Vendor middleware_automation.keycloak collection
Needed for keycloak_authentication_v2, to manage Keycloak authentication flows (e.g. the CCCHH browser flow) as YAML. Chosen over community.general's own copy of the module (deprecated in favor of this collection, and limited to 4 sub-flow levels there vs. 10 here).
This commit is contained in:
parent
4540dc5516
commit
4832e5da5d
159 changed files with 34399 additions and 0 deletions
|
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Hosts
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Authentication Flow Configuration
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_admin_user: admin
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_url: "http://localhost:8080"
|
||||
keycloak_realm: TestRealm
|
||||
tasks:
|
||||
- name: Create authentication flow with executions
|
||||
middleware_automation.keycloak.keycloak_authentication_flow:
|
||||
auth_keycloak_url: "{{ keycloak_url }}"
|
||||
auth_realm: master
|
||||
auth_username: "{{ keycloak_admin_user }}"
|
||||
auth_password: "{{ keycloak_admin_password }}"
|
||||
realm: "{{ keycloak_realm }}"
|
||||
alias: my-browser-flow
|
||||
description: "Custom browser authentication flow"
|
||||
provider_id: basic-flow
|
||||
executions:
|
||||
- provider_id: auth-cookie
|
||||
requirement: ALTERNATIVE
|
||||
- provider_id: auth-password
|
||||
requirement: REQUIRED
|
||||
- provider_id: auth-otp-form
|
||||
requirement: ALTERNATIVE
|
||||
state: present
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Client Scope Configuration
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_admin_user: admin
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_url: "http://localhost:8080"
|
||||
keycloak_realm: TestRealm
|
||||
tasks:
|
||||
- name: Create client scope with protocol mappers
|
||||
middleware_automation.keycloak.keycloak_client_scope:
|
||||
auth_keycloak_url: "{{ keycloak_url }}"
|
||||
auth_realm: master
|
||||
auth_username: "{{ keycloak_admin_user }}"
|
||||
auth_password: "{{ keycloak_admin_password }}"
|
||||
realm: "{{ keycloak_realm }}"
|
||||
name: TestClientScope
|
||||
description: "Client scope created via Ansible"
|
||||
protocol: openid-connect
|
||||
protocol_mappers:
|
||||
- name: email
|
||||
protocolMapper: oidc-usermodel-attribute-mapper
|
||||
config:
|
||||
user.attribute: email
|
||||
claim.name: email
|
||||
jsonType.label: String
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
userinfo.token.claim: "true"
|
||||
- name: firstName
|
||||
protocolMapper: oidc-usermodel-attribute-mapper
|
||||
config:
|
||||
user.attribute: firstName
|
||||
claim.name: given_name
|
||||
jsonType.label: String
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
userinfo.token.claim: "true"
|
||||
- name: username
|
||||
protocolMapper: oidc-usermodel-attribute-mapper
|
||||
config:
|
||||
user.attribute: username
|
||||
claim.name: preferred_username
|
||||
jsonType.label: String
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
userinfo.token.claim: "true"
|
||||
state: present
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Hosts
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Keycloak Realm Role
|
||||
ansible.builtin.include_role:
|
||||
name: keycloak_realm
|
||||
vars:
|
||||
keycloak_realm_admin_password: "remembertochangeme"
|
||||
keycloak_realm_realm: TestRealm
|
||||
keycloak_realm_user_federation:
|
||||
- realm: TestRealm
|
||||
name: my-ldap
|
||||
provider_id: ldap
|
||||
provider_type: org.keycloak.storage.UserStorageProvider
|
||||
config:
|
||||
priority: '0'
|
||||
enabled: true
|
||||
cachePolicy: DEFAULT
|
||||
batchSizeForSync: '1000'
|
||||
editMode: READ_ONLY
|
||||
importEnabled: true
|
||||
syncRegistrations: false
|
||||
vendor: other
|
||||
usernameLDAPAttribute: uid
|
||||
rdnLDAPAttribute: uid
|
||||
uuidLDAPAttribute: entryUUID
|
||||
userObjectClasses: inetOrgPerson, organizationalPerson
|
||||
connectionUrl: ldaps://ldap.example.com:636
|
||||
usersDn: ou=Users,dc=example,dc=com
|
||||
authType: simple
|
||||
bindDn: cn=directory reader
|
||||
bindCredential: password
|
||||
searchScope: '1'
