commit is contained in:
Stefan Bethke 2026-10-08 11:06:00 +02:00
commit 18b01045e5
3 changed files with 31 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

13
roles/keycloak_auth_flow/README.md
View file

@ -57,13 +57,6 @@ checks each flow definition before it's ever sent to the server.
sub-flow's own `requirement` is literally `CONDITIONAL`. See the Keycloak Server Admin Guide,
["Configuring authentication → Execution requirements"](https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/22.0/html/server_administration_guide/configuring-authentication_server_administration_guide):
"Condition executions can only be contained in Conditional subflow."
- **OTP + WebAuthn siblings under one shared `conditional-user-configured`**: this hits
[keycloak/keycloak#29515](https://github.com/keycloak/keycloak/issues/29515) — users with
neither credential configured get a generic login error instead of the check being skipped
(also discussed in
[keycloak/keycloak#14988](https://github.com/keycloak/keycloak/discussions/14988)). The fix is
to give each credential type its own nested `CONDITIONAL` sub-flow with its own
`conditional-user-configured` check.
- **`conditional-credential` config**: requires an `authenticationConfig` with a non-empty
`credentials` entry, and `included` (if set) must be the string `"true"` or `"false"` — Keycloak
stores authenticator config values as strings. See
@ -80,8 +73,8 @@ checks each flow definition before it's ever sent to the server.
execution ended up under a `Conditional` sub-flow.
- **`conditional-credential` `included` semantics reminder**: restates what the configured
`included` value actually means (`true` → condition is true when *any* listed credential was
used; `false` → true when *none* were used). This is unlabeled in the admin console and easy to
get backwards — see the same
used; `false` or unset → true when *none* were used, since Keycloak parses a missing value as
`false`). This is unlabeled in the admin console and easy to get backwards — see the same
[conditions.adoc](https://github.com/keycloak/keycloak/blob/main/docs/documentation/server_admin/topics/authentication/conditions.adoc)
reference as above.
- **`auth-conditional-otp-form` with no config**: unlike the plain `auth-otp-form`, `Conditional
@ -101,7 +94,7 @@ checks each flow definition before it's ever sent to the server.
```yaml
keycloak_auth_flow__flows:
- realm: ccchh
alias: browser passkey and token
alias: passkey and 2FA
providerId: basic-flow
authenticationExecutions:
- providerId: auth-cookie