Vendor middleware_automation.keycloak collection
Needed for keycloak_authentication_v2, to manage Keycloak authentication flows (e.g. the CCCHH browser flow) as YAML. Chosen over community.general's own copy of the module (deprecated in favor of this collection, and limited to 4 sub-flow levels there vs. 10 here).
This commit is contained in:
parent
4540dc5516
commit
4832e5da5d
159 changed files with 34399 additions and 0 deletions
|
|
@ -0,0 +1,215 @@
|
|||
keycloak
|
||||
========
|
||||
|
||||
Install [keycloak](https://keycloak.org/) or [Red Hat Single Sign-On](https://access.redhat.com/products/red-hat-single-sign-on) server configurations.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
This role requires the `python3-netaddr` library installed on the controller node.
|
||||
|
||||
* to install via yum/dnf: `dnf install python3-netaddr`
|
||||
* to install via apt: `apt install python3-netaddr`
|
||||
* or via pip: `pip install netaddr==0.8.0`
|
||||
* or via the collection: `pip install -r requirements.txt`
|
||||
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
The roles depends on:
|
||||
|
||||
* [middleware_automation.common](https://github.com/ansible-middleware/common)
|
||||
* [ansible-posix](https://docs.ansible.com/ansible/latest/collections/ansible/posix/index.html)
|
||||
|
||||
To install all the dependencies via galaxy:
|
||||
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
|
||||
|
||||
Versions
|
||||
--------
|
||||
|
||||
| RH-SSO VERSION | Release Date | Keycloak Version | EAP Version | Notes |
|
||||
|:---------------|:------------------|:-----------------|:------------|:----------------|
|
||||
|`7.5.0 GA` |September 20, 2021 |`15.0.2` | `7.4.6` |[Release Notes](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index)|
|
||||
|`7.6.0 GA` |June 30, 2022 |`18.0.3` | `7.4.6` |[Release Notes](https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.6/html-single/release_notes/index)|
|
||||
|
||||
|
||||
Patching
|
||||
--------
|
||||
|
||||
When variable `keycloak_rhsso_apply_patches` is `true` (default: `false`), the role will automatically apply the latest cumulative patch for the selected base version.
|
||||
|
||||
| RH-SSO VERSION | Release Date | RH-SSO LATEST CP | Notes |
|
||||
|:---------------|:------------------|:-----------------|:----------------|
|
||||
|`7.5.0 GA` |January 20, 2022 |`7.5.3 GA` |[Release Notes](https://access.redhat.com/articles/6646321)|
|
||||
|`7.6.0 GA` |November 11, 2022 |`7.6.1 GA` |[Release Notes](https://access.redhat.com/articles/6982711)|
|
||||
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
* Service configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_ha_enabled`| Enable auto configuration for database backend, clustering and remote caches on infinispan | `False` |
|
||||
|`keycloak_ha_discovery`| Discovery protocol for HA cluster members | `JDBC_PING` if `keycloak_db_enabled` else `TCPPING` |
|
||||
|`keycloak_db_enabled`| Enable auto configuration for database backend | `True` if `keycloak_ha_enabled` is True, else `False` |
|
||||
|`keycloak_remote_cache_enabled`| Enable remote cache store when in clustered ha configurations | `True` if `keycloak_ha_enabled` else `False` |
|
||||
|`keycloak_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_bind_address`| Address for binding service ports | `0.0.0.0` |
|
||||
|`keycloak_management_port_bind_address`| Address for binding management ports | `127.0.0.1` |
|
||||
|`keycloak_host`| hostname | `localhost` |
|
||||
|`keycloak_http_port`| HTTP port | `8080` |
|
||||
|`keycloak_https_port`| TLS HTTP port | `8443` |
|
||||
|`keycloak_ajp_port`| AJP port | `8009` |
|
||||
|`keycloak_jgroups_port`| jgroups cluster tcp port | `7600` |
|
||||
|`keycloak_management_http_port`| Management port | `9990` |
|
||||
|`keycloak_management_https_port`| TLS management port | `9993` |
|
||||
|`keycloak_prefer_ipv4`| Prefer IPv4 stack and addresses for port binding | `true` |
|
||||
|`keycloak_config_standalone_xml`| filename for configuration | `keycloak.xml` |
|
||||
|`keycloak_service_user`| posix account username | `keycloak` |
|
||||
|`keycloak_service_group`| posix account group | `keycloak` |
|
||||
|`keycloak_service_restart_always`| systemd restart always behavior activation | `False` |
|
||||
|`keycloak_service_restart_on_failure`| systemd restart on-failure behavior activation | `False` |
|
||||
|`keycloak_service_startlimitintervalsec`| systemd StartLimitIntervalSec | `300` |
|
||||
|`keycloak_service_startlimitburst`| systemd StartLimitBurst | `5` |
|
||||
|`keycloak_service_restartsec`| systemd RestartSec | `10s` |
|
||||
|`keycloak_service_pidfile`| pid file path for service | `/run/keycloak/keycloak.pid` |
|
||||
|`keycloak_features` | List of `name`/`status` pairs of features (also known as profiles on RH-SSO) to `enable` or `disable`, example: `[ { name: 'docker', status: 'enabled' } ]` | `[]`
|
||||
|`keycloak_jvm_package`| RHEL java package runtime | `java-1.8.0-openjdk-headless` |
|
||||
|`keycloak_java_home`| `JAVA_HOME` of installed JRE, leave empty for using RPM path at `keycloak_jvm_package` | `None` |
|
||||
|`keycloak_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` |
|
||||
|
||||
|
||||
* Install options
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_offline_install` | perform an offline install | `false`|
|
||||
|`keycloak_download_url`| Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/<version>/<archive>`|
|
||||
|`keycloak_version`| keycloak.org package version | `18.0.2` |
|
||||
|`keycloak_dest`| Installation root path | `/opt/keycloak` |
|
||||
|`keycloak_download_url` | Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/{{ keycloak_archive }}` |
|
||||
|`keycloak_configure_firewalld` | Ensure firewalld is running and configure keycloak ports | `false` |
|
||||
|
||||
|
||||
* Miscellaneous configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_archive` | keycloak install archive filename | `keycloak-legacy-{{ keycloak_version }}.zip` |
|
||||
|`keycloak_download_url_9x` | Download URL for keycloak (deprecated) | `https://downloads.jboss.org/keycloak/{{ keycloak_version }}/{{ keycloak_archive }}` |
|
||||
|`keycloak_installdir` | Installation path | `{{ keycloak_dest }}/keycloak-{{ keycloak_version }}` |
|
||||
|`keycloak_jboss_home` | Installation work directory | `{{ keycloak_rhsso_installdir }}` |
|
||||
|`keycloak_jboss_port_offset` | Port offset for the JBoss socket binding | `0` |
|
||||
|`keycloak_config_dir` | Path for configuration | `{{ keycloak_jboss_home }}/standalone/configuration` |
|
||||
|`keycloak_config_path_to_standalone_xml` | Custom path for configuration | `{{ keycloak_jboss_home }}/standalone/configuration/{{ keycloak_config_standalone_xml }}` |
|
||||
|`keycloak_config_override_template` | Path to custom template for standalone.xml configuration | `''` |
|
||||
|`keycloak_auth_realm` | Name for rest authentication realm | `master` |
|
||||
|`keycloak_auth_client` | Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_force_install` | Remove pre-existing versions of service | `false` |
|
||||
|`keycloak_url` | URL for configuration rest calls | `http://{{ keycloak_host }}:{{ keycloak_http_port + keycloak_jboss_port_offset }}` |
|
||||
|`keycloak_management_url` | URL for management console rest calls | `http://{{ keycloak_host }}:{{ keycloak_management_http_port + keycloak_jboss_port_offset }}` |
|
||||
|`keycloak_frontend_url_force` | Force backend requests to use the frontend URL | `false` |
|
||||
|`keycloak_db_background_validation` | Enable background validation of database connection | `false` |
|
||||
|`keycloak_db_background_validation_millis`| How frequenly the connection pool is validated in the background | `10000` if background validation enabled |
|
||||
|`keycloak_db_background_validate_on_match` | Enable validate on match for database connections | `false` |
|
||||
|`keycloak_frontend_url` | frontend URL for keycloak endpoint | `http://localhost:8080/auth/` |
|
||||
|`keycloak_log_target`| Set the destination of the keycloak log folder link | `/var/log/keycloak` |
|
||||
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
The following are a set of _required_ variables for the role:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_admin_password`| Password for the administration console user account (minimum 12 characters) |
|
||||
|`keycloak_frontend_url` | frontend URL for keycloak endpoint | `http://localhost:8080/auth/` |
|
||||
|
||||
|
||||
The following parameters are _required_ only when `keycloak_ha_enabled` is true:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_modcluster_enabled`| Enable configuration for modcluster subsystem | `True` if `keycloak_ha_enabled` is True, else `False` |
|
||||
|`keycloak_modcluster_url` | _deprecated_ Host for the modcluster reverse proxy | `localhost` |
|
||||
|`keycloak_modcluster_port` | _deprecated_ Port for the modcluster reverse proxy | `6666` |
|
||||
|`keycloak_modcluster_urls` | List of {host,port} dicts for the modcluster reverse proxies | `[ { localhost:6666 } ]` |
|
||||
|`keycloak_jdbc_engine` | backend database engine when db is enabled: [ postgres, mariadb, sqlserver ] | `postgres` |
|
||||
|`keycloak_infinispan_url` | URL for the infinispan remote-cache server | `localhost:11122` |
|
||||
|`keycloak_infinispan_user` | username for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_infinispan_pass` | password for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_infinispan_sasl_mechanism`| Authentication type | `SCRAM-SHA-512` |
|
||||
|`keycloak_infinispan_use_ssl`| Enable hotrod TLS communication | `False` |
|
||||
|`keycloak_infinispan_trust_store_path`| Path to truststore with infinispan server certificate | `/etc/pki/java/cacerts` |
|
||||
|`keycloak_infinispan_trust_store_password`| Password for opening truststore | `changeit` |
|
||||
|
||||
|
||||
The following parameters are _required_ only when `keycloak_db_enabled` is true:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_jdbc_url` | URL for the postgres backend database | `jdbc:postgresql://localhost:5432/keycloak` |
|
||||
|`keycloak_jdbc_driver_version`| Version for the JDBC driver to download | `9.4.1212` |
|
||||
|`keycloak_db_user` | username for connecting to postgres | `keycloak-user` |
|
||||
|`keycloak_db_pass` | password for connecting to postgres | `keycloak-pass` |
|
||||
|
||||
|
||||
The following variables are _optional_:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_db_valid_conn_sql` | Override the default database connection validation query sql |
|
||||
|`keycloak_admin_url` | Override the default administration endpoint URL |
|
||||
|`keycloak_jgroups_subnet`| Override the subnet match for jgroups cluster formation; if not defined, it will be inferred from local machine route configuration |
|
||||
|
||||
Example Playbook
|
||||
-----------------
|
||||
|
||||
* The following is an example playbook that makes use of the role to install keycloak from remote:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
roles:
|
||||
- middleware_automation.keycloak.keycloak
|
||||
```
|
||||
|
||||
|
||||
* The following example playbook makes use of the role to install keycloak from the controller node:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
collections:
|
||||
- middleware_automation.keycloak
|
||||
tasks:
|
||||
- name: Include keycloak role
|
||||
include_role:
|
||||
name: keycloak
|
||||
vars:
|
||||
keycloak_admin_password: "remembertochangeme"
|
||||
keycloak_offline_install: true
|
||||
# This should be the filename of keycloak archive on Ansible node: keycloak-16.1.0.zip
|
||||
```
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
* [Romain Pelisse](https://github.com/rpelisse)
|
||||
* [Pavan Kumar Motaparthi](https://github.com/motaparthipavankumar)
|
||||
|
|
@ -0,0 +1,128 @@
|
|||
---
|
||||
### Configuration specific to keycloak
|
||||
keycloak_version: 18.0.2
|
||||
keycloak_archive: "keycloak-legacy-{{ keycloak_version }}.zip"
|
||||
keycloak_download_url: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/{{ keycloak_archive }}"
|
||||
keycloak_download_url_9x: "https://downloads.jboss.org/keycloak/{{ keycloak_version }}/{{ keycloak_archive }}"
|
||||
keycloak_installdir: "{{ keycloak_dest }}/keycloak-{{ keycloak_version }}"
|
||||
keycloak_offline_install: false
|
||||
|
||||
# Authentication for Keycloak binary download (e.g. from internal artifact repository)
|
||||
keycloak_binary_download_user:
|
||||
keycloak_binary_download_pass:
|
||||
|
||||
### Install location and service settings
|
||||
keycloak_java_home:
|
||||
keycloak_dest: /opt/keycloak
|
||||
keycloak_jboss_home: "{{ keycloak_installdir }}"
|
||||
keycloak_jboss_port_offset: 0
|
||||
keycloak_config_dir: "{{ keycloak_jboss_home }}/standalone/configuration"
|
||||
keycloak_config_standalone_xml: "keycloak.xml"
|
||||
keycloak_config_path_to_standalone_xml: "{{ keycloak_jboss_home }}/standalone/configuration/{{ keycloak_config_standalone_xml }}"
|
||||
keycloak_config_override_template: ''
|
||||
keycloak_config_path_to_properties: "{{ keycloak_jboss_home }}/standalone/configuration/profile.properties"
|
||||
keycloak_service_runas: false
|
||||
keycloak_service_user: keycloak
|
||||
keycloak_service_group: keycloak
|
||||
keycloak_service_pidfile: "/run/keycloak/keycloak.pid"
|
||||
keycloak_service_name: keycloak
|
||||
keycloak_service_desc: Keycloak
|
||||
keycloak_service_start_delay: 10
|
||||
keycloak_service_start_retries: 25
|
||||
keycloak_service_restart_always: false
|
||||
keycloak_service_restart_on_failure: false
|
||||
keycloak_service_startlimitintervalsec: "300"
|
||||
keycloak_service_startlimitburst: "5"
|
||||
keycloak_service_restartsec: "10s"
|
||||
|
||||
keycloak_configure_firewalld: false
|
||||
keycloak_configure_iptables: false
|
||||
|
||||
### administrator console password
|
||||
keycloak_admin_password: ''
|
||||
|
||||
### Common configuration settings
|
||||
keycloak_bind_address: 0.0.0.0
|
||||
keycloak_host: localhost
|
||||
keycloak_http_port: 8080
|
||||
keycloak_https_port: 8443
|
||||
keycloak_ajp_port: 8009
|
||||
keycloak_jgroups_port: 7600
|
||||
keycloak_jgroups_subnet:
|
||||
keycloak_management_port_bind_address: 127.0.0.1
|
||||
keycloak_management_http_port: 9990
|
||||
keycloak_management_https_port: 9993
|
||||
keycloak_java_opts: "-Xms1024m -Xmx2048m"
|
||||
keycloak_prefer_ipv4: true
|
||||
keycloak_features: []
|
||||
|
||||
### Enable configuration for database backend, clustering and remote caches on infinispan
|
||||
keycloak_ha_enabled: false
|
||||
### Enable database configuration, must be enabled when HA is configured
|
||||
keycloak_db_enabled: "{{ True if keycloak_ha_enabled else False }}"
|
||||
### Discovery protocol for ha cluster members, valus [ 'JDBC_PING', 'TCPPING' ]
|
||||
keycloak_ha_discovery: "{{ 'JDBC_PING' if keycloak_db_enabled else 'TCPPING' }}"
|
||||
### Remote cache store on infinispan cluster
|
||||
keycloak_remote_cache_enabled: "{{ True if keycloak_ha_enabled else False }}"
|
||||
|
||||
### Keycloak administration console user
|
||||
keycloak_admin_user: admin
|
||||
keycloak_auth_realm: master
|
||||
keycloak_auth_client: admin-cli
|
||||
|
||||
keycloak_force_install: false
|
||||
|
||||
### mod_cluster reverse proxy list
|
||||
keycloak_modcluster_enabled: "{{ True if keycloak_ha_enabled else False }}"
|
||||
keycloak_modcluster_url: localhost
|
||||
keycloak_modcluster_port: 6666
|
||||
keycloak_modcluster_urls:
|
||||
- host: "{{ keycloak_modcluster_url }}"
|
||||
port: "{{ keycloak_modcluster_port }}"
|
||||
|
||||
### keycloak frontend url
|
||||
keycloak_frontend_url: http://localhost:8080/auth/
|
||||
keycloak_frontend_url_force: false
|
||||
keycloak_admin_url:
|
||||
|
||||
### infinispan remote caches access (hotrod)
|
||||
keycloak_infinispan_user: supervisor
|
||||
keycloak_infinispan_pass: supervisor
|
||||
keycloak_infinispan_url: localhost
|
||||
keycloak_infinispan_sasl_mechanism: SCRAM-SHA-512
|
||||
keycloak_infinispan_use_ssl: false
|
||||
# if ssl is enabled, import ispn server certificate here
|
||||
keycloak_infinispan_trust_store_path: /etc/pki/java/cacerts
|
||||
keycloak_infinispan_trust_store_password: changeit
|
||||
|
||||
### database backend engine: values [ 'postgres', 'mariadb', 'sqlserver' ]
|
||||
keycloak_jdbc_engine: postgres
|
||||
### database backend credentials
|
||||
keycloak_db_user: keycloak-user
|
||||
keycloak_db_pass: keycloak-pass
|
||||
## connection validation
|
||||
keycloak_db_background_validation: false
|
||||
keycloak_db_background_validation_millis: "{{ 10000 if keycloak_db_background_validation else 0 }}"
|
||||
keycloak_db_background_validate_on_match: false
|
||||
keycloak_jdbc_url: "{{ keycloak_default_jdbc[keycloak_jdbc_engine].url }}"
