CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 19 Pull requests 18 Wiki Activity Actions

Update to new manually created flow

Browse source
This commit is contained in:
Stefan Bethke 2026-10-08 11:06:00 +02:00
commit 18b01045e5
3 changed files with 31 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

34
roles/keycloak_auth_flow/library/keycloak_auth_flow_lint.py
View file

@ -128,12 +128,6 @@ ALLOWED_NODE_KEYS = {
}
MAX_SUBFLOW_DEPTH = 10
# providerIds relevant to the sibling-condition bug tracked as keycloak/keycloak#29515: mixing
# these two under one shared 'conditional-user-configured' check breaks login for users with
# neither credential configured.
OTP_PROVIDER_IDS = {"auth-otp-form", "auth-conditional-otp-form"}
WEBAUTHN_PROVIDER_IDS = {"webauthn-authenticator", "webauthn-authenticator-passwordless"}
class FlowValidationError(Exception):
pass
@ -165,8 +159,9 @@ def validate_authentication_config(auth_config, path, provider_id, warnings):
f"(got {included!r}) — Keycloak stores authenticator config values as strings"
)
# The included=true/false semantics are unlabeled in the Keycloak admin console and easy to
# get backwards, so restate them every time as a standing reminder.
if included == "false":
# get backwards, so restate them every time as a standing reminder. Keycloak reads the
# value with Boolean.parseBoolean(), so an unset 'included' behaves like "false".
if included != "true":
meaning = f"TRUE when NONE of [{credentials}] were used (inverted)"
else:
meaning = f"TRUE when ANY of [{credentials}] was used"
@ -231,9 +226,9 @@ def validate_node(node, path, depth, seen_subflow_names, seen_provider_ids, warn
if not isinstance(children, list):
raise FlowValidationError(f"{path}.authenticationExecutions: must be a list")
# Direct-child providerIds, used by the two checks below. Only *direct* children count:
# Keycloak's "Condition executions can only be contained in Conditional subflow" rule, and
# the sibling-condition bug, both concern immediate siblings, not deeper descendants.
# Direct-child providerIds, used by the check below. Only *direct* children count:
# Keycloak's "Condition executions can only be contained in Conditional subflow" rule
# concerns immediate children, not deeper descendants.
direct_provider_ids = {
child.get("providerId")
for child in children
@ -252,23 +247,6 @@ def validate_node(node, path, depth, seen_subflow_names, seen_provider_ids, warn
"never fires)"
)
# Gotcha: keycloak/keycloak#29515 — an OTP provider and a WebAuthn provider as siblings
# under one shared 'conditional-user-configured' check breaks login for users with neither
# credential configured. Give each credential type its own nested Conditional subflow with
# its own 'conditional-user-configured' check instead.
if (
"conditional-user-configured" in direct_provider_ids
and direct_provider_ids & OTP_PROVIDER_IDS
and direct_provider_ids & WEBAUTHN_PROVIDER_IDS
):
raise FlowValidationError(
f"{path}: sub-flow {name!r} mixes an OTP provider and a WebAuthn provider as "
"siblings under one shared 'conditional-user-configured' check — this hits "
"keycloak/keycloak#29515: users with neither credential configured get a generic "
"login error instead of the check being skipped. Give each credential type its own "
"nested Conditional subflow with its own 'conditional-user-configured' check."
)
for index, child in enumerate(children):
validate_node(
child,