|
||||
validatePasswordPolicy: false
|
||||
trustEmail: false
|
||||
useTruststoreSpi: ldapsOnly
|
||||
connectionPooling: true
|
||||
pagination: true
|
||||
allowKerberosAuthentication: false
|
||||
debug: false
|
||||
useKerberosForPasswordAuthentication: false
|
||||
mappers:
|
||||
- name: "full name"
|
||||
providerId: "full-name-ldap-mapper"
|
||||
providerType: "org.keycloak.storage.ldap.mappers.LDAPStorageMapper"
|
||||
config:
|
||||
ldap.full.name.attribute: cn
|
||||
read.only: true
|
||||
write.only: false
|
||||
keycloak_realm_clients:
|
||||
- name: TestClient1
|
||||
client_id: TestClient1
|
||||
roles:
|
||||
- TestClient1Admin
|
||||
- TestClient1User
|
||||
realm: "{{ keycloak_realm_realm }}"
|
||||
public_client: true
|
||||
web_origins:
|
||||
- http://testclient1origin/application
|
||||
- http://testclient1origin/other
|
||||
users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient1
|
||||
role: TestClient1User
|
||||
realm: "{{ keycloak_realm_realm }}"
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
- name: Playbook for Keycloak X Hosts with HTTPS enabled
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
|
||||
keycloak_quarkus_hostname: http://localhost
|
||||
keycloak_quarkus_port: 8443
|
||||
keycloak_quarkus_log: file
|
||||
keycloak_quarkus_proxy_mode: none
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak_quarkus
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
---
|
||||
- name: Playbook for Keycloak X Hosts in develop mode
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_quarkus_bootstrap_admin_password: "remembertochangeme"
|
||||
keycloak_quarkus_hostname: http://localhost
|
||||
keycloak_quarkus_port: 8080
|
||||
keycloak_quarkus_log: file
|
||||
keycloak_quarkus_start_dev: true
|
||||
keycloak_quarkus_proxy_mode: none
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak_quarkus
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Hosts
|
||||
hosts: all
|
||||
vars:
|
||||
keycloak_realm_admin_password: "remembertochangeme"
|
||||
keycloak_realm_clients:
|
||||
- name: TestClient1
|
||||
client_id: TestClient1
|
||||
roles:
|
||||
- TestClient1Admin
|
||||
- TestClient1User
|
||||
realm: TestRealm
|
||||
public_client: true
|
||||
web_origins:
|
||||
- http://testclient1origin/application
|
||||
- http://testclient1origin/other
|
||||
users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient1
|
||||
role: TestClient1User
|
||||
realm: TestRealm
|
||||
roles:
|
||||
- role: middleware_automation.keycloak.keycloak_realm
|
||||
keycloak_realm_realm: TestRealm
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
- name: Playbook for Keycloak Realm and Client Configuration
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Keycloak Realm Role
|
||||
ansible.builtin.include_role:
|
||||
name: middleware_automation.keycloak.keycloak_realm
|
||||
vars:
|
||||
keycloak_realm_admin_password: "remembertochangeme"
|
||||
keycloak_realm_realm: TestRealm
|
||||
keycloak_realm_client_default_roles:
|
||||
- TestRoleAdmin
|
||||
- TestRoleUser
|
||||
keycloak_realm_client_users:
|
||||
- username: TestUser
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient1
|
||||
role: TestRoleUser
|
||||
realm: TestRealm
|
||||
- username: TestAdmin
|
||||
password: password
|
||||
client_roles:
|
||||
- client: TestClient1
|
||||
role: TestRoleUser
|
||||
realm: TestRealm
|
||||
- client: TestClient1
|
||||
role: TestRoleAdmin
|
||||
realm: TestRealm
|
||||
keycloak_realm_clients:
|
||||
- name: TestClient1
|
||||
client_id: TestClient1
|
||||
roles: "{{ keycloak_realm_client_default_roles }}"
|
||||
realm: TestRealm
|
||||
public_client: true
|
||||
web_origins:
|
||||
- http://testclient1origin/application
|
||||
- http://testclient1origin/other
|
||||
users: "{{ keycloak_realm_client_users }}"
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
- name: Playbook for Red Hat SSO Hosts
|
||||
hosts: sso
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
sso_enable: true
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
|
|
@ -0,0 +1 @@
|
|||
../roles
|
||||
Loading…
Reference in a new issue