|
||||
keycloak_jdbc_driver_version: "{{ keycloak_default_jdbc[keycloak_jdbc_engine].version }}"
|
||||
# override the variables above, following defaults show minimum supported versions
|
||||
keycloak_default_jdbc:
|
||||
postgres:
|
||||
url: 'jdbc:postgresql://localhost:5432/keycloak'
|
||||
version: 9.4.1212
|
||||
mariadb:
|
||||
url: 'jdbc:mariadb://localhost:3306/keycloak'
|
||||
version: 2.7.4
|
||||
sqlserver:
|
||||
url: 'jdbc:sqlserver://localhost:1433;databaseName=keycloak;'
|
||||
version: 12.2.0
|
||||
# role specific vars
|
||||
keycloak_no_log: true
|
||||
|
||||
### logging configuration
|
||||
keycloak_log_target: /var/log/keycloak
|
||||
|
||||
# locations
|
||||
keycloak_url: "http://{{ keycloak_host }}:{{ keycloak_http_port + keycloak_jboss_port_offset }}"
|
||||
keycloak_management_url: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + keycloak_jboss_port_offset }}"
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
- name: "Restart handler"
|
||||
ansible.builtin.include_tasks: restart_keycloak.yml
|
||||
listen: "restart keycloak"
|
||||
|
|
@ -0,0 +1,393 @@
|
|||
argument_specs:
|
||||
main:
|
||||
options:
|
||||
keycloak_version:
|
||||
default: "18.0.2"
|
||||
description: "keycloak.org package version"
|
||||
type: "str"
|
||||
keycloak_archive:
|
||||
default: "keycloak-legacy-{{ keycloak_version }}.zip"
|
||||
description: "keycloak install archive filename"
|
||||
type: "str"
|
||||
keycloak_configure_iptables:
|
||||
default: false
|
||||
description: "Ensure iptables is running and configure keycloak ports"
|
||||
type: "bool"
|
||||
keycloak_configure_firewalld:
|
||||
default: false
|
||||
description: "Ensure firewalld is running and configure keycloak ports"
|
||||
type: "bool"
|
||||
keycloak_download_url:
|
||||
default: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/{{ keycloak_archive }}"
|
||||
description: "Download URL for keycloak"
|
||||
type: "str"
|
||||
keycloak_download_url_9x:
|
||||
default: "https://downloads.jboss.org/keycloak/{{ keycloak_version }}/{{ keycloak_archive }}"
|
||||
description: "Download URL for keycloak (deprecated)"
|
||||
type: "str"
|
||||
keycloak_installdir:
|
||||
default: "{{ keycloak_dest }}/keycloak-{{ keycloak_version }}"
|
||||
description: "Installation path"
|
||||
type: "str"
|
||||
keycloak_offline_install:
|
||||
default: false
|
||||
description: "Perform an offline install"
|
||||
type: "bool"
|
||||
keycloak_jvm_package:
|
||||
default: "java-1.8.0-openjdk-headless"
|
||||
description: "RHEL java package runtime rpm"
|
||||
type: "str"
|
||||
keycloak_java_home:
|
||||
description: "JAVA_HOME of installed JRE, leave empty for using specified keycloak_jvm_package RPM path"
|
||||
type: "str"
|
||||
keycloak_dest:
|
||||
default: "/opt/keycloak"
|
||||
description: "Root installation directory"
|
||||
type: "str"
|
||||
keycloak_jboss_home:
|
||||
default: "{{ keycloak_installdir }}"
|
||||
description: "Installation work directory"
|
||||
type: "str"
|
||||
keycloak_jboss_port_offset:
|
||||
default: 0
|
||||
description: "Port offset for the JBoss socket binding"
|
||||
type: "int"
|
||||
keycloak_config_dir:
|
||||
default: "{{ keycloak_jboss_home }}/standalone/configuration"
|
||||
description: "Path for configuration"
|
||||
type: "str"
|
||||
keycloak_config_standalone_xml:
|
||||
default: "keycloak.xml"
|
||||
description: "Service configuration filename"
|
||||
type: "str"
|
||||
keycloak_config_path_to_standalone_xml:
|
||||
default: "{{ keycloak_jboss_home }}/standalone/configuration/{{ keycloak_config_standalone_xml }}"
|
||||
description: "Custom path for configuration"
|
||||
type: "str"
|
||||
keycloak_config_override_template:
|
||||
default: ""
|
||||
description: "Path to custom template for standalone.xml configuration"
|
||||
type: "str"
|
||||
keycloak_service_runas:
|
||||
default: false
|
||||
description: "Enable execution of service as `keycloak_service_user`"
|
||||
type: "bool"
|
||||
keycloak_service_user:
|
||||
default: "keycloak"
|
||||
description: "posix account username"
|
||||
type: "str"
|
||||
keycloak_service_group:
|
||||
default: "keycloak"
|
||||
description: "posix account group"
|
||||
type: "str"
|
||||
keycloak_service_pidfile:
|
||||
default: "/run/keycloak/keycloak.pid"
|
||||
description: "PID file path for service"
|
||||
type: "str"
|
||||
keycloak_features:
|
||||
default: "[]"
|
||||
description: >
|
||||
List of `name`/`status` pairs of features (also known as profiles on RH-SSO) to `enable` or `disable`,
|
||||
example: `[ { name: 'docker', status: 'enabled' } ]`
|
||||
type: "list"
|
||||
keycloak_bind_address:
|
||||
default: "0.0.0.0"
|
||||
description: "Address for binding service ports"
|
||||
type: "str"
|
||||
keycloak_management_port_bind_address:
|
||||
default: "127.0.0.1"
|
||||
description: "Address for binding the management ports"
|
||||
type: "str"
|
||||
keycloak_host:
|
||||
default: "localhost"
|
||||
description: "Hostname for service"
|
||||
type: "str"
|
||||
keycloak_http_port:
|
||||
default: 8080
|
||||
description: "Listening HTTP port"
|
||||
type: "int"
|
||||
keycloak_https_port:
|
||||
default: 8443
|
||||
description: "Listening HTTPS port"
|
||||
type: "int"
|
||||
keycloak_ajp_port:
|
||||
default: 8009
|
||||
description: "Listening AJP port"
|
||||
type: "int"
|
||||
keycloak_jgroups_port:
|
||||
default: 7600
|
||||
description: "jgroups cluster tcp port"
|
||||
type: "int"
|
||||
keycloak_management_http_port:
|
||||
default: 9990
|
||||
description: "Management port (http)"
|
||||
type: "int"
|
||||
keycloak_management_https_port:
|
||||
default: 9993
|
||||
description: "Management port (https)"
|
||||
type: "int"
|
||||
keycloak_java_opts:
|
||||
default: "-Xms1024m -Xmx2048m"
|
||||
description: "Additional JVM options"
|
||||
type: "str"
|
||||
keycloak_prefer_ipv4:
|
||||
default: true
|
||||
description: "Prefer IPv4 stack and addresses for port binding"
|
||||
type: "bool"
|
||||
keycloak_ha_enabled:
|
||||
default: false
|
||||
description: "Enable auto configuration for database backend, clustering and remote caches on infinispan"
|
||||
type: "bool"
|
||||
keycloak_ha_discovery:
|
||||
default: "{{ 'JDBC_PING' if keycloak_db_enabled else 'TCPPING' }}"
|
||||
description: "Discovery protocol for HA cluster members"
|
||||
type: "str"
|
||||
keycloak_db_enabled:
|
||||
default: "{{ True if keycloak_ha_enabled else False }}"
|
||||
description: "Enable auto configuration for database backend"
|
||||
type: "bool"
|
||||
keycloak_admin_user:
|
||||
default: "admin"
|
||||
description: "Administration console user account"
|
||||
type: "str"
|
||||
keycloak_auth_realm:
|
||||
default: "master"
|
||||
description: "Name for rest authentication realm"
|
||||
type: "str"
|
||||
keycloak_auth_client:
|
||||
default: "admin-cli"
|
||||
description: "Authentication client for configuration REST calls"
|
||||
type: "str"
|
||||
keycloak_force_install:
|
||||
default: false
|
||||
description: "Remove pre-existing versions of service"
|
||||
type: "bool"
|
||||
keycloak_modcluster_enabled:
|
||||
default: "{{ True if keycloak_ha_enabled else False }}"
|
||||
description: "Enable configuration for modcluster subsystem"
|
||||
type: "bool"
|
||||
keycloak_modcluster_url:
|
||||
default: "localhost"
|
||||
description: "URL for the modcluster reverse proxy"
|
||||
type: "str"
|
||||
keycloak_modcluster_port:
|
||||
default: 6666
|
||||
description: "Port for the modcluster reverse proxy"
|
||||
type: "int"
|
||||
keycloak_modcluster_urls:
|
||||
default: "[ { host: 'localhost', port: 6666 } ]"
|
||||
description: "List of modproxy node URLs in the format { host, port } for the modcluster reverse proxy"
|
||||
type: "list"
|
||||
keycloak_frontend_url:
|
||||
default: "http://localhost"
|
||||
description: "Frontend URL for keycloak endpoints when a reverse proxy is used"
|
||||
type: "str"
|
||||
keycloak_frontend_url_force:
|
||||
default: false
|
||||
description: "Force backend requests to use the frontend URL"
|
||||
type: "bool"
|
||||
keycloak_infinispan_user:
|
||||
default: "supervisor"
|
||||
description: "Username for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_infinispan_pass:
|
||||
default: "supervisor"
|
||||
description: "Password for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_infinispan_url:
|
||||
default: "localhost"
|
||||
description: "URL for the infinispan remote-cache server"
|
||||
type: "str"
|
||||
keycloak_infinispan_sasl_mechanism:
|
||||
default: "SCRAM-SHA-512"
|
||||
description: "Authentication type to infinispan server"
|
||||
type: "str"
|
||||
keycloak_infinispan_use_ssl:
|
||||
default: false
|
||||
description: "Enable hotrod client TLS communication"
|
||||
type: "bool"
|
||||
keycloak_infinispan_trust_store_path:
|
||||
default: "/etc/pki/java/cacerts"
|
||||
description: "TODO document argument"
|
||||
type: "str"
|
||||
keycloak_infinispan_trust_store_password:
|
||||
default: "changeit"
|
||||
description: "Path to truststore containing infinispan server certificate"
|
||||
type: "str"
|
||||
keycloak_jdbc_engine:
|
||||
default: "postgres"
|
||||
description: "Backend database flavour when db is enabled: [ postgres, mariadb, sqlserver ]"
|
||||
type: "str"
|
||||
keycloak_db_user:
|
||||
default: "keycloak-user"
|
||||
description: "Username for connecting to database"
|
||||
type: "str"
|
||||
keycloak_db_pass:
|
||||
default: "keycloak-pass"
|
||||
description: "Password for connecting to database"
|
||||
type: "str"
|
||||
keycloak_jdbc_url:
|
||||
default: "{{ keycloak_default_jdbc[keycloak_jdbc_engine].url }}"
|
||||
description: "URL for connecting to backend database"
|
||||
type: "str"
|
||||
keycloak_jdbc_driver_version:
|
||||
default: "{{ keycloak_default_jdbc[keycloak_jdbc_engine].version }}"
|
||||
description: "Version for the JDBC driver to download"
|
||||
type: "str"
|
||||
keycloak_admin_password:
|
||||
required: true
|
||||
description: "Password for the administration console user account"
|
||||
type: "str"
|
||||
keycloak_url:
|
||||
default: "http://{{ keycloak_host }}:{{ keycloak_http_port + keycloak_jboss_port_offset }}"
|
||||
description: "URL for configuration rest calls"
|
||||
type: "str"
|
||||
keycloak_management_url:
|
||||
default: "http://{{ keycloak_host }}:{{ keycloak_management_http_port + keycloak_jboss_port_offset }}"
|
||||
description: "URL for management console rest calls"
|
||||
type: "str"
|
||||
keycloak_service_name:
|
||||
default: "keycloak"
|
||||
description: "systemd service name for keycloak"
|
||||
type: "str"
|
||||
keycloak_service_desc:
|
||||
default: "Keycloak"
|
||||
description: "systemd description for keycloak"
|
||||
type: "str"
|
||||
keycloak_service_start_delay:
|
||||
default: "10"
|
||||
description: "Expected delay in ms before the service is expected to be available after start."
|
||||
type: "int"
|
||||
keycloak_service_start_retries:
|
||||
default: "25"
|
||||
description: "How many time should Ansible retry to connect to the service after it was started, before failing."
|
||||
type: "int"
|
||||
keycloak_service_restart_always:
|
||||
default: false
|
||||
description: "systemd restart always behavior activation for keycloak"
|
||||
type: "bool"
|
||||
keycloak_service_restart_on_failure:
|
||||
default: false
|
||||
description: "systemd restart on-failure behavior activation for keycloak"
|
||||
type: "bool"
|
||||
keycloak_service_startlimitintervalsec:
|
||||
default: 300
|
||||
description: "systemd StartLimitIntervalSec for keycloak"
|
||||
type: "int"
|
||||
keycloak_service_startlimitburst:
|
||||
default: 5
|
||||
description: "systemd StartLimitBurst for keycloak"
|
||||
type: "int"
|
||||
keycloak_service_restartsec:
|
||||
default: "5s"
|
||||
description: "systemd RestartSec for keycloak"
|
||||
type: "str"
|
||||
keycloak_no_log:
|
||||
default: true
|
||||
type: "bool"
|
||||
description: "Changes default behavior for no_log for debugging purpose, do not change for production system."
|
||||
keycloak_remote_cache_enabled:
|
||||
default: "{{ True if keycloak_ha_enabled else False }}"
|
||||
description: "Enable remote cache store when in clustered ha configurations"
|
||||
type: "bool"
|
||||
keycloak_db_background_validation:
|
||||
default: false
|
||||
description: "Enable background validation of database connection"
|
||||
type: "bool"
|
||||
keycloak_db_background_validation_millis:
|
||||
default: "{{ 10000 if keycloak_db_background_validation else 0 }}"
|
||||
description: "How frequenly the connection pool is validated in the background"
|
||||
type: 'int'
|
||||
keycloak_db_background_validate_on_match:
|
||||
default: false
|
||||
description: "Enable validate on match for database connections"
|
||||
type: "bool"
|
||||
keycloak_db_valid_conn_sql:
|
||||
required: false
|
||||
description: "Override the default database connection validation query sql"
|
||||
type: "str"
|
||||
keycloak_admin_url:
|
||||
required: false
|
||||
description: "Override the default administration endpoint URL"
|
||||
type: "str"
|
||||
keycloak_jgroups_subnet:
|
||||
required: false
|
||||
description: >
|
||||
Override the subnet match for jgroups cluster formation; if not defined, it will be inferred from local machine route configuration
|
||||
type: "str"
|
||||
keycloak_log_target:
|
||||
default: '/var/log/keycloak'
|
||||
type: "str"
|
||||
description: "Set the destination of the keycloak log folder link"
|
||||
keycloak_jdbc_download_url:
|
||||
description: "Override the default Maven Central download URL for the JDBC driver"
|
||||
type: "str"
|
||||
keycloak_jdbc_download_user:
|
||||
description: "Set a username with which to authenticate when downloading JDBC drivers from an alternative location"
|
||||
type: "str"
|
||||
keycloak_jdbc_download_pass:
|
||||
description: >
|
||||
Set a password with which to authenticate when downloading JDBC drivers from an alternative location (requires keycloak_jdbc_download_user)
|
||||
type: "str"
|
||||
keycloak_jdbc_download_validate_certs:
|
||||
default: true
|
||||
description: "Allow the option to ignore invalid certificates when downloading JDBC drivers from a custom URL"
|
||||
type: "bool"
|
||||
keycloak_binary_download_user:
|
||||
description: "Username for HTTP Basic Auth when downloading Keycloak binary"
|
||||
type: "str"
|
||||
required: false
|
||||
keycloak_binary_download_pass:
|
||||
description: "Password for HTTP Basic Auth when downloading Keycloak binary"
|
||||
type: "str"
|
||||
required: false
|
||||
downstream:
|
||||
options:
|
||||
sso_version:
|
||||
default: "7.6.0"
|
||||
description: "Red Hat Single Sign-On version"
|
||||
type: "str"
|
||||
sso_archive:
|
||||
default: "rh-sso-{{ sso_version }}-server-dist.zip"
|
||||
description: "Red Hat SSO install archive filename"
|
||||
type: "str"
|
||||
sso_dest:
|
||||
default: "/opt/sso"
|
||||
description: "Root installation directory"
|
||||
type: "str"
|
||||
sso_installdir:
|
||||
default: "{{ sso_dest }}/rh-sso-{{ sso_version.split('.')[0] }}.{{ sso_version.split('.')[1] }}"
|
||||
description: "Installation path for Red Hat SSO"
|
||||
type: "str"
|
||||
sso_apply_patches:
|
||||
default: false
|
||||
description: "Install Red Hat SSO most recent cumulative patch"
|
||||
type: "bool"
|
||||
sso_enable:
|
||||
default: true
|
||||
description: "Enable Red Hat Single Sign-on installation"
|
||||
type: "str"
|
||||
sso_offline_install:
|
||||
default: false
|
||||
description: "Perform an offline install"
|
||||
type: "bool"
|
||||
sso_service_name:
|
||||
default: "sso"
|
||||
description: "systemd service name for Single Sign-On"
|
||||
type: "str"
|
||||
sso_service_desc:
|
||||
default: "Red Hat Single Sign-On"
|
||||
description: "systemd description for Red Hat Single Sign-On"
|
||||
type: "str"
|
||||
sso_patch_version:
|
||||
required: false
|
||||
description: "Red Hat Single Sign-On latest cumulative patch version to apply; defaults to latest version when sso_apply_patches is True"
|
||||
type: "str"
|
||||
sso_patch_bundle:
|
||||
default: "rh-sso-{{ sso_patch_version | default('[0-9]+[.][0-9]+[.][0-9]+') }}-patch.zip"
|
||||
description: "Red Hat SSO patch archive filename"
|
||||
type: "str"
|
||||
sso_product_category:
|
||||
default: "CORE.SERVICE.RHSSO"
|
||||
description: "Unified Downloads API category for Single Sign-On"
|
||||
type: "str"
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
collections:
|
||||
- middleware_automation.common
|
||||
- ansible.posix
|
||||
|
||||
galaxy_info:
|
||||
role_name: keycloak
|
||||
namespace: middleware_automation
|
||||
author: Romain Pelisse, Guido Grazioli, Pavan Kumar Motaparthi
|
||||
description: Install keycloak or Red Hat Single Sign-On server configurations
|
||||
company: Red Hat, Inc.
