CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 20 Pull requests 17 Wiki Activity Actions

Manage the CCCHH browser authentication flow as YAML
All checks were successful
/ build (pull_request) Successful in 47s
Details
/ Ansible Lint (push) Successful in 5m31s
Details
/ Ansible Lint (pull_request) Successful in 4m35s
Details

Browse source 
Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.
This commit is contained in:
Stefan Bethke 2026-09-02 11:07:45 +02:00
commit 32b5f147bc
9 changed files with 616 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
roles/keycloak_auth_flow/defaults/main.yaml Normal file
View file

@ -0,0 +1,3 @@
keycloak_auth_flow__flows: [ ]
keycloak_auth_flow__admin_url: "http://127.0.0.1:8080"
keycloak_auth_flow__admin_username: admin