|
||||
|
||||
license: Apache License 2.0
|
||||
|
||||
min_ansible_version: "2.16"
|
||||
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "8"
|
||||
|
||||
galaxy_tags:
|
||||
- keycloak
|
||||
- redhat
|
||||
- rhel
|
||||
- sso
|
||||
- authentication
|
||||
- identity
|
||||
- security
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
- name: Include firewall config tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: iptables.yml
|
||||
apply:
|
||||
tags:
|
||||
- firewall
|
||||
when: keycloak_configure_iptables
|
||||
tags:
|
||||
- firewall
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
- name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
|
||||
ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
|
||||
register: keycloak_rpm_info
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Add missing packages to the yum install list"
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_packages_to_install: "{{ keycloak_packages_to_install | default([]) + keycloak_rpm_info.stdout_lines | \
|
||||
map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
|
||||
when: ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Install packages: {{ keycloak_packages_to_install }}"
|
||||
become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ keycloak_packages_to_install }}"
|
||||
state: present
|
||||
when:
|
||||
- keycloak_packages_to_install | default([]) | length > 0
|
||||
- ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Install packages: {{ packages_list }}"
|
||||
become: "{{ keycloak_fastpackages_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.package:
|
||||
name: "{{ packages_list }}"
|
||||
state: present
|
||||
when:
|
||||
- packages_list | default([]) | length > 0
|
||||
- ansible_facts.os_family == "Debian"
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
- name: Ensure required package firewalld are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list:
|
||||
- firewalld
|
||||
|
||||
- name: Enable and start the firewalld service
|
||||
become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.systemd:
|
||||
name: firewalld
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
- name: "Configure firewall ports for {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_firewalld_require_privilege_escalation | default(true) }}"
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ item }}"
|
||||
permanent: true
|
||||
state: enabled
|
||||
immediate: true
|
||||
loop:
|
||||
- "{{ keycloak_http_port }}/tcp"
|
||||
- "{{ keycloak_https_port }}/tcp"
|
||||
- "{{ keycloak_management_http_port }}/tcp"
|
||||
- "{{ keycloak_management_https_port }}/tcp"
|
||||
- "{{ keycloak_jgroups_port }}/tcp"
|
||||
- "{{ keycloak_ajp_port }}/tcp"
|
||||
|
|
@ -0,0 +1,306 @@
|
|||
---
|
||||
- name: Validate parameters
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_jboss_home is defined
|
||||
- keycloak_service_user is defined
|
||||
- keycloak_dest is defined
|
||||
- keycloak_archive is defined
|
||||
- keycloak_download_url is defined
|
||||
- keycloak_version is defined
|
||||
quiet: true
|
||||
|
||||
- name: Check for an existing deployment
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_jboss_home }}"
|
||||
register: keycloak_existing_deploy
|
||||
|
||||
- name: Stop and restart if existing deployment exists and install forced
|
||||
when: keycloak_existing_deploy.stat.exists and keycloak_force_install | bool
|
||||
block:
|
||||
- name: "Stop the old service: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
failed_when: false
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
state: stopped
|
||||
- name: "Remove the old deployment: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak_jboss_home }}"
|
||||
state: absent
|
||||
|
||||
- name: Check for an existing deployment after possible forced removal
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_jboss_home }}"
|
||||
|
||||
- name: "Create service user/group for {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.user:
|
||||
name: "{{ keycloak_service_user }}"
|
||||
home: /opt/keycloak
|
||||
system: true
|
||||
create_home: false
|
||||
|
||||
- name: "Create install location for {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
dest: "{{ keycloak_dest }}"
|
||||
state: directory
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0750'
|
||||
|
||||
- name: Create pidfile folder
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
dest: "{{ keycloak_service_pidfile | dirname }}"
|
||||
state: directory
|
||||
owner: "{{ keycloak_service_user if keycloak_service_runas else omit }}"
|
||||
group: "{{ keycloak_service_group if keycloak_service_runas else omit }}"
|
||||
mode: '0750'
|
||||
|
||||
## check remote archive
|
||||
- name: Set download archive path
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_archive_full_path: "{{ keycloak_dest }}/{{ keycloak_archive }}"
|
||||
|
||||
- name: Check download archive path
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_archive_full_path }}"
|
||||
register: keycloak_archive_path
|
||||
|
||||
## download to controller
|
||||
- name: Check local download archive path
|
||||
ansible.builtin.stat:
|
||||
path: "{{ lookup('env', 'PWD') }}"
|
||||
register: keycloak_local_path
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Download keycloak archive
|
||||
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
|
||||
url: "{{ keycloak_download_url }}"
|
||||
dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
|
||||
mode: '0644'
|
||||
url_username: "{{ keycloak_binary_download_user | default(omit) }}"
|
||||
url_password: "{{ keycloak_binary_download_pass | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_archive_path is defined
|
||||
- keycloak_archive_path.stat is defined
|
||||
- not keycloak_archive_path.stat.exists
|
||||
- not sso_enable is defined or not sso_enable
|
||||
- not keycloak_offline_install
|
||||
|
||||
- name: Perform download from RHN using Unified Downloads API
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_archive_path is defined
|
||||
- keycloak_archive_path.stat is defined
|
||||
- not keycloak_archive_path.stat.exists
|
||||
- sso_enable is defined and sso_enable
|
||||
- not keycloak_offline_install
|
||||
block:
|
||||
- name: Retrieve product download using Unified Downloads API
|
||||
middleware_automation.common.product_search:
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_type: DISTRIBUTION
|
||||
product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
|
||||
product_category: "{{ sso_product_category }}"
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
register: keycloak_rhn_products
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Determine install zipfile from search results
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_rhn_filtered_products: >-
|
||||
{{ keycloak_rhn_products.results
|
||||
| selectattr('file_name', 'search', 'rh-sso-' + sso_version + '-server-dist.zip$')
|
||||
| list }}
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Download Red Hat Single Sign-On
|
||||
middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_id: "{{ (keycloak_rhn_filtered_products | first).id }}"
|
||||
dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Download rhsso archive from alternate location
|
||||
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
|
||||
url: "{{ keycloak_rhsso_download_url }}"
|
||||
dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
|
||||
mode: '0644'
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_archive_path is defined
|
||||
- keycloak_archive_path.stat is defined
|
||||
- not keycloak_archive_path.stat.exists
|
||||
- sso_enable is defined and sso_enable
|
||||
- not keycloak_offline_install
|
||||
- keycloak_rhsso_download_url is defined
|
||||
|
||||
- name: Check downloaded archive
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
|
||||
register: keycloak_local_archive_path
|
||||
delegate_to: localhost
|
||||
|
||||
## copy and unpack
|
||||
- name: Copy archive to target nodes
|
||||
ansible.builtin.copy:
|
||||
src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
|
||||
dest: "{{ keycloak_archive_full_path }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
register: keycloak_new_version_downloaded
|
||||
when:
|
||||
- not keycloak_archive_path.stat.exists
|
||||
- keycloak_local_archive_path.stat is defined
|
||||
- keycloak_local_archive_path.stat.exists
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Check target directory: {{ keycloak_config.home }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_config.home }}"
|
||||
register: keycloak_path_to_workdir
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Extract archive on target: {{ keycloak_service_desc }}"
|
||||
ansible.builtin.unarchive:
|
||||
remote_src: true
|
||||
src: "{{ keycloak_archive_full_path }}"
|
||||
dest: "{{ keycloak_dest }}"
|
||||
creates: "{{ keycloak_config.home }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
when:
|
||||
- keycloak_new_version_downloaded.changed or not keycloak_path_to_workdir.stat.exists
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: Inform decompression was not executed
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ keycloak_config.home }} already exists and version unchanged, skipping decompression"
|
||||
when:
|
||||
- not keycloak_new_version_downloaded.changed and keycloak_path_to_workdir.stat.exists
|
||||
|
||||
- name: "Reown installation directory to {{ keycloak_service_user }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak_config.home }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
recurse: true
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
changed_when: false
|
||||
|
||||
- name: Ensure permissions are correct on existing deploy
|
||||
ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak_config.home }}"
|
||||
when: keycloak_service_runas
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
changed_when: false
|
||||
|
||||
# driver and configuration
|
||||
- name: "Install database driver: {{ keycloak_jdbc_engine }}"
|
||||
ansible.builtin.include_tasks: jdbc_driver.yml
|
||||
when: keycloak_jdbc[keycloak_jdbc_engine].enabled
|
||||
|
||||
- name: "Deploy custom config: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: "templates/{{ keycloak_config_override_template }}"
|
||||
dest: "{{ keycloak_config_path_to_standalone_xml }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
notify:
|
||||
- restart keycloak
|
||||
when: (keycloak_config_override_template | default('', true)) | length > 0
|
||||
|
||||
- name: "Deploy standalone config: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: templates/standalone.xml.j2
|
||||
dest: "{{ keycloak_config_path_to_standalone_xml }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
notify:
|
||||
- restart keycloak
|
||||
when:
|
||||
- not keycloak_ha_enabled
|
||||
- (keycloak_config_override_template | default('', true)) | length == 0
|
||||
|
||||
- name: Create tcpping cluster node list
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_cluster_nodes: >
|
||||
{{ keycloak_cluster_nodes | default([]) + [
|
||||
{
|
||||
"name": item,
|
||||
"address": 'jgroups-' + item,
|
||||
"inventory_host": hostvars[item].ansible_default_ipv4.address | default(item) + '[' + (keycloak_jgroups_port | string) + ']',
|
||||
"value": hostvars[item].ansible_default_ipv4.address | default(item)
|
||||
}
|
||||
] }}
|
||||
loop: "{{ ansible_play_batch }}"
|
||||
when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING'
|
||||
|
||||
- name: "Deploy HA config: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: templates/standalone-ha.xml.j2
|
||||
dest: "{{ keycloak_config_path_to_standalone_xml }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
notify:
|
||||
- restart keycloak
|
||||
when:
|
||||
- keycloak_ha_enabled
|
||||
- not keycloak_remote_cache_enabled
|
||||
- (keycloak_config_override_template | default('', true)) | length == 0
|
||||
|
||||
- name: "Deploy HA config with infinispan: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: templates/standalone-infinispan.xml.j2
|
||||
dest: "{{ keycloak_config_path_to_standalone_xml }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
notify:
|
||||
- restart keycloak
|
||||
when:
|
||||
- keycloak_ha_enabled
|
||||
- keycloak_remote_cache_enabled
|
||||
- (keycloak_config_override_template | default('', true)) | length == 0
|
||||
|
||||
- name: "Deploy profile.properties file to {{ keycloak_config_path_to_properties }}"
|
||||
become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak-profile.properties.j2
|
||||
dest: "{{ keycloak_config_path_to_properties }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
notify:
|
||||
- restart keycloak
|
||||
when: (keycloak_features | default([], true)) | length > 0
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
- name: Ensure required package iptables are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list:
|
||||
- iptables
|
||||
|
||||
- name: "Configure firewall ports for {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_iptables_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.iptables:
|
||||
destination_port: "{{ item }}"
|
||||
action: "insert"
|
||||
rule_num: 6 # magic number I forget why
|
||||
chain: "INPUT"
|
||||
policy: "ACCEPT"
|
||||
protocol: tcp
|
||||
loop:
|
||||
- "{{ keycloak_http_port }}"
|
||||
- "{{ keycloak_https_port }}"
|
||||
- "{{ keycloak_management_http_port }}"
|
||||
- "{{ keycloak_management_https_port }}"
|
||||
- "{{ keycloak_jgroups_port }}"
|
||||
- "{{ keycloak_ajp_port }}"
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
---
|
||||
- name: "Check module directory: {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
|
||||
register: keycloak_dest_path
|
||||
become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Set up module dir for JDBC Driver {{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}"
|
||||
state: directory
|
||||
recurse: true
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0750'
|
||||
become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
|
||||
when:
|
||||
- not dest_path.stat.exists
|
||||
- name: "Verify valid parameters for download credentials when specified"
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
When JDBC driver download credentials are set, both the username and the password MUST be set
|
||||
when: >
|
||||
(keycloak_jdbc_download_user is undefined and keycloak_jdbc_download_pass is not undefined) or
|
||||
(keycloak_jdbc_download_pass is undefined and keycloak_jdbc_download_user is not undefined)
|
||||
|
||||
- name: "Retrieve JDBC Driver from {{ keycloak_jdbc[keycloak_jdbc_engine].driver_jar_url }}"
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_jar_url }}"
|
||||
dest: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}/{{ keycloak_jdbc[keycloak_jdbc_engine].driver_jar_filename }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
url_username: "{{ keycloak_jdbc_download_user | default(omit) }}"
|
||||
url_password: "{{ keycloak_jdbc_download_pass | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_jdbc_download_validate_certs | default(omit) }}"
|
||||
mode: '0640'
|
||||
become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Deploy module.xml for JDBC Driver"
|
||||
ansible.builtin.template:
|
||||
src: "templates/jdbc_driver_module.xml.j2"
|
||||
dest: "{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_dir }}/module.xml"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
mode: '0640'
|
||||
become: "{{ keycloak_jdbc_driver_require_privilege_escalation | default(true) }}"
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
---
|
||||
# tasks file for keycloak
|
||||
- name: Check prerequisites
|
||||
ansible.builtin.include_tasks:
|
||||
file: prereqs.yml
|
||||
apply:
|
||||
tags:
|
||||
- prereqs
|
||||
tags:
|
||||
- prereqs
|
||||
|
||||
- name: Distro specific tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ ansible_os_family | lower }}.yml"
|
||||
apply:
|
||||
tags:
|
||||
- unbound
|
||||
tags:
|
||||
- unbound
|
||||
|
||||
- name: Include install tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: install.yml
|
||||
apply:
|
||||
tags:
|
||||
- install
|
||||
tags:
|
||||
- install
|
||||
|
||||
- name: Include systemd tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: systemd.yml
|
||||
apply:
|
||||
tags:
|
||||
- systemd
|
||||
tags:
|
||||
- systemd
|
||||
|
||||
- name: Include patch install tasks
|
||||
ansible.builtin.include_tasks: rhsso_patch.yml
|
||||
when:
|
||||
- sso_apply_patches is defined and sso_apply_patches
|
||||
- sso_enable is defined and sso_enable
|
||||
- ansible_facts.os_family == "RedHat"
|
||||
tags:
|
||||
- install
|
||||
- patch
|
||||
|
||||
- name: Link default logs directory
|
||||
ansible.builtin.file:
|
||||
state: link
|
||||
src: "{{ keycloak_jboss_home }}/standalone/log"
|
||||
dest: "{{ keycloak_log_target }}"
|
||||
become: "{{ keycloak_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: Set admin credentials and restart if not already created
|
||||
block:
|
||||
- name: Check admin credentials by generating a token (supposed to fail on first installation)
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_url }}/auth/realms/master/protocol/openid-connect/token"
|
||||
method: POST
|
||||
body: "client_id={{ keycloak_auth_client }}&username={{ keycloak_admin_user }}&password={{ keycloak_admin_password }}&grant_type=password"
|
||||
validate_certs: "{{ keycloak_validate_certs | default(omit) }}"
|
||||
register: keycloak_auth_response
|
||||
until: keycloak_auth_response.status == 200
|
||||
retries: 2
|
||||
delay: 2
|
||||
rescue:
|
||||
- name: "Create admin user: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.command:
|
||||
args:
|
||||
argv:
|
||||
- "{{ keycloak_jboss_home }}/bin/add-user-keycloak.sh"
|
||||
- "-rmaster"
|
||||
- "-u{{ keycloak_admin_user }}"
|
||||
- "-p{{ keycloak_admin_password }}"
|
||||
changed_when: true
|
||||
become: "{{ keycloak_require_privilege_escalation | default(true) }}"
|
||||
- name: "Restart service: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.include_tasks: tasks/restart_keycloak.yml
|
||||
- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_config.health_url }}"
|
||||
validate_certs: "{{ keycloak_validate_certs | default(omit) }}"
|
||||
register: keycloak_status
|
||||
until: keycloak_status.status == 200
|
||||
retries: 25
|
||||
delay: 10
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
---
|
||||
- name: Validate admin console password
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (keycloak_admin_password | default('', true)) | length > 12
|
||||
quiet: true
|
||||
fail_msg: >
|
||||
The console administrator password is empty or invalid. Please set the keycloak_admin_password variable to a 12+ char long string
|
||||
success_msg: "{{ 'Console administrator password OK' }}"
|
||||
|
||||
- name: Validate configuration
|
||||
ansible.builtin.assert:
|
||||
that: >
|
||||
(keycloak_ha_enabled and keycloak_db_enabled) or
|
||||
(not keycloak_ha_enabled and keycloak_db_enabled) or
|
||||
(not keycloak_ha_enabled and not keycloak_db_enabled)
|
||||
quiet: true
|
||||
fail_msg: "Cannot install HA setup without a backend database service. Check keycloak_ha_enabled and keycloak_db_enabled"
|
||||
success_msg: "{{ 'Configuring HA' if keycloak_ha_enabled else 'Configuring standalone' }}"
|
||||
|
||||
- name: Validate credentials
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (rhn_username is defined and sso_enable is defined and sso_enable) or not sso_enable is defined or not sso_enable or keycloak_offline_install
|
||||
- (rhn_password is defined and sso_enable is defined and sso_enable) or not sso_enable is defined or not sso_enable or keycloak_offline_install
|
||||
quiet: true
|
||||
fail_msg: "Cannot install Red Hat SSO without RHN credentials. Check rhn_username and rhn_password are defined"
|
||||
success_msg: "Installing {{ keycloak_service_desc }}"
|
||||
|
||||
- name: Validate persistence configuration
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_jdbc_engine is defined and keycloak_jdbc_engine in [ 'postgres', 'mariadb', 'sqlserver' ]
|
||||
- (keycloak_jdbc_url | default('', true)) | length > 0
|
||||
- (keycloak_db_user | default('', true)) | length > 0
|
||||
- (keycloak_db_pass | default('', true)) | length > 0
|
||||
quiet: true
|
||||
fail_msg: "Configuration for the JDBC persistence is invalid or incomplete"
|
||||
success_msg: "Configuring JDBC persistence using {{ keycloak_jdbc_engine }} database"
|
||||
when: keycloak_db_enabled
|
||||
|
||||
- name: Validate OS family
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_os_family in ["RedHat", "Debian"]
|
||||
quiet: true
|
||||
fail_msg: "Can only install on RedHat or Debian OS families; found {{ ansible_os_family }}"
|
||||
success_msg: "Installing on {{ ansible_os_family }}"
|
||||
|
||||
- name: Load OS specific variables
|
||||
ansible.builtin.include_vars: "vars/{{ ansible_os_family | lower }}.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Ensure required packages are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list: "{{ keycloak_prereq_package_list }}"
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
- name: Include firewall config tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: firewalld.yml
|
||||
apply:
|
||||
tags:
|
||||
- firewall
|
||||
when: keycloak_configure_firewalld
|
||||
tags:
|
||||
- firewall
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
- name: "Restart and enable service: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
enabled: true
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
become: "{{ keycloak_restart_require_privilege_escalation | default(true) }}"
|
||||
delegate_to: "{{ ansible_play_hosts | first }}"
|
||||
run_once: true
|
||||
|
||||
- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_config.health_url }}"
|
||||
validate_certs: "{{ keycloak_validate_certs | default(omit) }}"
|
||||
register: keycloak_status
|
||||
until: keycloak_status.status == 200
|
||||
delegate_to: "{{ ansible_play_hosts | first }}"
|
||||
run_once: true
|
||||
retries: "{{ keycloak_service_start_retries }}"
|
||||
delay: "{{ keycloak_service_start_delay }}"
|
||||
|
||||
- name: "Restart and enable service (remaining nodes): {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
enabled: true
|
||||
state: restarted
|
||||
become: "{{ keycloak_restart_require_privilege_escalation | default(true) }}"
|
||||
when: inventory_hostname != ansible_play_hosts | first
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
- name: Ensure required params for CLI have been provided
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- cli_query is defined
|
||||
fail_msg: "Missing required parameters to execute CLI."
|
||||
quiet: true
|
||||
|
||||
- name: "Execute CLI query: {{ cli_query }}"
|
||||
ansible.builtin.command: >
|
||||
{{ keycloak_config.cli_path }} --connect --command='{{ cli_query }}' --controller={{ keycloak_host }}:{{ keycloak_management_http_port }}
|
||||
changed_when: false
|
||||
register: keycloak_cli_result
|
||||
|
|
@ -0,0 +1,174 @@
|
|||
---
|
||||
## check remote patch archive
|
||||
- name: Set download patch archive path
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_patch_archive: "{{ keycloak_dest }}/{{ sso_patch_bundle }}"
|
||||
keycloak_patch_bundle: "{{ sso_patch_bundle }}"
|
||||
keycloak_patch_version: "{{ sso_patch_version }}"
|
||||
when: sso_patch_version is defined
|
||||
|
||||
- name: Check download patch archive path
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_patch_archive }}"
|
||||
register: keycloak_patch_archive_path
|
||||
when: sso_patch_version is defined
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: Perform patch download from RHN via Unified Downloads API
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- sso_enable is defined and sso_enable
|
||||
- not keycloak_offline_install
|
||||
- sso_apply_patches
|
||||
block:
|
||||
- name: Retrieve product download using Unified Downloads API
|
||||
middleware_automation.common.product_search:
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_type: BUGFIX
|
||||
product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
|
||||
product_category: "{{ sso_product_category }}"
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
register: keycloak_rhn_products
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Determine patch versions list
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_filtered_versions: "{{ keycloak_rhn_products.results | map(attribute='file_name') | \
|
||||
select('match', '^[^/]*/rh-sso-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | \
|
||||
map('regex_replace', '[^/]*/rh-sso-([0-9]*[.][0-9]*[.][0-9]*(-[0-9])?)-.*', '\\1') | list | unique }}"
|
||||
when: (sso_patch_version | default('', true)) | length == 0
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Determine latest version
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_sso_latest_version: "{{ keycloak_filtered_versions | middleware_automation.common.version_sort | last }}"
|
||||
when: (sso_patch_version | default('', true)) | length == 0
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Determine install zipfile from search results
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/rh-sso-' + keycloak_sso_latest_version + '-patch.zip$') }}"
|
||||
keycloak_patch_bundle: "rh-sso-{{ keycloak_sso_latest_version }}-patch.zip"
|
||||
keycloak_patch_version: "{{ keycloak_sso_latest_version }}"
|
||||
when: (sso_patch_version | default('', true)) | length == 0
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: "Determine selected patch from supplied version: {{ sso_patch_version }}"
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_rhn_filtered_products: "{{ keycloak_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + sso_patch_bundle + '$') }}"
|
||||
keycloak_patch_bundle: "{{ sso_patch_bundle }}"
|
||||
keycloak_patch_version: "{{ sso_patch_version }}"
|
||||
when: sso_patch_version is defined
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Download Red Hat Single Sign-On patch
|
||||
middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_id: "{{ (keycloak_rhn_filtered_products | sort | last).id }}"
|
||||
dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
|
||||
validate_certs: "{{ keycloak_download_validate_certs | default(omit) }}"
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Set download patch archive path
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_patch_archive: "{{ keycloak_dest }}/{{ keycloak_patch_bundle }}"
|
||||
|
||||
- name: Check download patch archive path
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_patch_archive }}"
|
||||
register: keycloak_patch_archive_path
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
|
||||
## copy and unpack
|
||||
- name: Copy patch archive to target nodes
|
||||
ansible.builtin.copy:
|
||||
src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_patch_bundle }}"
|
||||
dest: "{{ keycloak_patch_archive }}"
|
||||
owner: "{{ keycloak_service_user }}"
|
||||
group: "{{ keycloak_service_group }}"
|
||||
mode: '0640'
|
||||
register: keycloak_new_version_downloaded
|
||||
when:
|
||||
- not keycloak_patch_archive_path.stat.exists
|
||||
- keycloak_local_archive_path.stat is defined
|
||||
- keycloak_local_archive_path.stat.exists
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Check installed patches"
|
||||
ansible.builtin.include_tasks: rhsso_cli.yml
|
||||
vars:
|
||||
cli_query: "patch info"
|
||||
args:
|
||||
apply:
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
become_user: "{{ keycloak_service_user }}"
|
||||
|
||||
- name: "Perform patching"
|
||||
when:
|
||||
- keycloak_cli_result is defined
|
||||
- keycloak_cli_result.stdout is defined
|
||||
- keycloak_patch_version | regex_replace('-[0-9]$', '') not in keycloak_cli_result.stdout
|
||||
block:
|
||||
- name: "Apply patch to server: {{ keycloak_patch_version }}"
|
||||
ansible.builtin.include_tasks: rhsso_cli.yml
|
||||
vars:
|
||||
cli_query: "patch apply {{ keycloak_patch_archive }}"
|
||||
args:
|
||||
apply:
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
become_user: "{{ keycloak_service_user }}"
|
||||
|
||||
- name: "Restart server to ensure patch content is running"
|
||||
ansible.builtin.include_tasks: rhsso_cli.yml
|
||||
vars:
|
||||
cli_query: "shutdown --restart"
|
||||
when:
|
||||
- keycloak_cli_result.rc == 0
|
||||
args:
|
||||
apply:
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
become_user: "{{ keycloak_service_user }}"
|
||||
|
||||
- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_config.health_url }}"
|
||||
validate_certs: "{{ keycloak_validate_certs | default(omit) }}"
|
||||
register: keycloak_status
|
||||
until: keycloak_status.status == 200
|
||||
retries: 25
|
||||
delay: 10
|
||||
|
||||
- name: "Query installed patch after restart"
|
||||
ansible.builtin.include_tasks: rhsso_cli.yml
|
||||
vars:
|
||||
cli_query: "patch info"
|
||||
args:
|
||||
apply:
|
||||
become: "{{ keycloak_rhsso_patch_require_privilege_escalation | default(true) }}"
|
||||
become_user: "{{ keycloak_service_user }}"
|
||||
|
||||
- name: "Verify installed patch version"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_patch_version not in keycloak_cli_result.stdout
|
||||
fail_msg: "Patch installation failed"
|
||||
success_msg: "Patch installation successful"
|
||||
|
||||
- name: "Skipping patch"
|
||||
ansible.builtin.debug:
|
||||
msg: "Cumulative patch {{ keycloak_patch_version }} already installed, skipping patch installation."
|
||||
when:
|
||||
- keycloak_cli_result is defined
|
||||
- keycloak_cli_result.stdout is defined
|
||||
- keycloak_patch_version in keycloak_cli_result.stdout
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
- name: "Start service: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
become: "{{ keycloak_start_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Wait until service becomes active: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_config.health_url }}"
|
||||
validate_certs: "{{ keycloak_validate_certs | default(omit) }}"
|
||||
register: keycloak_status
|
||||
until: keycloak_status.status == 200
|
||||
retries: "{{ keycloak_service_start_retries }}"
|
||||
delay: "{{ keycloak_service_start_delay }}"
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
- name: "Stop {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
enabled: true
|
||||
state: stopped
|
||||
become: "{{ keycloak_stop_require_privilege_escalation | default(true) }}"
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
- name: "Configure service script wrapper: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak-service.sh.j2
|
||||
dest: "{{ keycloak_dest }}/keycloak-service.sh"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: "Configure sysconfig file for service: {{ keycloak_config.service_name }}"
|
||||
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak-sysconfig.j2
|
||||
dest: "{{ keycloak_sysconf_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: "Configure systemd unit file for service: {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak.service.j2
|
||||
dest: /etc/systemd/system/keycloak.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: "{{ keycloak_systemd_require_privilege_escalation | default(true) }}"
|
||||
register: keycloak_systemdunit
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: "Start and wait for service (first node db): {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.include_tasks: start_keycloak.yml
|
||||
run_once: true
|
||||
when: keycloak_db_enabled
|
||||
|
||||
- name: "Start and wait for service (remaining nodes): {{ keycloak_config.service_name }}"
|
||||
ansible.builtin.include_tasks: start_keycloak.yml
|
||||
|
||||
- name: Check service status
|
||||
ansible.builtin.command: "systemctl status keycloak"
|
||||
register: keycloak_service_status
|
||||
changed_when: false
|
||||
|
||||
- name: Verify service status
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_service_status is defined
|
||||
- keycloak_service_status.stdout is defined
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
|
@ -0,0 +1,761 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
{{ ansible_managed | comment('xml') }}
|
||||
<server xmlns="urn:jboss:domain:16.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.clustering.jgroups"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.security"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.health"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.metrics"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<security-realms>
|
||||
<security-realm name="ManagementRealm">
|
||||
<authentication>
|
||||
<local default-user="$local" skip-group-loading="true"/>
|
||||
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization map-groups-to-roles="false">
|
||||
<properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
<security-realm name="ApplicationRealm">
|
||||
<server-identities>
|
||||
<ssl>
|
||||
<keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/>
|
||||
</ssl>
|
||||
</server-identities>
|
||||
<authentication>
|
||||
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
|
||||
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization>
|
||||
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
</security-realms>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface security-realm="ManagementRealm">
|
||||
<http-upgrade enabled="true"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.cluster.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.connections.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.cache.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.sessions.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:6.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<connection-url>{{ keycloak_jdbc[keycloak_jdbc_engine].connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc[keycloak_jdbc_engine].db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc[keycloak_jdbc_engine].db_password }}</password>
|
||||
</security>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<driver name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" module="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<driver-class>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_class }}</driver-class>
|
||||
<xa-datasource-class>{{ keycloak_jdbc[keycloak_jdbc_engine].xa_datasource_class }}</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:6.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="distributable" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connectors="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:health:1.0" security-enabled="false"/>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:12.0">
|
||||
<cache-container name="ejb" default-cache="dist" aliases="sfsb" modules="org.wildfly.clustering.ejb.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak" modules="org.keycloak.keycloak-model-infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="realms">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
{% for cachename in [ "sessions", "offlineSessions", "clientSessions", "offlineClientSessions", "loginFailures", "actionTokens", "authenticationSessions" ] %}
|
||||
<distributed-cache name="{{ cachename }}">
|
||||
<remote-store cache="{{ cachename }}"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">{{ keycloak_remotecache.use_ssl }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</distributed-cache>
|
||||
{% endfor %}
|
||||
<replicated-cache name="work">
|
||||
<remote-store cache="work"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">{{ keycloak_remotecache.use_ssl }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</replicated-cache>
|
||||
<local-cache name="authorization">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<heap-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" aliases="singleton cluster" modules="org.wildfly.clustering.server">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="dist" modules="org.wildfly.clustering.web.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" modules="org.infinispan.hibernate-cache">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="local-query">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<invalidation-cache name="entity">
|
||||
<transaction mode="NON_XA"/>
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</invalidation-cache>
|
||||
<replicated-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:2.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jgroups:8.0">
|
||||
<channels default="ee">
|
||||
<channel name="ee" stack="tcp" cluster="ejb"/>
|
||||
</channels>
|
||||
<stacks>
|
||||
<stack name="tcp">
|
||||
<transport site="${jboss.node.name}" type="TCP" socket-binding="jgroups-tcp"/>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<protocol type="JDBC_PING">
|
||||
<property name="datasource_jndi_name">java:jboss/datasources/KeycloakDS</property>
|
||||
<property name="initialize_sql">{{ keycloak_jdbc[keycloak_jdbc_engine].initialize_db }}</property>
|
||||
<property name="insert_single_sql">INSERT INTO JGROUPSPING (own_addr, cluster_name, ping_data) values (?, ?, ?)</property>
|
||||
<property name="delete_single_sql">DELETE FROM JGROUPSPING WHERE own_addr=? AND cluster_name=?</property>
|
||||
<property name="select_all_pingdata_sql">SELECT ping_data FROM JGROUPSPING WHERE cluster_name=?</property>
|
||||
</protocol>
|
||||
{% endif %}
|
||||
<protocol type="MERGE3"/>
|
||||
<protocol type="FD_SOCK"/>
|
||||
<protocol type="FD_ALL"/>
|
||||
<protocol type="VERIFY_SUSPECT"/>
|
||||
<protocol type="pbcast.NAKACK2"/>
|
||||
<protocol type="UNICAST3"/>
|
||||
<protocol type="pbcast.STABLE"/>
|
||||
<protocol type="pbcast.GMS">
|
||||
<property name="join_timeout">30000</property>
|
||||
</protocol>
|
||||
<protocol type="MFC"/>
|
||||
<protocol type="FRAG2"/>
|
||||
</stack>
|
||||
</stacks>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
{% if keycloak_ha_enabled %}
|
||||
<spi name="dblock">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="lockWaitTimeout" value="900"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
{% endif %}
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="true"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:4.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise="false" listener="ajp" proxies="proxy1">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security:2.0">
|
||||
<security-domains>
|
||||
<security-domain name="other" cache-type="default">
|
||||
<authentication>
|
||||
<login-module code="Remoting" flag="optional">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
<login-module code="RealmDirect" flag="required">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
</authentication>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-web-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
<security-domain name="jaspitest" cache-type="default">
|
||||
<authentication-jaspi>
|
||||
<login-module-stack name="dummy">
|
||||
<login-module code="Dummy" flag="optional"/>
|
||||
</login-module-stack>
|
||||
<auth-module code="Dummy"/>
|
||||
</authentication-jaspi>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-ejb-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:6.0">
|
||||
<core-environment node-identifier="{{ inventory_hostname | default('${jboss.tx.node.id:1}') }}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>
|
||||
<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker security-realm="ApplicationRealm"/>
|
||||
<filter-ref name="proxy-peer"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
<filters>
|
||||
<filter name="proxy-peer" module="io.undertow.core"
|
||||
class-name="io.undertow.server.handlers.ProxyPeerAddressHandler"/>
|
||||
</filters>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="{{ keycloak_management_port_bind_address }}"/>
|
||||
</interface>
|
||||
<interface name="jgroups">
|
||||
{% if ansible_default_ipv4 is defined %}
|
||||
<subnet-match value="{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') }}"/>
|
||||
{% else %}
|
||||
<any-address />
|
||||
{% endif %}
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="{{ keycloak_bind_address }}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="{{ keycloak_ajp_port }}"/>
|
||||
<socket-binding name="http" port="{{ keycloak_http_port }}"/>
|
||||
<socket-binding name="https" port="{{ keycloak_https_port }}"/>
|
||||
<socket-binding name="management-http" interface="management" port="{{ keycloak_management_http_port }}"/>
|
||||
<socket-binding name="management-https" interface="management" port="{{ keycloak_management_https_port }}"/>
|
||||
<socket-binding name="jgroups-tcp" interface="jgroups" port="{{ keycloak_jgroups_port }}"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<outbound-socket-binding name="proxy1">
|
||||
<remote-destination host="{{ keycloak_modcluster.reverse_proxy_url | default('localhost') }}" port="6666"/>
|
||||
</outbound-socket-binding>
|
||||
{% endif %}
|
||||
<outbound-socket-binding name="remote-cache">
|
||||
<remote-destination host="{{ keycloak_remotecache.server_name | default('localhost') }}" port="${remote.cache.port:11222}"/>
|
||||
</outbound-socket-binding>
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,658 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
{{ ansible_managed | comment('xml') }}
|
||||
<server xmlns="urn:jboss:domain:16.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.security"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.health"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.metrics"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<security-realms>
|
||||
<security-realm name="ManagementRealm">
|
||||
<authentication>
|
||||
<local default-user="$local" skip-group-loading="true"/>
|
||||
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization map-groups-to-roles="false">
|
||||
<properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
<security-realm name="ApplicationRealm">
|
||||
<server-identities>
|
||||
<ssl>
|
||||
<keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/>
|
||||
</ssl>
|
||||
</server-identities>
|
||||
<authentication>
|
||||
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
|
||||
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization>
|
||||
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
</security-realms>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface security-realm="ManagementRealm">
|
||||
<http-upgrade enabled="true"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:6.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<connection-url>{{ keycloak_jdbc[keycloak_jdbc_engine].connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc[keycloak_jdbc_engine].db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc[keycloak_jdbc_engine].db_password }}</password>
|
||||
</security>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<driver name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" module="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<driver-class>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_class }}</driver-class>
|
||||
<xa-datasource-class>{{ keycloak_jdbc[keycloak_jdbc_engine].xa_datasource_class }}</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:6.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="simple" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connectors="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:health:1.0" security-enabled="false"/>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:12.0">
|
||||
<cache-container name="ejb" default-cache="passivation" aliases="sfsb" modules="org.wildfly.clustering.ejb.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak" modules="org.keycloak.keycloak-model-infinispan">
|
||||
<local-cache name="realms">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="sessions"/>
|
||||
<local-cache name="authenticationSessions"/>
|
||||
<local-cache name="offlineSessions"/>
|
||||
<local-cache name="clientSessions"/>
|
||||
<local-cache name="offlineClientSessions"/>
|
||||
<local-cache name="loginFailures"/>
|
||||
<local-cache name="work"/>
|
||||
<local-cache name="authorization">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<heap-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
<local-cache name="actionTokens">
|
||||
<heap-memory size="-1"/>
|
||||
<expiration interval="300000" max-idle="-1"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" modules="org.wildfly.clustering.server">
|
||||
<local-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="passivation" modules="org.wildfly.clustering.web.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
<local-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
<local-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" modules="org.infinispan.hibernate-cache">
|
||||
<local-cache name="entity">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="local-query">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:2.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
{% if keycloak_ha_enabled %}
|
||||
<spi name="dblock">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="lockWaitTimeout" value="900"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
{% endif %}
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="true"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:4.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise="false" listener="ajp" proxies="proxy1">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security:2.0">
|
||||
<security-domains>
|
||||
<security-domain name="other" cache-type="default">
|
||||
<authentication>
|
||||
<login-module code="Remoting" flag="optional">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
<login-module code="RealmDirect" flag="required">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
</authentication>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-web-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
<security-domain name="jaspitest" cache-type="default">
|
||||
<authentication-jaspi>
|
||||
<login-module-stack name="dummy">
|
||||
<login-module code="Dummy" flag="optional"/>
|
||||
</login-module-stack>
|
||||
<auth-module code="Dummy"/>
|
||||
</authentication-jaspi>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-ejb-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:6.0">
|
||||
<core-environment node-identifier="${jboss.tx.node.id:1}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
|
||||
<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker security-realm="ApplicationRealm"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="{{ keycloak_management_port_bind_address }}"/>
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="{{ keycloak_bind_address }}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="{{ keycloak_ajp_port }}"/>
|
||||
<socket-binding name="http" port="{{ keycloak_http_port }}"/>
|
||||
<socket-binding name="https" port="{{ keycloak_https_port }}"/>
|
||||
<socket-binding name="management-http" interface="management" port="{{ keycloak_management_http_port }}"/>
|
||||
<socket-binding name="management-https" interface="management" port="{{ keycloak_management_https_port }}"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<outbound-socket-binding name="proxy1">
|
||||
<remote-destination host="{{ keycloak_modcluster.reverse_proxy_url | default('localhost') }}" port="6666"/>
|
||||
</outbound-socket-binding>
|
||||
{% endif %}
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,759 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
|
||||
<server xmlns="urn:jboss:domain:10.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.clustering.jgroups"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.security"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.microprofile.config-smallrye"/>
|
||||
<extension module="org.wildfly.extension.microprofile.health-smallrye"/>
|
||||
<extension module="org.wildfly.extension.microprofile.metrics-smallrye"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<security-realms>
|
||||
<security-realm name="ManagementRealm">
|
||||
<authentication>
|
||||
<local default-user="$local" skip-group-loading="true"/>
|
||||
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization map-groups-to-roles="false">
|
||||
<properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
<security-realm name="ApplicationRealm">
|
||||
<server-identities>
|
||||
<ssl>
|
||||
<keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password"
|
||||
alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/>
|
||||
</ssl>
|
||||
</server-identities>
|
||||
<authentication>
|
||||
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
|
||||
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization>
|
||||
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
</security-realms>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface security-realm="ManagementRealm">
|
||||
<http-upgrade enabled="true"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.cluster.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.connections.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.cache.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.sessions.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:5.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc.postgres.enabled %}
|
||||
<connection-url>{{ keycloak_jdbc.postgres.connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc.postgres.driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc.postgres.db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc.postgres.db_password }}</password>
|
||||
</security>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc.postgres.enabled %}
|
||||
<driver name="{{ keycloak_jdbc.postgres.driver_module_name }}" module="{{ keycloak_jdbc.postgres.driver_module_name }}">
|
||||
<driver-class>org.postgresql.Driver</driver-class>
|
||||
<xa-datasource-class>org.postgresql.xa.PGXADataSource</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:4.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS"
|
||||
managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default"
|
||||
managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:6.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="simple" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connector-ref="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:8.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:9.0">
|
||||
<cache-container name="ejb" default-cache="passivation" aliases="sfsb" module="org.wildfly.clustering.ejb.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak" module="org.keycloak.keycloak-model-infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="realms">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="authenticationSessions"/>
|
||||
{% for cachename in [ "sessions", "offlineSessions", "clientSessions", "offlineClientSessions", "loginFailures", "actionTokens" ] %}
|
||||
<distributed-cache name="{{ cachename }}">
|
||||
<remote-store cache="{{ cachename }}"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism | default('SCRAM-SHA-512') }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">false</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path | default('/etc/truststore/truststore.jks') }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password | default("changeme") }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</distributed-cache>
|
||||
{% endfor %}
|
||||
<replicated-cache name="work">
|
||||
<remote-store cache="work"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism | default('SCRAM-SHA-512') }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">false</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path | default('/etc/truststore/truststore.jks') }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password | default("changeme") }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</replicated-cache>
|
||||
<local-cache name="authorization">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<object-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" module="org.wildfly.clustering.server">
|
||||
<local-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="passivation" module="org.wildfly.clustering.web.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
<local-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
<local-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" module="org.infinispan.hibernate-cache">
|
||||
<local-cache name="entity">
|
||||
<object-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="local-query">
|
||||
<object-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jgroups:7.0">
|
||||
<channels default="ee">
|
||||
<channel name="ee" stack="tcp" cluster="ejb"/>
|
||||
</channels>
|
||||
<stacks>
|
||||
<stack name="tcp">
|
||||
<transport site="${jboss.node.name}" type="TCP" socket-binding="jgroups-tcp"/>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<protocol type="JDBC_PING">
|
||||
<property name="datasource_jndi_name">java:jboss/datasources/KeycloakDS</property>
|
||||
<property name="initialize_sql">{{ keycloak_jdbc[keycloak_jdbc_engine].initialize_db }}</property>
|
||||
<property name="insert_single_sql">INSERT INTO JGROUPSPING (own_addr, cluster_name, ping_data) values (?, ?, ?)</property>
|
||||
<property name="delete_single_sql">DELETE FROM JGROUPSPING WHERE own_addr=? AND cluster_name=?</property>
|
||||
<property name="select_all_pingdata_sql">SELECT ping_data FROM JGROUPSPING WHERE cluster_name=?</property>
|
||||
</protocol>
|
||||
{% endif %}
|
||||
<protocol type="MERGE3"/>
|
||||
<protocol type="FD_SOCK"/>
|
||||
<protocol type="FD_ALL"/>
|
||||
<protocol type="VERIFY_SUSPECT"/>
|
||||
<protocol type="pbcast.NAKACK2"/>
|
||||
<protocol type="UNICAST3"/>
|
||||
<protocol type="pbcast.STABLE"/>
|
||||
<protocol type="pbcast.GMS">
|
||||
<property name="join_timeout">30000</property>
|
||||
</protocol>
|
||||
<protocol type="MFC"/>
|
||||
<protocol type="FRAG2"/>
|
||||
</stack>
|
||||
</stacks>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-datasource="" default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="true"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:3.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise-socket="modcluster" listener="ajp" proxies="proxy1">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security:2.0">
|
||||
<security-domains>
|
||||
<security-domain name="other" cache-type="default">
|
||||
<authentication>
|
||||
<login-module code="Remoting" flag="optional">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
<login-module code="RealmDirect" flag="required">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
</authentication>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-web-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
<security-domain name="jaspitest" cache-type="default">
|
||||
<authentication-jaspi>
|
||||
<login-module-stack name="dummy">
|
||||
<login-module code="Dummy" flag="optional"/>
|
||||
</login-module-stack>
|
||||
<auth-module code="Dummy"/>
|
||||
</authentication-jaspi>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-ejb-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:5.0">
|
||||
<core-environment node-identifier="{{ inventory_hostname | default('${jboss.tx.node.id:1}') }}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:10.0" default-server="default-server" default-virtual-host="default-host"
|
||||
default-servlet-container="default" default-security-domain="other"
|
||||
statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>
|
||||
<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker security-realm="ApplicationRealm"/>
|
||||
<filter-ref name="proxy-peer"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
<filters>
|
||||
<filter name="proxy-peer" module="io.undertow.core"
|
||||
class-name="io.undertow.server.handlers.ProxyPeerAddressHandler"/>
|
||||
</filters>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-config-smallrye:1.0"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-health-smallrye:2.0" security-enabled="false"
|
||||
empty-liveness-checks-status="${env.MP_HEALTH_EMPTY_LIVENESS_CHECKS_STATUS:UP}"
|
||||
empty-readiness-checks-status="${env.MP_HEALTH_EMPTY_READINESS_CHECKS_STATUS:UP}"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-metrics-smallrye:2.0" security-enabled="false"
|
||||
exposed-subsystems="*" prefix="${wildfly.metrics.prefix:wildfly}"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
|
||||
</interface>
|
||||
<interface name="jgroups">
|
||||
{% if ansible_default_ipv4 is defined %}
|
||||
<subnet-match value="{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') }}"/>
|
||||
{% else %}
|
||||
<any-address />
|
||||
{% endif %}
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="${jboss.bind.address:127.0.0.1}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
|
||||
<socket-binding name="http" port="${jboss.http.port:8080}"/>
|
||||
<socket-binding name="https" port="${jboss.https.port:8443}"/>
|
||||
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
|
||||
<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
|
||||
<socket-binding name="jgroups-tcp" interface="jgroups" port="7600"/>
|
||||
<socket-binding name="modcluster" multicast-address="${jboss.modcluster.multicast.address:224.0.1.105}" multicast-port="23364"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<outbound-socket-binding name="proxy1">
|
||||
<remote-destination host="{{ keycloak_modcluster.reverse_proxy_url | default('localhost') }}" port="6666"/>
|
||||
</outbound-socket-binding>
|
||||
{% endif %}
|
||||
<outbound-socket-binding name="remote-cache">
|
||||
<remote-destination host="{{ keycloak_remotecache.server_name | default('localhost') }}" port="${remote.cache.port:11222}"/>
|
||||
</outbound-socket-binding>
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,619 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
|
||||
<server xmlns="urn:jboss:domain:10.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.security"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.microprofile.config-smallrye"/>
|
||||
<extension module="org.wildfly.extension.microprofile.health-smallrye"/>
|
||||
<extension module="org.wildfly.extension.microprofile.metrics-smallrye"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<security-realms>
|
||||
<security-realm name="ManagementRealm">
|
||||
<authentication>
|
||||
<local default-user="$local" skip-group-loading="true"/>
|
||||
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization map-groups-to-roles="false">
|
||||
<properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
<security-realm name="ApplicationRealm">
|
||||
<server-identities>
|
||||
<ssl>
|
||||
<keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password"
|
||||
alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/>
|
||||
</ssl>
|
||||
</server-identities>
|
||||
<authentication>
|
||||
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
|
||||
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authentication>
|
||||
<authorization>
|
||||
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</authorization>
|
||||
</security-realm>
|
||||
</security-realms>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface security-realm="ManagementRealm">
|
||||
<http-upgrade enabled="true"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:5.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<drivers>
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:4.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS"
|
||||
managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default"
|
||||
managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:6.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="simple" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote connector-ref="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:9.0">
|
||||
<cache-container name="keycloak">
|
||||
<local-cache name="realms">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="sessions"/>
|
||||
<local-cache name="authenticationSessions"/>
|
||||
<local-cache name="offlineSessions"/>
|
||||
<local-cache name="clientSessions"/>
|
||||
<local-cache name="offlineClientSessions"/>
|
||||
<local-cache name="loginFailures"/>
|
||||
<local-cache name="work"/>
|
||||
<local-cache name="authorization">
|
||||
<object-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<object-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
<local-cache name="actionTokens">
|
||||
<object-memory size="-1"/>
|
||||
<expiration max-idle="-1" interval="300000"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" module="org.wildfly.clustering.server">
|
||||
<local-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="passivation" module="org.wildfly.clustering.web.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
<local-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
<local-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="ejb" aliases="sfsb" default-cache="passivation" module="org.wildfly.clustering.ejb.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" module="org.infinispan.hibernate-cache">
|
||||
<local-cache name="entity">
|
||||
<object-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="local-query">
|
||||
<object-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-datasource="" default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:3.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise-socket="modcluster" listener="ajp" proxies="proxy1">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:8.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:security:2.0">
|
||||
<security-domains>
|
||||
<security-domain name="other" cache-type="default">
|
||||
<authentication>
|
||||
<login-module code="Remoting" flag="optional">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
<login-module code="RealmDirect" flag="required">
|
||||
<module-option name="password-stacking" value="useFirstPass"/>
|
||||
</login-module>
|
||||
</authentication>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-web-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
<security-domain name="jaspitest" cache-type="default">
|
||||
<authentication-jaspi>
|
||||
<login-module-stack name="dummy">
|
||||
<login-module code="Dummy" flag="optional"/>
|
||||
</login-module-stack>
|
||||
<auth-module code="Dummy"/>
|
||||
</authentication-jaspi>
|
||||
</security-domain>
|
||||
<security-domain name="jboss-ejb-policy" cache-type="default">
|
||||
<authorization>
|
||||
<policy-module code="Delegating" flag="required"/>
|
||||
</authorization>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:5.0">
|
||||
<core-environment node-identifier="${jboss.tx.node.id:1}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-config-smallrye:1.0"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-health-smallrye:2.0" security-enabled="false"
|
||||
empty-liveness-checks-status="${env.MP_HEALTH_EMPTY_LIVENESS_CHECKS_STATUS:UP}" empty-readiness-checks-status="${env.MP_HEALTH_EMPTY_READINESS_CHECKS_STATUS:UP}"/>
|
||||
<subsystem xmlns="urn:wildfly:microprofile-metrics-smallrye:2.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:wildfly}"/>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:10.0" default-server="default-server" default-virtual-host="default-host"
|
||||
default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
|
||||
<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker security-realm="ApplicationRealm"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>classpath:${jboss.home.dir}/providers/*</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="true"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="${jboss.bind.address:127.0.0.1}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
|
||||
<socket-binding name="http" port="${jboss.http.port:8080}"/>
|
||||
<socket-binding name="https" port="${jboss.https.port:8443}"/>
|
||||
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
|
||||
<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
|
||||
<socket-binding name="modcluster" multicast-address="${jboss.modcluster.multicast.address:224.0.1.105}" multicast-port="23364"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="localhost" port="25"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<outbound-socket-binding name="proxy1">
|
||||
<remote-destination host="{{ keycloak_modcluster.reverse_proxy_url | default('localhost') }}" port="6666"/>
|
||||
</outbound-socket-binding>
|
||||
{% endif %}
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<module xmlns="urn:jboss:module:1.0" name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<resources>
|
||||
<resource-root path="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_jar_filename }}"/>
|
||||
</resources>
|
||||
<dependencies>
|
||||
<module name="javax.api"/>
|
||||
<module name="javax.transaction.api"/>
|
||||
</dependencies>
|
||||
</module>
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{% for feature in keycloak_config.features %}
|
||||
feature.{{ feature.name }}={{ feature.status | default('enabled') }}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,127 @@
|
|||
#!/bin/bash -eu
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
set +u -o pipefail
|
||||
|
||||
checkEnvVar() {
|
||||
local envVar=${1}
|
||||
local msg=${2}
|
||||
local exitCode=${3}
|
||||
|
||||
if [ -z "${envVar}" ]; then
|
||||
echo "${msg}"
|
||||
exit "${exitCode}"
|
||||
fi
|
||||
}
|
||||
# SystemD will do for the unit, decomment
|
||||
# for testing outside systemd
|
||||
. /etc/sysconfig/keycloak
|
||||
|
||||
readonly KEYCLOAK_HOME={{ keycloak_config.home }}
|
||||
readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS}
|
||||
readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT}
|
||||
readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT}
|
||||
readonly KEYCLOAK_MANAGEMENT_HTTP_PORT=${KEYCLOAK_MANAGEMENT_HTTP_PORT}
|
||||
readonly KEYCLOAK_MANAGEMENT_HTTPS_PORT=${KEYCLOAK_MANAGEMENT_HTTPS_PORT}
|
||||
readonly KEYCLOAK_PIDFILE={{ keycloak_service_pidfile }}
|
||||
|
||||
set -u
|
||||
if [ ! -d "${KEYCLOAK_HOME}" ]; then
|
||||
echo "KEYCLOAK_HOME (${KEYCLOAK_HOME}) is not a directory or does not exists."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
checkEnvVar "${KEYCLOAK_PIDFILE}" 'KEYCLOAK_PIDFILE not provided' 2
|
||||
|
||||
getKeycloakPID() {
|
||||
|
||||
local pid
|
||||
if [ -e "${KEYCLOAK_PIDFILE}" ]; then
|
||||
cat "${KEYCLOAK_PIDFILE}"
|
||||
fi
|
||||
}
|
||||
|
||||
statusKeycloak() {
|
||||
|
||||
if [ "$(isKeyCloakRunning)" -eq 1 ]; then
|
||||
echo "Keycloak is running (PID:$(getKeycloakPID ))"
|
||||
else
|
||||
echo "Keycloak is NOT running."
|
||||
fi
|
||||
}
|
||||
|
||||
isKeyCloakRunning() {
|
||||
set +e
|
||||
local statusKeycloak=0
|
||||
local pid=$(getKeycloakPID )
|
||||
if [ -n "${pid}" ]; then
|
||||
kill -0 "${pid}" 2> /dev/null
|
||||
if [ "${?}" -eq 0 ]; then
|
||||
statusKeycloak=1
|
||||
fi
|
||||
fi
|
||||
set -e
|
||||
echo "${statusKeycloak}"
|
||||
}
|
||||
|
||||
startKeycloak() {
|
||||
checkEnvVar "${KEYCLOAK_BIND_ADDRESS}" 'KEYCLOAK_BIND_ADDRESS not provided' 2
|
||||
checkEnvVar "${KEYCLOAK_HTTP_PORT}" 'KEYCLOAK_HTTP_PORT not provided' 4
|
||||
checkEnvVar "${KEYCLOAK_HTTPS_PORT}" 'KEYCLOAK_HTTPS_PORT not provided' 5
|
||||
checkEnvVar "${KEYCLOAK_MANAGEMENT_HTTP_PORT}" 'KEYCLOAK_MANAGEMENT_HTTP_PORT not provided' 6
|
||||
checkEnvVar "${KEYCLOAK_MANAGEMENT_HTTPS_PORT}" 'KEYCLOAK_MANAGEMENT_HTTPS_PORT not provided' 7
|
||||
|
||||
if [ "$(isKeyCloakRunning)" -eq 1 ]; then
|
||||
statusKeycloak
|
||||
else
|
||||
LAUNCH_JBOSS_IN_BACKGROUND=1 JBOSS_PIDFILE=${KEYCLOAK_PIDFILE} ${KEYCLOAK_HOME}/bin/standalone.sh \
|
||||
-Djboss.bind.address=${KEYCLOAK_BIND_ADDRESS} \
|
||||
-Djboss.http.port=${KEYCLOAK_HTTP_PORT} \
|
||||
-Djboss.https.port=${KEYCLOAK_HTTPS_PORT} \
|
||||
-Djboss.management.http.port=${KEYCLOAK_MANAGEMENT_HTTP_PORT} \
|
||||
-Djboss.management.https.port=${KEYCLOAK_MANAGEMENT_HTTPS_PORT} \
|
||||
-Djboss.node.name={{ inventory_hostname }} \
|
||||
{% if keycloak_prefer_ipv4 %}-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true {% endif %}\
|
||||
{% if keycloak_config_standalone_xml is defined %}--server-config={{ keycloak_config_standalone_xml }}{% endif %} &
|
||||
while [ ! -f ${KEYCLOAK_PIDFILE} ]; do sleep 1; done
|
||||
fi
|
||||
}
|
||||
|
||||
stopKeycloak() {
|
||||
local pid=$(getKeycloakPID)
|
||||
if [ -n "${pid}" ]; then
|
||||
set +e
|
||||
kill ${pid} 2> /dev/null
|
||||
kill -0 "${pid}" 2> /dev/null
|
||||
# if [ "${?}" -eq 0 ]; then
|
||||
# sleep 5
|
||||
# kill -9 "${pid}" > /dev/null
|
||||
# fi
|
||||
set -e
|
||||
deletePidFile
|
||||
fi
|
||||
}
|
||||
|
||||
deletePidFile() {
|
||||
rm -f "${KEYCLOAK_PIDFILE}"
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
startKeycloak
|
||||
;;
|
||||
stop)
|
||||
stopKeycloak
|
||||
;;
|
||||
restart)
|
||||
stopKeycloak
|
||||
startKeycloak
|
||||
;;
|
||||
status)
|
||||
statusKeycloak
|
||||
;;
|
||||
*)
|
||||
echo "usage: $0 start|stop|restart" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{{ ansible_managed | comment }}
|
||||
JAVA_OPTS='{{ keycloak_java_opts }}'
|
||||
JAVA_HOME={{ keycloak_java_home | default(keycloak_pkg_java_home, true) }}
|
||||
JBOSS_HOME={{ keycloak_config.home }}
|
||||
KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }}
|
||||
KEYCLOAK_HTTP_PORT={{ keycloak_http_port }}
|
||||
KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }}
|
||||
KEYCLOAK_MANAGEMENT_HTTP_PORT={{ keycloak_management_http_port }}
|
||||
KEYCLOAK_MANAGEMENT_HTTPS_PORT={{ keycloak_management_https_port }}
|
||||
JBOSS_PIDFILE='{{ keycloak_service_pidfile }}'
|
||||
|
||||
WILDFLY_OPTS=-Djboss.bind.address=${KEYCLOAK_BIND_ADDRESS} \
|
||||
-Djboss.http.port=${KEYCLOAK_HTTP_PORT} \
|
||||
-Djboss.https.port=${KEYCLOAK_HTTPS_PORT} \
|
||||
-Djboss.management.http.port=${KEYCLOAK_MANAGEMENT_HTTP_PORT} \
|
||||
-Djboss.management.https.port=${KEYCLOAK_MANAGEMENT_HTTPS_PORT} \
|
||||
-Djboss.node.name={{ inventory_hostname }} \
|
||||
{% if keycloak_prefer_ipv4 %}-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true {% endif %}\
|
||||
{% if keycloak_config_standalone_xml is defined %}--server-config={{ keycloak_config_standalone_xml }}{% endif %}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{{ ansible_managed | comment }}
|
||||
[Unit]
|
||||
Description={{ keycloak_config.service_name }} Server
|
||||
After=network.target
|
||||
StartLimitIntervalSec={{ keycloak_service_startlimitintervalsec }}
|
||||
StartLimitBurst={{ keycloak_service_startlimitburst }}
|
||||
|
||||
|
||||
[Service]
|
||||
{% if keycloak_service_runas %}
|
||||
User={{ keycloak_service_user }}
|
||||
Group={{ keycloak_service_group }}
|
||||
{% endif -%}
|
||||
EnvironmentFile=-{{ keycloak_sysconf_file }}
|
||||
PIDFile={{ keycloak_service_pidfile }}
|
||||
ExecStart={{ keycloak_config.home }}/bin/standalone.sh $WILDFLY_OPTS
|
||||
WorkingDirectory={{ keycloak_config.home }}
|
||||
TimeoutStartSec=30
|
||||
TimeoutStopSec=30
|
||||
LimitNOFILE=102642
|
||||
{% if keycloak_service_restart_always %}
|
||||
Restart=always
|
||||
{% elif keycloak_service_restart_on_failure %}
|
||||
Restart=on-failure
|
||||
{% endif %}
|
||||
RestartSec={{ keycloak_service_restartsec }}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,707 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
{{ ansible_managed | comment('xml') }}
|
||||
<server xmlns="urn:jboss:domain:16.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.clustering.jgroups"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.health"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.metrics"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface http-authentication-factory="management-http-authentication">
|
||||
<http-upgrade enabled="true" sasl-authentication-factory="management-sasl-authentication"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.cluster.infinispan">
|
||||
<level name="INFO"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.connections.infinispan">
|
||||
<level name="INFO"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.cache.infinispan">
|
||||
<level name="INFO"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.sessions.infinispan">
|
||||
<level name="INFO"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:6.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<connection-url>{{ keycloak_jdbc[keycloak_jdbc_engine].connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc[keycloak_jdbc_engine].db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc[keycloak_jdbc_engine].db_password }}</password>
|
||||
</security>
|
||||
<validation>
|
||||
<check-valid-connection-sql>{{ keycloak_jdbc[keycloak_jdbc_engine].validate_query }}</check-valid-connection-sql>
|
||||
<validate-on-match>{{ keycloak_db_background_validate_on_match }}</validate-on-match>
|
||||
{% if keycloak_db_background_validation_millis | int > 0 or keycloak_db_background_validation %}
|
||||
<background-validation>{{ keycloak_db_background_validation }}</background-validation>
|
||||
<background-validation-millis>{{ keycloak_db_background_validation_millis }}</background-validation-millis>
|
||||
{% endif %}
|
||||
</validation>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<driver name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" module="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<driver-class>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_class }}</driver-class>
|
||||
<xa-datasource-class>{{ keycloak_jdbc[keycloak_jdbc_engine].xa_datasource_class }}</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:6.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="distributable" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connectors="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<http-authentication-factory name="application-http-authentication" security-domain="ApplicationDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="BASIC">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:health:1.0" security-enabled="false"/>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:12.0">
|
||||
<cache-container name="ejb" default-cache="dist" aliases="sfsb" modules="org.wildfly.clustering.ejb.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="realms">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<replicated-cache name="work"/>
|
||||
<distributed-cache name="sessions" owners="2"/>
|
||||
<distributed-cache name="authenticationSessions" owners="2"/>
|
||||
<distributed-cache name="offlineSessions" owners="2"/>
|
||||
<distributed-cache name="clientSessions" owners="2"/>
|
||||
<distributed-cache name="offlineClientSessions" owners="2"/>
|
||||
<distributed-cache name="loginFailures" owners="2"/>
|
||||
<distributed-cache name="actionTokens" owners="2">
|
||||
<expiration interval="300000" max-idle="-1"/>
|
||||
</distributed-cache>
|
||||
<local-cache name="authorization">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<heap-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" aliases="singleton cluster" modules="org.wildfly.clustering.server">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="dist" modules="org.wildfly.clustering.web.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" modules="org.infinispan.hibernate-cache">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="local-query">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<invalidation-cache name="entity">
|
||||
<transaction mode="NON_XA"/>
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</invalidation-cache>
|
||||
<replicated-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:2.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jgroups:8.0">
|
||||
<channels default="ee">
|
||||
<channel name="ee" stack="tcp" cluster="ejb"/>
|
||||
</channels>
|
||||
<stacks>
|
||||
<stack name="tcp">
|
||||
<transport site="${jboss.node.name}" type="TCP" socket-binding="jgroups-tcp"/>
|
||||
{% if keycloak_ha_discovery == 'JDBC_PING' and keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<protocol type="JDBC_PING">
|
||||
<property name="datasource_jndi_name">java:jboss/datasources/KeycloakDS</property>
|
||||
<property name="initialize_sql">{{ keycloak_jdbc[keycloak_jdbc_engine].initialize_db }}</property>
|
||||
<property name="insert_single_sql">INSERT INTO JGROUPSPING (own_addr, cluster_name, ping_data) values (?, ?, ?)</property>
|
||||
<property name="delete_single_sql">DELETE FROM JGROUPSPING WHERE own_addr=? AND cluster_name=?</property>
|
||||
<property name="select_all_pingdata_sql">SELECT ping_data FROM JGROUPSPING WHERE cluster_name=?</property>
|
||||
</protocol>
|
||||
{% elif keycloak_ha_discovery == 'TCPPING' %}
|
||||
<protocol type="TCPPING">
|
||||
<property name="initial_hosts">{{ keycloak_cluster_nodes | map(attribute='inventory_host') | join (',') }}</property>
|
||||
<property name="port_range">0</property>
|
||||
<property name="timeout">3000</property>
|
||||
<property name="num_initial_members">2</property>
|
||||
</protocol>
|
||||
{% endif %}
|
||||
<protocol type="MERGE3"/>
|
||||
<protocol type="FD_SOCK"/>
|
||||
<protocol type="FD_ALL"/>
|
||||
<protocol type="VERIFY_SUSPECT"/>
|
||||
<protocol type="pbcast.NAKACK2"/>
|
||||
<protocol type="UNICAST3"/>
|
||||
<protocol type="pbcast.STABLE"/>
|
||||
<protocol type="pbcast.GMS">
|
||||
<property name="join_timeout">30000</property>
|
||||
</protocol>
|
||||
<protocol type="MFC"/>
|
||||
<protocol type="FRAG2"/>
|
||||
</stack>
|
||||
</stacks>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
{% if keycloak_ha_enabled %}
|
||||
<spi name="dblock">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="lockWaitTimeout" value="900"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
{% endif %}
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="{{ keycloak_modcluster.force_frontend_url }}"/>
|
||||
{% if keycloak_modcluster.admin_url | length > 0 %}
|
||||
<property name="adminUrl" value="{{ keycloak_modcluster.admin_url }}" />
|
||||
{% endif %}
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:4.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product(keycloak_modcluster.reverse_proxy_urls | map(attribute='host')) | map('join') | list | join(' ') }}">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" sasl-authentication-factory="application-sasl-authentication"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:6.0">
|
||||
<core-environment node-identifier="{{ inventory_hostname | default('${jboss.tx.node.id:1}') }}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>
|
||||
<https-listener name="https" socket-binding="https" ssl-context="applicationSSC" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker http-authentication-factory="application-http-authentication"/>
|
||||
<filter-ref name="proxy-peer"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
<filters>
|
||||
<filter name="proxy-peer" module="io.undertow.core"
|
||||
class-name="io.undertow.server.handlers.ProxyPeerAddressHandler"/>
|
||||
</filters>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="{{ keycloak_management_port_bind_address }}"/>
|
||||
</interface>
|
||||
<interface name="jgroups">
|
||||
{% if keycloak_jgroups_subnet is defined and keycloak_jgroups_subnet is not none and keycloak_jgroups_subnet | string | length > 0 %}
|
||||
<subnet-match value="{{ keycloak_jgroups_subnet | string }}"/>
|
||||
{% elif ansible_default_ipv4 is defined and (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') | length > 0 %}
|
||||
<subnet-match value="{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') }}"/>
|
||||
{% else %}
|
||||
<any-address />
|
||||
{% endif %}
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="{{ keycloak_bind_address }}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="{{ keycloak_ajp_port }}"/>
|
||||
<socket-binding name="http" port="{{ keycloak_http_port }}"/>
|
||||
<socket-binding name="https" port="{{ keycloak_https_port }}"/>
|
||||
<socket-binding name="management-http" interface="management" port="{{ keycloak_management_http_port }}"/>
|
||||
<socket-binding name="management-https" interface="management" port="{{ keycloak_management_https_port }}"/>
|
||||
<socket-binding name="jgroups-tcp" interface="jgroups" port="{{ keycloak_jgroups_port }}"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
{% for modcluster in keycloak_modcluster.reverse_proxy_urls %}
|
||||
<outbound-socket-binding name="proxy_{{ modcluster.host }}">
|
||||
<remote-destination host="{{ modcluster.host }}" port="{{ modcluster.port }}"/>
|
||||
</outbound-socket-binding>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if keycloak_ha_discovery == 'TCPPING' %}
|
||||
{% for node in keycloak_cluster_nodes %}
|
||||
<outbound-socket-binding name="jgroups_{{ node.address }}">
|
||||
<remote-destination host="{{ node.value }}" port="{{ keycloak_jgroups_port }}"/>
|
||||
</outbound-socket-binding>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
<outbound-socket-binding name="remote-cache">
|
||||
<remote-destination host="{{ keycloak_remotecache.server_name | default('localhost') }}" port="${remote.cache.port:11222}"/>
|
||||
</outbound-socket-binding>
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,745 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
{{ ansible_managed | comment('xml') }}
|
||||
<server xmlns="urn:jboss:domain:16.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.clustering.jgroups"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.health"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.metrics"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface http-authentication-factory="management-http-authentication">
|
||||
<http-upgrade enabled="true" sasl-authentication-factory="management-sasl-authentication"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.cluster.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.connections.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.cache.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="org.keycloak.models.sessions.infinispan">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:6.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<connection-url>{{ keycloak_jdbc[keycloak_jdbc_engine].connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc[keycloak_jdbc_engine].db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc[keycloak_jdbc_engine].db_password }}</password>
|
||||
</security>
|
||||
<validation>
|
||||
<check-valid-connection-sql>{{ keycloak_jdbc[keycloak_jdbc_engine].validate_query }}</check-valid-connection-sql>
|
||||
<validate-on-match>{{ keycloak_db_background_validate_on_match }}</validate-on-match>
|
||||
{% if keycloak_db_background_validation_millis | int > 0 or keycloak_db_background_validation %}
|
||||
<background-validation>{{ keycloak_db_background_validation }}</background-validation>
|
||||
<background-validation-millis>{{ keycloak_db_background_validation_millis }}</background-validation-millis>
|
||||
{% endif %}
|
||||
</validation>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<driver name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" module="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<driver-class>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_class }}</driver-class>
|
||||
<xa-datasource-class>{{ keycloak_jdbc[keycloak_jdbc_engine].xa_datasource_class }}</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:6.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="distributable" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connectors="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<http-authentication-factory name="application-http-authentication" security-domain="ApplicationDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="BASIC">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:health:1.0" security-enabled="false"/>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:12.0">
|
||||
<cache-container name="ejb" default-cache="dist" aliases="sfsb" modules="org.wildfly.clustering.ejb.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak" modules="org.keycloak.keycloak-model-infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="realms">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
{% for cachename in [ "sessions", "offlineSessions", "clientSessions", "offlineClientSessions", "loginFailures", "actionTokens", "authenticationSessions" ] %}
|
||||
<distributed-cache name="{{ cachename }}">
|
||||
<remote-store cache="{{ cachename }}"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">{{ keycloak_remotecache.use_ssl }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</distributed-cache>
|
||||
{% endfor %}
|
||||
<replicated-cache name="work">
|
||||
<remote-store cache="work"
|
||||
remote-servers="remote-cache"
|
||||
passivation="false"
|
||||
fetch-state="false"
|
||||
purge="false"
|
||||
preload="false"
|
||||
shared="true">
|
||||
<property name="rawValues">true</property>
|
||||
<property name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
|
||||
<property name="remoteStoreSecurityEnabled">false</property>
|
||||
<property name="infinispan.client.hotrod.auth_username">{{ keycloak_remotecache.username }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_password">{{ keycloak_remotecache.password }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_realm">{{ keycloak_remotecache.realm | default('default') }}</property>
|
||||
<property name="infinispan.client.hotrod.auth_server_name">{{ keycloak_remotecache.server_name }}</property>
|
||||
<property name="infinispan.client.hotrod.sasl_mechanism">{{ keycloak_remotecache.sasl_mechanism }}</property>
|
||||
<property name="infinispan.client.hotrod.use_ssl">{{ keycloak_remotecache.use_ssl }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_file_name">{{ keycloak_remotecache.trust_store_path }}</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_type">JKS</property>
|
||||
<property name="infinispan.client.hotrod.trust_store_password">{{ keycloak_remotecache.trust_store_password }}</property>
|
||||
<property name="infinispan.client.hotrod.client_intelligence">TOPOLOGY_AWARE</property>
|
||||
</remote-store>
|
||||
</replicated-cache>
|
||||
<local-cache name="authorization">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<heap-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" aliases="singleton cluster" modules="org.wildfly.clustering.server">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="dist" modules="org.wildfly.clustering.web.infinispan">
|
||||
<transport lock-timeout="60000"/>
|
||||
<replicated-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</replicated-cache>
|
||||
<distributed-cache name="dist">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" modules="org.infinispan.hibernate-cache">
|
||||
<transport lock-timeout="60000"/>
|
||||
<local-cache name="local-query">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<invalidation-cache name="entity">
|
||||
<transaction mode="NON_XA"/>
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</invalidation-cache>
|
||||
<replicated-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:2.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jgroups:8.0">
|
||||
<channels default="ee">
|
||||
<channel name="ee" stack="tcp" cluster="ejb"/>
|
||||
</channels>
|
||||
<stacks>
|
||||
<stack name="tcp">
|
||||
<transport site="${jboss.node.name}" type="TCP" socket-binding="jgroups-tcp"/>
|
||||
{% if keycloak_ha_discovery == 'JDBC_PING' and keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<protocol type="JDBC_PING">
|
||||
<property name="datasource_jndi_name">java:jboss/datasources/KeycloakDS</property>
|
||||
<property name="initialize_sql">{{ keycloak_jdbc[keycloak_jdbc_engine].initialize_db }}</property>
|
||||
<property name="insert_single_sql">INSERT INTO JGROUPSPING (own_addr, cluster_name, ping_data) values (?, ?, ?)</property>
|
||||
<property name="delete_single_sql">DELETE FROM JGROUPSPING WHERE own_addr=? AND cluster_name=?</property>
|
||||
<property name="select_all_pingdata_sql">SELECT ping_data FROM JGROUPSPING WHERE cluster_name=?</property>
|
||||
</protocol>
|
||||
{% elif keycloak_ha_discovery == 'TCPPING' %}
|
||||
<protocol type="TCPPING">
|
||||
<property name="initial_hosts">{{ keycloak_cluster_nodes | map(attribute='inventory_host') | join (',') }}</property>
|
||||
<property name="port_range">0</property>
|
||||
<property name="timeout">3000</property>
|
||||
<property name="num_initial_members">2</property>
|
||||
</protocol>
|
||||
{% endif %}
|
||||
<protocol type="MERGE3"/>
|
||||
<protocol type="FD_SOCK"/>
|
||||
<protocol type="FD_ALL"/>
|
||||
<protocol type="VERIFY_SUSPECT"/>
|
||||
<protocol type="pbcast.NAKACK2"/>
|
||||
<protocol type="UNICAST3"/>
|
||||
<protocol type="pbcast.STABLE"/>
|
||||
<protocol type="pbcast.GMS">
|
||||
<property name="join_timeout">30000</property>
|
||||
</protocol>
|
||||
<protocol type="MFC"/>
|
||||
<protocol type="FRAG2"/>
|
||||
</stack>
|
||||
</stacks>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
{% if keycloak_ha_enabled %}
|
||||
<spi name="dblock">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="lockWaitTimeout" value="900"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
{% endif %}
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="{{ keycloak_modcluster.force_frontend_url }}"/>
|
||||
{% if keycloak_modcluster.admin_url | length > 0 %}
|
||||
<property name="adminUrl" value="{{ keycloak_modcluster.admin_url }}" />
|
||||
{% endif %}
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:4.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product(keycloak_modcluster.reverse_proxy_urls | map(attribute='host')) | map('join') | list | join(' ') }}">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" sasl-authentication-factory="application-sasl-authentication"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:6.0">
|
||||
<core-environment node-identifier="{{ inventory_hostname | default('${jboss.tx.node.id:1}') }}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>
|
||||
<https-listener name="https" socket-binding="https" ssl-context="applicationSSC" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker http-authentication-factory="application-http-authentication"/>
|
||||
<filter-ref name="proxy-peer"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
<filters>
|
||||
<filter name="proxy-peer" module="io.undertow.core"
|
||||
class-name="io.undertow.server.handlers.ProxyPeerAddressHandler"/>
|
||||
</filters>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="{{ keycloak_management_port_bind_address }}"/>
|
||||
</interface>
|
||||
<interface name="jgroups">
|
||||
{% if keycloak_jgroups_subnet is defined and keycloak_jgroups_subnet is not none and keycloak_jgroups_subnet | string | length > 0 %}
|
||||
<subnet-match value="{{ keycloak_jgroups_subnet | string }}"/>
|
||||
{% elif ansible_default_ipv4 is defined and (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') | length > 0 %}
|
||||
<subnet-match value="{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('net') }}"/>
|
||||
{% else %}
|
||||
<any-address />
|
||||
{% endif %}
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="{{ keycloak_bind_address }}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="{{ keycloak_ajp_port }}"/>
|
||||
<socket-binding name="http" port="{{ keycloak_http_port }}"/>
|
||||
<socket-binding name="https" port="{{ keycloak_https_port }}"/>
|
||||
<socket-binding name="management-http" interface="management" port="{{ keycloak_management_http_port }}"/>
|
||||
<socket-binding name="management-https" interface="management" port="{{ keycloak_management_https_port }}"/>
|
||||
<socket-binding name="jgroups-tcp" interface="jgroups" port="{{ keycloak_jgroups_port }}"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
{% for modcluster in keycloak_modcluster.reverse_proxy_urls %}
|
||||
<outbound-socket-binding name="proxy_{{ modcluster.host }}">
|
||||
<remote-destination host="{{ modcluster.host }}" port="{{ modcluster.port }}"/>
|
||||
</outbound-socket-binding>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if keycloak_ha_discovery == 'TCPPING' %}
|
||||
{% for node in keycloak_cluster_nodes %}
|
||||
<outbound-socket-binding name="jgroups_{{ node.address }}">
|
||||
<remote-destination host="{{ node.value }}" port="{{ keycloak_jgroups_port }}"/>
|
||||
</outbound-socket-binding>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
<outbound-socket-binding name="remote-cache">
|
||||
<remote-destination host="{{ keycloak_remotecache.server_name | default('localhost') }}" port="${remote.cache.port:11222}"/>
|
||||
</outbound-socket-binding>
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,626 @@
|
|||
<?xml version='1.0' encoding='UTF-8'?>
|
||||
{{ ansible_managed | comment('xml') }}
|
||||
<server xmlns="urn:jboss:domain:16.0">
|
||||
<extensions>
|
||||
<extension module="org.jboss.as.clustering.infinispan"/>
|
||||
<extension module="org.jboss.as.connector"/>
|
||||
<extension module="org.jboss.as.deployment-scanner"/>
|
||||
<extension module="org.jboss.as.ee"/>
|
||||
<extension module="org.jboss.as.ejb3"/>
|
||||
<extension module="org.jboss.as.jaxrs"/>
|
||||
<extension module="org.jboss.as.jmx"/>
|
||||
<extension module="org.jboss.as.jpa"/>
|
||||
<extension module="org.jboss.as.logging"/>
|
||||
<extension module="org.jboss.as.mail"/>
|
||||
<extension module="org.jboss.as.modcluster"/>
|
||||
<extension module="org.jboss.as.naming"/>
|
||||
<extension module="org.jboss.as.remoting"/>
|
||||
<extension module="org.jboss.as.transactions"/>
|
||||
<extension module="org.jboss.as.weld"/>
|
||||
<extension module="org.keycloak.keycloak-server-subsystem"/>
|
||||
<extension module="org.wildfly.extension.bean-validation"/>
|
||||
<extension module="org.wildfly.extension.core-management"/>
|
||||
<extension module="org.wildfly.extension.elytron"/>
|
||||
<extension module="org.wildfly.extension.health"/>
|
||||
<extension module="org.wildfly.extension.io"/>
|
||||
<extension module="org.wildfly.extension.metrics"/>
|
||||
<extension module="org.wildfly.extension.request-controller"/>
|
||||
<extension module="org.wildfly.extension.security.manager"/>
|
||||
<extension module="org.wildfly.extension.undertow"/>
|
||||
</extensions>
|
||||
<management>
|
||||
<audit-log>
|
||||
<formatters>
|
||||
<json-formatter name="json-formatter"/>
|
||||
</formatters>
|
||||
<handlers>
|
||||
<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>
|
||||
</handlers>
|
||||
<logger log-boot="true" log-read-only="false" enabled="false">
|
||||
<handlers>
|
||||
<handler name="file"/>
|
||||
</handlers>
|
||||
</logger>
|
||||
</audit-log>
|
||||
<management-interfaces>
|
||||
<http-interface http-authentication-factory="management-http-authentication">
|
||||
<http-upgrade enabled="true" sasl-authentication-factory="management-sasl-authentication"/>
|
||||
<socket-binding http="management-http"/>
|
||||
</http-interface>
|
||||
</management-interfaces>
|
||||
<access-control provider="simple">
|
||||
<role-mapping>
|
||||
<role name="SuperUser">
|
||||
<include>
|
||||
<user name="$local"/>
|
||||
</include>
|
||||
</role>
|
||||
</role-mapping>
|
||||
</access-control>
|
||||
</management>
|
||||
<profile>
|
||||
<subsystem xmlns="urn:jboss:domain:logging:8.0">
|
||||
<console-handler name="CONSOLE">
|
||||
<level name="INFO"/>
|
||||
<formatter>
|
||||
<named-formatter name="COLOR-PATTERN"/>
|
||||
</formatter>
|
||||
</console-handler>
|
||||
<periodic-rotating-file-handler name="FILE" autoflush="true">
|
||||
<formatter>
|
||||
<named-formatter name="PATTERN"/>
|
||||
</formatter>
|
||||
<file relative-to="jboss.server.log.dir" path="server.log"/>
|
||||
<suffix value=".yyyy-MM-dd"/>
|
||||
<append value="true"/>
|
||||
</periodic-rotating-file-handler>
|
||||
<logger category="com.arjuna">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="io.jaegertracing.Configuration">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<logger category="org.jboss.as.config">
|
||||
<level name="DEBUG"/>
|
||||
</logger>
|
||||
<logger category="sun.rmi">
|
||||
<level name="WARN"/>
|
||||
</logger>
|
||||
<root-logger>
|
||||
<level name="INFO"/>
|
||||
<handlers>
|
||||
<handler name="CONSOLE"/>
|
||||
<handler name="FILE"/>
|
||||
</handlers>
|
||||
</root-logger>
|
||||
<formatter name="PATTERN">
|
||||
<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
<formatter name="COLOR-PATTERN">
|
||||
<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n"/>
|
||||
</formatter>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:bean-validation:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:core-management:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:datasources:6.0">
|
||||
<datasources>
|
||||
<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
</datasource>
|
||||
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true" statistics-enabled="${wildfly.datasources.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<connection-url>{{ keycloak_jdbc[keycloak_jdbc_engine].connection_url }}</connection-url>
|
||||
<driver>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}</driver>
|
||||
<pool>
|
||||
<max-pool-size>20</max-pool-size>
|
||||
</pool>
|
||||
<security>
|
||||
<user-name>{{ keycloak_jdbc[keycloak_jdbc_engine].db_user }}</user-name>
|
||||
<password>{{ keycloak_jdbc[keycloak_jdbc_engine].db_password }}</password>
|
||||
</security>
|
||||
<validation>
|
||||
<check-valid-connection-sql>{{ keycloak_jdbc[keycloak_jdbc_engine].validate_query }}</check-valid-connection-sql>
|
||||
<validate-on-match>{{ keycloak_db_background_validate_on_match }}</validate-on-match>
|
||||
{% if keycloak_db_background_validation_millis | int > 0 or keycloak_db_background_validation %}
|
||||
<background-validation>{{ keycloak_db_background_validation }}</background-validation>
|
||||
<background-validation-millis>{{ keycloak_db_background_validation_millis }}</background-validation-millis>
|
||||
{% endif %}
|
||||
</validation>
|
||||
{% else %}
|
||||
<connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url>
|
||||
<driver>h2</driver>
|
||||
<security>
|
||||
<user-name>sa</user-name>
|
||||
<password>sa</password>
|
||||
</security>
|
||||
{% endif %}
|
||||
</datasource>
|
||||
<drivers>
|
||||
{% if keycloak_jdbc[keycloak_jdbc_engine].enabled %}
|
||||
<driver name="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}" module="{{ keycloak_jdbc[keycloak_jdbc_engine].driver_module_name }}">
|
||||
<driver-class>{{ keycloak_jdbc[keycloak_jdbc_engine].driver_class }}</driver-class>
|
||||
<xa-datasource-class>{{ keycloak_jdbc[keycloak_jdbc_engine].xa_datasource_class }}</xa-datasource-class>
|
||||
</driver>
|
||||
{% endif %}
|
||||
<driver name="h2" module="com.h2database.h2">
|
||||
<xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
|
||||
</driver>
|
||||
</drivers>
|
||||
</datasources>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:deployment-scanner:2.0">
|
||||
<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" runtime-failure-causes-rollback="${jboss.deployment.scanner.rollback.on.failure:false}"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ee:6.0">
|
||||
<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
|
||||
<concurrent>
|
||||
<context-services>
|
||||
<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>
|
||||
</context-services>
|
||||
<managed-thread-factories>
|
||||
<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>
|
||||
</managed-thread-factories>
|
||||
<managed-executor-services>
|
||||
<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="5000"/>
|
||||
</managed-executor-services>
|
||||
<managed-scheduled-executor-services>
|
||||
<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-termination-period="0" hung-task-threshold="60000" keepalive-time="3000"/>
|
||||
</managed-scheduled-executor-services>
|
||||
</concurrent>
|
||||
<default-bindings context-service="java:jboss/ee/concurrency/context/default" datasource="java:jboss/datasources/ExampleDS" managed-executor-service="java:jboss/ee/concurrency/executor/default" managed-scheduled-executor-service="java:jboss/ee/concurrency/scheduler/default" managed-thread-factory="java:jboss/ee/concurrency/factory/default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
|
||||
<session-bean>
|
||||
<stateless>
|
||||
<bean-instance-pool-ref pool-name="slsb-strict-max-pool"/>
|
||||
</stateless>
|
||||
<stateful default-access-timeout="5000" cache-ref="simple" passivation-disabled-cache-ref="simple"/>
|
||||
<singleton default-access-timeout="5000"/>
|
||||
</session-bean>
|
||||
<pools>
|
||||
<bean-instance-pools>
|
||||
<strict-max-pool name="mdb-strict-max-pool" derive-size="from-cpu-count" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
<strict-max-pool name="slsb-strict-max-pool" derive-size="from-worker-pools" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>
|
||||
</bean-instance-pools>
|
||||
</pools>
|
||||
<caches>
|
||||
<cache name="simple"/>
|
||||
<cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
|
||||
</caches>
|
||||
<passivation-stores>
|
||||
<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>
|
||||
</passivation-stores>
|
||||
<async thread-pool-name="default"/>
|
||||
<timer-service thread-pool-name="default" default-data-store="default-file-store">
|
||||
<data-stores>
|
||||
<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>
|
||||
</data-stores>
|
||||
</timer-service>
|
||||
<remote cluster="ejb" connectors="http-remoting-connector" thread-pool-name="default">
|
||||
<channel-creation-options>
|
||||
<option name="MAX_OUTBOUND_MESSAGES" value="1234" type="remoting"/>
|
||||
</channel-creation-options>
|
||||
</remote>
|
||||
<thread-pools>
|
||||
<thread-pool name="default">
|
||||
<max-threads count="10"/>
|
||||
<keepalive-time time="60" unit="seconds"/>
|
||||
</thread-pool>
|
||||
</thread-pools>
|
||||
<default-security-domain value="other"/>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
<default-missing-method-permissions-deny-access value="true"/>
|
||||
<statistics enabled="${wildfly.ejb3.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<log-system-exceptions value="true"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
|
||||
<providers>
|
||||
<aggregate-providers name="combined-providers">
|
||||
<providers name="elytron"/>
|
||||
<providers name="openssl"/>
|
||||
</aggregate-providers>
|
||||
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
|
||||
<provider-loader name="openssl" module="org.wildfly.openssl"/>
|
||||
</providers>
|
||||
<audit-logging>
|
||||
<file-audit-log name="local-audit" path="audit.log" relative-to="jboss.server.log.dir" format="JSON"/>
|
||||
</audit-logging>
|
||||
<security-domains>
|
||||
<security-domain name="ApplicationDomain" default-realm="ApplicationRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ApplicationRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local"/>
|
||||
</security-domain>
|
||||
<security-domain name="ManagementDomain" default-realm="ManagementRealm" permission-mapper="default-permission-mapper">
|
||||
<realm name="ManagementRealm" role-decoder="groups-to-roles"/>
|
||||
<realm name="local" role-mapper="super-user-mapper"/>
|
||||
</security-domain>
|
||||
</security-domains>
|
||||
<security-realms>
|
||||
<identity-realm name="local" identity="$local"/>
|
||||
<properties-realm name="ApplicationRealm">
|
||||
<users-properties path="application-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ApplicationRealm"/>
|
||||
<groups-properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
<properties-realm name="ManagementRealm">
|
||||
<users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
|
||||
<groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
|
||||
</properties-realm>
|
||||
</security-realms>
|
||||
<mappers>
|
||||
<simple-permission-mapper name="default-permission-mapper" mapping-mode="first">
|
||||
<permission-mapping>
|
||||
<principal name="anonymous"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
<permission-mapping match-all="true">
|
||||
<permission-set name="login-permission"/>
|
||||
<permission-set name="default-permissions"/>
|
||||
</permission-mapping>
|
||||
</simple-permission-mapper>
|
||||
<constant-realm-mapper name="local" realm-name="local"/>
|
||||
<simple-role-decoder name="groups-to-roles" attribute="groups"/>
|
||||
<constant-role-mapper name="super-user-mapper">
|
||||
<role name="SuperUser"/>
|
||||
</constant-role-mapper>
|
||||
</mappers>
|
||||
<permission-sets>
|
||||
<permission-set name="login-permission">
|
||||
<permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
|
||||
</permission-set>
|
||||
<permission-set name="default-permissions">
|
||||
<permission class-name="org.wildfly.extension.batch.jberet.deployment.BatchPermission" module="org.wildfly.extension.batch.jberet" target-name="*"/>
|
||||
<permission class-name="org.wildfly.transaction.client.RemoteTransactionPermission" module="org.wildfly.transaction.client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
<permission class-name="org.jboss.ejb.client.RemoteEJBPermission" module="org.jboss.ejb-client"/>
|
||||
</permission-set>
|
||||
</permission-sets>
|
||||
<http>
|
||||
<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="DIGEST">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<http-authentication-factory name="application-http-authentication" security-domain="ApplicationDomain" http-server-mechanism-factory="global">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="BASIC">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</http-authentication-factory>
|
||||
<provider-http-server-mechanism-factory name="global"/>
|
||||
</http>
|
||||
<sasl>
|
||||
<sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" security-domain="ApplicationDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ApplicationRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" security-domain="ManagementDomain">
|
||||
<mechanism-configuration>
|
||||
<mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/>
|
||||
<mechanism mechanism-name="DIGEST-MD5">
|
||||
<mechanism-realm realm-name="ManagementRealm"/>
|
||||
</mechanism>
|
||||
</mechanism-configuration>
|
||||
</sasl-authentication-factory>
|
||||
<configurable-sasl-server-factory name="configured" sasl-server-factory="elytron">
|
||||
<properties>
|
||||
<property name="wildfly.sasl.local-user.default-user" value="$local"/>
|
||||
</properties>
|
||||
</configurable-sasl-server-factory>
|
||||
<mechanism-provider-filtering-sasl-server-factory name="elytron" sasl-server-factory="global">
|
||||
<filters>
|
||||
<filter provider-name="WildFlyElytron"/>
|
||||
</filters>
|
||||
</mechanism-provider-filtering-sasl-server-factory>
|
||||
<provider-sasl-server-factory name="global"/>
|
||||
</sasl>
|
||||
<tls>
|
||||
<key-stores>
|
||||
<key-store name="applicationKS">
|
||||
<credential-reference clear-text="password"/>
|
||||
<implementation type="JKS"/>
|
||||
<file path="application.keystore" relative-to="jboss.server.config.dir"/>
|
||||
</key-store>
|
||||
</key-stores>
|
||||
<key-managers>
|
||||
<key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
|
||||
<credential-reference clear-text="password"/>
|
||||
</key-manager>
|
||||
</key-managers>
|
||||
<server-ssl-contexts>
|
||||
<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
|
||||
</server-ssl-contexts>
|
||||
</tls>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:health:1.0" security-enabled="false"/>
|
||||
<subsystem xmlns="urn:jboss:domain:infinispan:12.0">
|
||||
<cache-container name="ejb" default-cache="passivation" aliases="sfsb" modules="org.wildfly.clustering.ejb.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="keycloak" modules="org.keycloak.keycloak-model-infinispan">
|
||||
<local-cache name="realms">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="sessions"/>
|
||||
<local-cache name="authenticationSessions"/>
|
||||
<local-cache name="offlineSessions"/>
|
||||
<local-cache name="clientSessions"/>
|
||||
<local-cache name="offlineClientSessions"/>
|
||||
<local-cache name="loginFailures"/>
|
||||
<local-cache name="work"/>
|
||||
<local-cache name="authorization">
|
||||
<heap-memory size="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="keys">
|
||||
<heap-memory size="1000"/>
|
||||
<expiration max-idle="3600000"/>
|
||||
</local-cache>
|
||||
<local-cache name="actionTokens">
|
||||
<heap-memory size="-1"/>
|
||||
<expiration interval="300000" max-idle="-1"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="server" default-cache="default" modules="org.wildfly.clustering.server">
|
||||
<local-cache name="default">
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
</cache-container>
|
||||
<cache-container name="web" default-cache="passivation" modules="org.wildfly.clustering.web.infinispan">
|
||||
<local-cache name="passivation">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
<file-store passivation="true" purge="false"/>
|
||||
</local-cache>
|
||||
<local-cache name="sso">
|
||||
<locking isolation="REPEATABLE_READ"/>
|
||||
<transaction mode="BATCH"/>
|
||||
</local-cache>
|
||||
<local-cache name="routing"/>
|
||||
</cache-container>
|
||||
<cache-container name="hibernate" modules="org.infinispan.hibernate-cache">
|
||||
<local-cache name="entity">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="local-query">
|
||||
<heap-memory size="10000"/>
|
||||
<expiration max-idle="100000"/>
|
||||
</local-cache>
|
||||
<local-cache name="timestamps"/>
|
||||
</cache-container>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:io:3.0">
|
||||
<worker name="default"/>
|
||||
<buffer-pool name="default"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jaxrs:2.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:jca:5.0">
|
||||
<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>
|
||||
<bean-validation enabled="true"/>
|
||||
<default-workmanager>
|
||||
<short-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</short-running-threads>
|
||||
<long-running-threads>
|
||||
<core-threads count="50"/>
|
||||
<queue-length count="50"/>
|
||||
<max-threads count="50"/>
|
||||
<keepalive-time time="10" unit="seconds"/>
|
||||
</long-running-threads>
|
||||
</default-workmanager>
|
||||
<cached-connection-manager/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
|
||||
<expose-resolved-model/>
|
||||
<expose-expression-model/>
|
||||
<remoting-connector/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:jpa:1.1">
|
||||
<jpa default-extended-persistence-inheritance="DEEP"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
|
||||
<web-context>auth</web-context>
|
||||
<providers>
|
||||
<provider>
|
||||
classpath:${jboss.home.dir}/providers/*
|
||||
</provider>
|
||||
</providers>
|
||||
<master-realm-name>master</master-realm-name>
|
||||
<scheduled-task-interval>900</scheduled-task-interval>
|
||||
<theme>
|
||||
<staticMaxAge>2592000</staticMaxAge>
|
||||
<cacheThemes>true</cacheThemes>
|
||||
<cacheTemplates>true</cacheTemplates>
|
||||
<dir>${jboss.home.dir}/themes</dir>
|
||||
</theme>
|
||||
{% if keycloak_ha_enabled %}
|
||||
<spi name="dblock">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="lockWaitTimeout" value="900"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
{% endif %}
|
||||
<spi name="eventsStore">
|
||||
<provider name="jpa" enabled="true">
|
||||
<properties>
|
||||
<property name="exclude-events" value="["REFRESH_TOKEN"]"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="userCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="userSessionPersister">
|
||||
<default-provider>jpa</default-provider>
|
||||
</spi>
|
||||
<spi name="timer">
|
||||
<default-provider>basic</default-provider>
|
||||
</spi>
|
||||
<spi name="connectionsHttpClient">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsJpa">
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
|
||||
<property name="initializeEmpty" value="true"/>
|
||||
<property name="migrationStrategy" value="update"/>
|
||||
<property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="realmCache">
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="connectionsInfinispan">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="cacheContainer" value="java:jboss/infinispan/container/keycloak"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="jta-lookup">
|
||||
<default-provider>${keycloak.jta.lookup.provider:jboss}</default-provider>
|
||||
<provider name="jboss" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="publicKeyStorage">
|
||||
<provider name="infinispan" enabled="true">
|
||||
<properties>
|
||||
<property name="minTimeBetweenRequests" value="10"/>
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
<spi name="x509cert-lookup">
|
||||
<default-provider>${keycloak.x509cert.lookup.provider:default}</default-provider>
|
||||
<provider name="default" enabled="true"/>
|
||||
</spi>
|
||||
<spi name="hostname">
|
||||
<default-provider>default</default-provider>
|
||||
<provider name="default" enabled="true">
|
||||
<properties>
|
||||
<property name="frontendUrl" value="{{ keycloak_modcluster.frontend_url }}"/>
|
||||
<property name="forceBackendUrlToFrontendUrl" value="{{ keycloak_modcluster.force_frontend_url }}"/>
|
||||
{% if (keycloak_modcluster.admin_url | default('', true)) | length > 0 %}
|
||||
<property name="adminUrl" value="{{ keycloak_modcluster.admin_url }}" />
|
||||
{% endif %}
|
||||
</properties>
|
||||
</provider>
|
||||
</spi>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:mail:4.0">
|
||||
<mail-session name="default" jndi-name="java:jboss/mail/Default">
|
||||
<smtp-server outbound-socket-binding-ref="mail-smtp"/>
|
||||
</mail-session>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:wildfly:metrics:1.0" security-enabled="false" exposed-subsystems="*" prefix="${wildfly.metrics.prefix:jboss}"/>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
<subsystem xmlns="urn:jboss:domain:modcluster:5.0">
|
||||
<proxy name="default" advertise="false" listener="ajp" proxies="{{ ['proxy_'] | product((keycloak_modcluster.reverse_proxy_urls | default([])) | map(attribute='host')) | map('join') | list | join(' ') }}">
|
||||
<dynamic-load-provider>
|
||||
<load-metric type="cpu"/>
|
||||
</dynamic-load-provider>
|
||||
</proxy>
|
||||
</subsystem>
|
||||
{% endif %}
|
||||
<subsystem xmlns="urn:jboss:domain:naming:2.0">
|
||||
<remote-naming/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
|
||||
<http-connector name="http-remoting-connector" connector-ref="default" sasl-authentication-factory="application-sasl-authentication"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:request-controller:1.0"/>
|
||||
<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
|
||||
<deployment-permissions>
|
||||
<maximum-set>
|
||||
<permission class="java.security.AllPermission"/>
|
||||
</maximum-set>
|
||||
</deployment-permissions>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:transactions:6.0">
|
||||
<core-environment node-identifier="${jboss.tx.node.id:1}">
|
||||
<process-id>
|
||||
<uuid/>
|
||||
</process-id>
|
||||
</core-environment>
|
||||
<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>
|
||||
<coordinator-environment statistics-enabled="${wildfly.transactions.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
|
||||
<object-store path="tx-object-store" relative-to="jboss.server.data.dir"/>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
|
||||
<buffer-cache name="default"/>
|
||||
<server name="default-server">
|
||||
<ajp-listener name="ajp" socket-binding="ajp"/>
|
||||
<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
|
||||
<https-listener name="https" socket-binding="https" ssl-context="applicationSSC" enable-http2="true"/>
|
||||
<host name="default-host" alias="localhost">
|
||||
<location name="/" handler="welcome-content"/>
|
||||
<http-invoker http-authentication-factory="application-http-authentication"/>
|
||||
</host>
|
||||
</server>
|
||||
<servlet-container name="default">
|
||||
<jsp-config/>
|
||||
<websockets/>
|
||||
</servlet-container>
|
||||
<handlers>
|
||||
<file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
|
||||
</handlers>
|
||||
<application-security-domains>
|
||||
<application-security-domain name="other" security-domain="ApplicationDomain"/>
|
||||
</application-security-domains>
|
||||
</subsystem>
|
||||
<subsystem xmlns="urn:jboss:domain:weld:4.0"/>
|
||||
</profile>
|
||||
<interfaces>
|
||||
<interface name="management">
|
||||
<inet-address value="{{ keycloak_management_port_bind_address }}"/>
|
||||
</interface>
|
||||
<interface name="public">
|
||||
<inet-address value="{{ keycloak_bind_address }}"/>
|
||||
</interface>
|
||||
</interfaces>
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:{{ keycloak_jboss_port_offset }}}">
|
||||
<socket-binding name="ajp" port="{{ keycloak_ajp_port }}"/>
|
||||
<socket-binding name="http" port="{{ keycloak_http_port }}"/>
|
||||
<socket-binding name="https" port="{{ keycloak_https_port }}"/>
|
||||
<socket-binding name="management-http" interface="management" port="{{ keycloak_management_http_port }}"/>
|
||||
<socket-binding name="management-https" interface="management" port="{{ keycloak_management_https_port }}"/>
|
||||
<socket-binding name="txn-recovery-environment" port="4712"/>
|
||||
<socket-binding name="txn-status-manager" port="4713"/>
|
||||
<outbound-socket-binding name="mail-smtp">
|
||||
<remote-destination host="${jboss.mail.server.host:localhost}" port="${jboss.mail.server.port:25}"/>
|
||||
</outbound-socket-binding>
|
||||
{% if keycloak_modcluster.enabled %}
|
||||
{% for modcluster in keycloak_modcluster.reverse_proxy_urls %}
|
||||
<outbound-socket-binding name="proxy_{{ modcluster.host }}">
|
||||
<remote-destination host="{{ modcluster.host }}" port="{{ modcluster.port }}"/>
|
||||
</outbound-socket-binding>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
</socket-binding-group>
|
||||
</server>
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
---
|
||||
keycloak_varjvm_package: "{{ keycloak_jvm_package | default('openjdk-11-jdk-headless') }}"
|
||||
keycloak_prereq_package_list:
|
||||
- "{{ keycloak_varjvm_package }}"
|
||||
- unzip
|
||||
- procps
|
||||
- apt
|
||||
- tzdata
|
||||
keycloak_configure_iptables: true
|
||||
keycloak_sysconf_file: /etc/default/keycloak
|
||||
keycloak_pkg_java_home: "/usr/lib/jvm/java-{{ keycloak_varjvm_package | \
|
||||
regex_search('(?!:openjdk-)[0-9.]+') }}-openjdk-{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
|
||||
|
|
@ -0,0 +1,105 @@
|
|||
---
|
||||
# internal variables below
|
||||
|
||||
keycloak_config:
|
||||
home: "{{ keycloak_jboss_home }}"
|
||||
config_dir: "{{ keycloak_config_dir }}"
|
||||
bundle: "{{ keycloak_archive }}"
|
||||
service_name: "{{ keycloak_service_name }}"
|
||||
health_url: "{{ keycloak_management_url }}/health"
|
||||
cli_path: "{{ keycloak_jboss_home }}/bin/jboss-cli.sh"
|
||||
config_template_source: "{{ keycloak_config_override_template if keycloak_config_override_template | length > 0 \
|
||||
else 'standalone-ha.xml.j2' if keycloak_remote_cache_enabled else 'standalone.xml.j2' }}"
|
||||
features: "{{ keycloak_features }}"
|
||||
|
||||
# database
|
||||
keycloak_jdbc:
|
||||
postgres:
|
||||
enabled: "{{ (keycloak_ha_enabled or keycloak_db_enabled) and keycloak_jdbc_engine == 'postgres' }}"
|
||||
driver_class: org.postgresql.Driver
|
||||
xa_datasource_class: org.postgresql.xa.PGXADataSource
|
||||
driver_module_name: "org.postgresql"
|
||||
driver_module_dir: "{{ keycloak_jboss_home }}/modules/org/postgresql/main"
|
||||
driver_version: "{{ keycloak_jdbc_driver_version }}"
|
||||
driver_jar_filename: "postgresql-{{ keycloak_jdbc_driver_version }}.jar"
|
||||
driver_jar_url: >
|
||||
{{ keycloak_maven_central }}org/postgresql/postgresql/{{ keycloak_jdbc_driver_version }}/postgresql-{{ keycloak_jdbc_driver_version }}.jar
|
||||
connection_url: "{{ keycloak_jdbc_url }}"
|
||||
db_user: "{{ keycloak_db_user }}"
|
||||
db_password: "{{ keycloak_db_pass }}"
|
||||
validate_query: "{{ keycloak_db_valid_conn_sql | default('select 1') }}"
|
||||
initialize_db: >
|
||||
CREATE TABLE IF NOT EXISTS JGROUPSPING (
|
||||
own_addr varchar(200) NOT NULL,
|
||||
cluster_name varchar(200) NOT NULL,
|
||||
updated TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||||
ping_data BYTEA,
|
||||
constraint PK_JGROUPSPING PRIMARY KEY (own_addr, cluster_name))
|
||||
mariadb:
|
||||
enabled: "{{ (keycloak_ha_enabled or keycloak_db_enabled) and keycloak_jdbc_engine == 'mariadb' }}"
|
||||
driver_class: org.mariadb.jdbc.Driver
|
||||
xa_datasource_class: org.mariadb.jdbc.MariaDbDataSource
|
||||
driver_module_name: "org.mariadb"
|
||||
driver_module_dir: "{{ keycloak_jboss_home }}/modules/org/mariadb/main"
|
||||
driver_version: "{{ keycloak_jdbc_driver_version }}"
|
||||
driver_jar_filename: "mariadb-java-client-{{ keycloak_jdbc_driver_version }}.jar"
|
||||
driver_jar_url: >
|
||||
{{ keycloak_maven_central }}org/mariadb/jdbc/mariadb-java-client/{{ keycloak_jdbc_driver_version }}/mariadb-java-client-{{ keycloak_jdbc_driver_version }}.jar
|
||||
connection_url: "{{ keycloak_jdbc_url }}"
|
||||
db_user: "{{ keycloak_db_user }}"
|
||||
db_password: "{{ keycloak_db_pass }}"
|
||||
validate_query: "{{ keycloak_db_valid_conn_sql | default('select 1') }}"
|
||||
initialize_db: >
|
||||
CREATE TABLE IF NOT EXISTS JGROUPSPING (
|
||||
own_addr varchar(200) NOT NULL,
|
||||
cluster_name varchar(200) NOT NULL,
|
||||
updated TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
ping_data varbinary(5000) DEFAULT NULL,
|
||||
PRIMARY KEY (own_addr, cluster_name))
|
||||
ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin
|
||||
sqlserver:
|
||||
enabled: "{{ (keycloak_ha_enabled or keycloak_db_enabled) and keycloak_jdbc_engine == 'sqlserver' }}"
|
||||
driver_class: com.microsoft.sqlserver.jdbc.SQLServerDriver
|
||||
xa_datasource_class: com.microsoft.sqlserver.jdbc.SQLServerXADataSource
|
||||
driver_module_name: "com.microsoft.sqlserver"
|
||||
driver_module_dir: "{{ keycloak_jboss_home }}/modules/com/microsoft/sqlserver/main"
|
||||
driver_version: "{{ keycloak_jdbc_driver_version }}"
|
||||
driver_jar_filename: "mssql-java-client-{{ keycloak_jdbc_driver_version }}.jar"
|
||||
driver_jar_url: >
|
||||
{{ keycloak_maven_central }}com/microsoft/sqlserver/mssql-jdbc/{{ keycloak_jdbc_driver_version }}.jre11/mssql-jdbc-{{ keycloak_jdbc_driver_version }}.jre11.jar
|
||||
connection_url: "{{ keycloak_jdbc_url }}"
|
||||
db_user: "{{ keycloak_db_user }}"
|
||||
db_password: "{{ keycloak_db_pass }}"
|
||||
validate_query: "{{ keycloak_db_valid_conn_sql | default('select 1') }}"
|
||||
initialize_db: >
|
||||
IF NOT EXISTS (SELECT * FROM sys.objects WHERE object_id = OBJECT_ID(N'[dbo].[JGROUPSPING]') AND type in (N'U'))
|
||||
BEGIN
|
||||
CREATE TABLE JGROUPSPING (
|
||||
own_addr varchar(200) NOT NULL,
|
||||
cluster_name varchar(200) NOT NULL,
|
||||
updated DATETIME2 DEFAULT SYSUTCDATETIME(),
|
||||
ping_data varbinary(5000) DEFAULT NULL,
|
||||
PRIMARY KEY (own_addr, cluster_name))
|
||||
END
|
||||
|
||||
# reverse proxy mod_cluster
|
||||
keycloak_modcluster:
|
||||
enabled: "{{ keycloak_ha_enabled or keycloak_modcluster_enabled }}"
|
||||
reverse_proxy_urls: "{{ keycloak_modcluster_urls }}"
|
||||
frontend_url: "{{ keycloak_frontend_url }}"
|
||||
force_frontend_url: "{{ keycloak_frontend_url_force }}"
|
||||
admin_url: "{{ keycloak_admin_url | default('') }}"
|
||||
|
||||
# infinispan
|
||||
keycloak_remotecache:
|
||||
enabled: "{{ keycloak_ha_enabled }}"
|
||||
username: "{{ keycloak_infinispan_user }}"
|
||||
password: "{{ keycloak_infinispan_pass }}"
|
||||
realm: default
|
||||
sasl_mechanism: "{{ keycloak_infinispan_sasl_mechanism }}"
|
||||
server_name: "{{ keycloak_infinispan_url }}"
|
||||
use_ssl: "{{ keycloak_infinispan_use_ssl }}"
|
||||
trust_store_path: "{{ keycloak_infinispan_trust_store_path }}"
|
||||
trust_store_password: "{{ keycloak_infinispan_trust_store_password }}"
|
||||
|
||||
keycloak_maven_central: https://repo1.maven.org/maven2/
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
keycloak_varjvm_package: "{{ keycloak_jvm_package | default('java-1.8.0-openjdk-headless') }}"
|
||||
keycloak_prereq_package_list:
|
||||
- "{{ keycloak_varjvm_package }}"
|
||||
- unzip
|
||||
- procps-ng
|
||||
- initscripts
|
||||
- tzdata-java
|
||||
keycloak_sysconf_file: /etc/sysconfig/keycloak
|
||||
keycloak_pkg_java_home: "/etc/alternatives/jre_{{ keycloak_varjvm_package | regex_search('(?<=java-)[0-9.]+') }}"
|
||||
|
|
@ -0,0 +1,314 @@
|
|||
keycloak_quarkus
|
||||
================
|
||||
<!--start description -->
|
||||
Install [keycloak](https://keycloak.org/) >= 20.0.0 (quarkus) server configurations.
|
||||
<!--end description -->
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
This role requires the `python3-netaddr` and `lxml` library installed on the controller node.
|
||||
|
||||
* to install via yum/dnf: `dnf install python3-netaddr python3-lxml`
|
||||
* to install via apt: `apt install python3-netaddr python3-lxml`
|
||||
* or via the collection: `pip install -r requirements.txt`
|
||||
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
The roles depends on:
|
||||
|
||||
* [middleware_automation.common](https://github.com/ansible-middleware/common)
|
||||
* [ansible-posix](https://docs.ansible.com/ansible/latest/collections/ansible/posix/index.html)
|
||||
|
||||
To install all the dependencies via galaxy:
|
||||
|
||||
ansible-galaxy collection install -r requirements.yml
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
#### Installation options
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_version`| keycloak.org package version | `26.6.2` |
|
||||
|`keycloak_quarkus_offline_install` | Perform an offline install | `False`|
|
||||
|`keycloak_quarkus_dest`| Installation root path | `/opt/keycloak` |
|
||||
|`keycloak_quarkus_download_url` | Download URL for keycloak | `https://github.com/keycloak/keycloak/releases/download/{{ keycloak_quarkus_version }}/{{ keycloak_quarkus_archive }}` |
|
||||
|`keycloak_quarkus_download_path`| Path local to controller for offline/download of install archives | `{{ lookup('env', 'PWD') }}` |
|
||||
|
||||
|
||||
#### Service configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_bootstrap_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_quarkus_admin_user`| Deprecated, use `keycloak_quarkus_bootstrap_admin_user` instead. | |
|
||||
|`keycloak_quarkus_bind_address`| Deprecated, use `keycloak_quarkus_http_host` instead | `0.0.0.0` |
|
||||
|`keycloak_quarkus_host`| Deprecated, use `keycloak_quarkus_hostname` instead. | |
|
||||
|`keycloak_quarkus_port`| Deprecated, use `keycloak_quarkus_hostname` instead. | |
|
||||
|`keycloak_quarkus_path`| Deprecated, use `keycloak_quarkus_hostname` instead. | |
|
||||
|`keycloak_quarkus_service_user`| Posix account username | `keycloak` |
|
||||
|`keycloak_quarkus_service_group`| Posix account group | `keycloak` |
|
||||
|`keycloak_quarkus_service_restart_always`| systemd restart always behavior activation | `False` |
|
||||
|`keycloak_quarkus_service_restart_on_failure`| systemd restart on-failure behavior activation | `False` |
|
||||
|`keycloak_quarkus_service_restartsec`| systemd RestartSec | `10s` |
|
||||
|`keycloak_quarkus_jvm_package`| RHEL java package runtime | `java-21-openjdk-headless` |
|
||||
|`keycloak_quarkus_java_home`| JAVA_HOME of installed JRE, leave empty for using specified keycloak_quarkus_jvm_package RPM path | `None` |
|
||||
|`keycloak_quarkus_java_heap_opts`| Heap memory JVM setting | `-Xms1024m -Xmx2048m` |
|
||||
|`keycloak_quarkus_java_jvm_opts`| Other JVM settings | same as keycloak |
|
||||
|`keycloak_quarkus_java_opts`| JVM arguments; if overridden, it takes precedence over `keycloak_quarkus_java_*` | `{{ keycloak_quarkus_java_heap_opts + ' ' + keycloak_quarkus_java_jvm_opts }}` |
|
||||
|`keycloak_quarkus_additional_env_vars` | List of additional env variables of { key: str, value: str} to be put in sysconfig file, see https://www.keycloak.org/server/all-config | `[]` |
|
||||
|`keycloak_quarkus_frontend_url`| Deprecated, use `keycloak_quarkus_hostname` instead. | |
|
||||
|`keycloak_quarkus_admin_url`| Deprecated, use `keycloak_quarkus_hostname_admin` instead. | |
|
||||
|`keycloak_quarkus_health_check_url`| Full URL (including scheme, host, path, fragment etc.) used for health check endpoint; keycloak_quarkus_hostname will NOT be prepended; helpful when health checks should happen against http port, but keycloak_quarkus_hostname uses https scheme per default | `{{ keycloak_quarkus_hostname ~ keycloak_quarkus_http_relative_path.rstrip('/') ~ '/' ~ keycloak_quarkus_health_check_url_path }}` |
|
||||
|`keycloak_quarkus_health_check_url_path`| Path to the health check endpoint; keycloak_quarkus_hostname will be prepended automatically; Note that keycloak_quarkus_health_check_url takes precedence over this property | `realms/{{ keycloak_quarkus_master_realm }}/.well-known/openid-configuration` |
|
||||
|`keycloak_quarkus_proxy_headers`| Parse reverse proxy headers (`forwarded` or `xforwarded`) | `""` |
|
||||
|`keycloak_quarkus_config_key_store_file`| Path to the configuration key store; only used if `keycloak_quarkus_config_key_store_password` is not empty | `{{ keycloak.home }}/conf/conf_store.p12` if `keycloak_quarkus_config_key_store_password != ''`, else `''` |
|
||||
|`keycloak_quarkus_config_key_store_password`| Password of the configuration keystore; if non-empty, `keycloak_quarkus_db_pass` will be saved to the keystore at `keycloak_quarkus_config_key_store_file` instead of being written to the configuration file in clear text | `""` |
|
||||
|`keycloak_quarkus_configure_firewalld` | Ensure firewalld is running and configure keycloak ports | `False` |
|
||||
|`keycloak_quarkus_configure_iptables` | Ensure iptables is configured for keycloak ports | `False` |
|
||||
|
||||
|
||||
#### High-availability
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_ha_enabled`| Enable auto configuration for database backend, clustering and remote caches on infinispan | `False` |
|
||||
|`keycloak_quarkus_ha_discovery`| Discovery protocol for HA cluster members | `JDBCPING` |
|
||||
|`keycloak_quarkus_db_enabled`| Enable auto configuration for database backend | `True` if `keycloak_quarkus_ha_enabled` is True, else `False` |
|
||||
|`keycloak_quarkus_jgroups_ip`| Host jgroups IP. If changing this variable you must make sure it is always set for all hosts in your cluster. | `{{ ansible_default_ipv4.address }}` |
|
||||
|`keycloak_quarkus_jgroups_port`| jgroups cluster tcp port | `7800` |
|
||||
|`keycloak_quarkus_systemd_wait_for_port` | Whether systemd unit should wait for keycloak port before returning | `{{ keycloak_quarkus_ha_enabled }}` |
|
||||
|`keycloak_quarkus_systemd_wait_for_port_number`| Which port the systemd unit should wait for | `{{ keycloak_quarkus_https_port }}` |
|
||||
|`keycloak_quarkus_systemd_wait_for_log` | Whether systemd unit should wait for service to be up in logs | `false` |
|
||||
|`keycloak_quarkus_systemd_wait_for_timeout`| How long to wait for service to be alive (seconds) | `60` |
|
||||
|`keycloak_quarkus_systemd_wait_for_delay`| Activation delay for service systemd unit (seconds) | `10` |
|
||||
|`keycloak_quarkus_restart_strategy`| Strategy task file for restarting in HA (one of provided restart/['serial.yml','none.yml','serial_then_parallel.yml']) or path to file when providing custom strategy | `restart/serial.yml` |
|
||||
|`keycloak_quarkus_restart_health_check`| Whether to wait for successful health check after restart | `true` |
|
||||
|`keycloak_quarkus_restart_health_check_delay`| Seconds to let pass before starting healch checks | `10` |
|
||||
|`keycloak_quarkus_restart_health_check_retries`| Number of attempts for successful health check before failing | `25` |
|
||||
|`keycloak_quarkus_validate_certs`| Whether to validate SSL certificates when performing health checks | `true` |
|
||||
|`keycloak_quarkus_restart_pause`| Seconds to wait between restarts in HA strategy | `15` |
|
||||
|
||||
|
||||
#### Hostname configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_hostname`| Address at which is the server exposed. Can be a full URL, or just a hostname. When only hostname is provided, scheme, port and context path are resolved from the request. | |
|
||||
|`keycloak_quarkus_hostname_admin`| Set the base URL for accessing the administration console, including scheme, host, port and path | `` |
|
||||
|`keycloak_quarkus_hostname_strict`| Disables dynamically resolving the hostname from request headers | `true` |
|
||||
|`keycloak_quarkus_hostname_backchannel_dynamic`| Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path. Set to true if your application accesses Keycloak via a private network. If set to true, hostname option needs to be specified as a full URL. | `false` |
|
||||
|`keycloak_quarkus_hostname_strict_backchannel`| Deprecated, use (the inverted!)`keycloak_quarkus_hostname_backchannel_dynamic` instead. | |
|
||||
|
||||
|
||||
#### HTTP(S) configuration
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_http_relative_path`| Set the path relative to / for serving resources. The path must start with a / | `/` |
|
||||
|`keycloak_quarkus_http_host`| The http host, ie. the address used to bind the service | `0.0.0.0` |
|
||||
|`keycloak_quarkus_http_port`| HTTP listening port | `8080` |
|
||||
|`keycloak_quarkus_https_port`| TLS HTTP listening port | `8443` |
|
||||
|`keycloak_quarkus_http_management_port`| Port of the management interface. Relevant only when something is exposed on the management interface - see the guide for details. | `9000` |
|
||||
|`keycloak_quarkus_https_key_store_file`| The file path to the key store | `{{ keycloak.home }}/conf/key_store.p12` |
|
||||
|`keycloak_quarkus_https_key_store_password`| Password for the key store | `""` |
|
||||
|`keycloak_quarkus_https_trust_store_enabled`| Enable configuration of the https trust store | `False` |
|
||||
|`keycloak_quarkus_https_trust_store_file`| The file path to the trust store | `{{ keycloak.home }}/conf/trust_store.p12` |
|
||||
|`keycloak_quarkus_https_trust_store_password`| Password for the trust store | `""` |
|
||||
|`keycloak_quarkus_https_key_file_enabled`| Enable listener on HTTPS port | `False` |
|
||||
|`keycloak_quarkus_key_file_copy_enabled`| Enable copy of key file to target host | `False` |
|
||||
|`keycloak_quarkus_key_content`| Content of the TLS private key. Use `"{{ lookup('file', 'server.key.pem') }}"` to lookup a file. | `""` |
|
||||
|`keycloak_quarkus_key_file`| The file path to a private key in PEM format | `/etc/pki/tls/private/server.key.pem` |
|
||||
|`keycloak_quarkus_cert_file_copy_enabled`| Enable copy of cert file to target host | `False`|
|
||||
|`keycloak_quarkus_cert_file_src`| Set the source file path | `""` |
|
||||
|`keycloak_quarkus_cert_file`| The file path to a server certificate or certificate chain in PEM format | `/etc/pki/tls/certs/server.crt.pem` |
|
||||
|`keycloak_quarkus_https_key_store_enabled`| Enable configuration of HTTPS via a key store | `False` |
|
||||
|`keycloak_quarkus_key_store_file`| Deprecated, use `keycloak_quarkus_https_key_store_file` instead. ||
|
||||
|`keycloak_quarkus_key_store_password`| Deprecated, use `keycloak_quarkus_https_key_store_password` instead.||
|
||||
|`keycloak_quarkus_http_relative_path` | Set the path relative to / for serving resources. The path must start with a / | `/` |
|
||||
|`keycloak_quarkus_http_management_relative_path` | Set the path relative to / for serving resources from management interface. The path must start with a /. If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details. | `/` |
|
||||
|`keycloak_quarkus_http_enabled`| Enable listener on HTTP port | `True` |
|
||||
|
||||
|
||||
#### Infinispan configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
| :------------------------------------------------- | :------------------------------ | :----------------------------------------------------------- |
|
||||
| `keycloak_quarkus_cache_managed_infinispan_config` | Manage infinispan configuration | `"{{ keycloak_quarkus_version is version('26.4.0', '<') }}"` |
|
||||
| `keycloak_quarkus_cache_infinispan_template` | Infinispan cache template file | `cache-ispn.xml` |
|
||||
|
||||
As explained in the [official documentation](https://www.keycloak.org/server/caching#_modifying_cache_configuration_defaults), since version 26.4, it is recommended not to modify the XML configuration file but rather to configure the cache via the keycloak.properties file. By default, the role will no longer automatically deploy this file for versions higher than 26.4.
|
||||
|
||||
For earlier versions, it is possible to override the given template to customize the cache using the `keycloak_quarkus_cache_infinispan_template` variable.
|
||||
|
||||
#### Database configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_db_engine` | Database engine [mariadb,postres,mssql] | `postgres` |
|
||||
|`keycloak_quarkus_db_user` | User for database connection | `keycloak-user` |
|
||||
|`keycloak_quarkus_db_pass` | Password for database connection | `keycloak-pass` |
|
||||
|`keycloak_quarkus_db_url` | JDBC URL for connecting to database | `jdbc:postgresql://localhost:5432/keycloak` |
|
||||
|`keycloak_quarkus_db_driver_version` | Version for JDBC engine driver | `9.4.1212` |
|
||||
|
||||
|
||||
#### Cache configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_cache_remote` | Whether to connect to remote cache infinispan server | `false` |
|
||||
|`keycloak_quarkus_cache_remote_username` | Username for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_quarkus_cache_remote_password` | Password for connecting to infinispan | `supervisor` |
|
||||
|`keycloak_quarkus_cache_remote_host` | Hostname for connecting to infinispan | `localhost` |
|
||||
|`keycloak_quarkus_cache_remote_port`| Port for connecting to infinispan | `11222` |
|
||||
|`keycloak_quarkus_cache_remote_sasl_mechanism` | Infinispan auth mechanism | `SCRAM-SHA-512` |
|
||||
|`keycloak_quarkus_cache_remote_tls_enabled` | Whether infinispan uses TLS connection | `false` |
|
||||
|`keycloak_quarkus_cache_embedded_properties` | Embedded cache properties | `` |
|
||||
|
||||
|
||||
#### Logging configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_log`| Enable one or more log handlers in a comma-separated list | `file` |
|
||||
|`keycloak_quarkus_log_level`| The log level of the root category or a comma-separated list of individual categories and their levels | `info` |
|
||||
|`keycloak_quarkus_log_file`| Set the log file path and filename relative to keycloak home | `data/log/keycloak.log` |
|
||||
|`keycloak_quarkus_log_format`| Set a format specific to file log entries | `%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n` |
|
||||
|`keycloak_quarkus_log_target`| Set the destination of the keycloak log folder link | `/var/log/keycloak` |
|
||||
|`keycloak_quarkus_log_max_file_size`| Set the maximum log file size before a log rotation happens; A size configuration option recognises string in this format (shown as a regular expression): `[0-9]+[KkMmGgTtPpEeZzYy]?`. If no suffix is given, assume bytes. | `10M` |
|
||||
|`keycloak_quarkus_log_max_backup_index`| Set the maximum number of archived log files to keep | `10` |
|
||||
|`keycloak_quarkus_log_file_suffix`| Set the log file handler rotation file suffix. When used, the file will be rotated based on its suffix; Note: If the suffix ends with `.zip` or `.gz`, the rotation file will also be compressed. | `.yyyy-MM-dd.zip` |
|
||||
|
||||
|
||||
#### Miscellaneous configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_metrics_enabled`| Whether to enable metrics | `False` |
|
||||
|`keycloak_quarkus_health_enabled`| If the server should expose health check endpoints on the management interface | `True` |
|
||||
|`keycloak_quarkus_archive` | keycloak install archive filename | `keycloak-{{ keycloak_quarkus_version }}.zip` |
|
||||
|`keycloak_quarkus_installdir` | Installation path | `{{ keycloak_quarkus_dest }}/keycloak-{{ keycloak_quarkus_version }}` |
|
||||
|`keycloak_quarkus_home` | Installation work directory | `{{ keycloak_quarkus_installdir }}` |
|
||||
|`keycloak_quarkus_config_dir` | Path for configuration | `{{ keycloak_quarkus_home }}/conf` |
|
||||
|`keycloak_quarkus_master_realm` | Name for rest authentication realm | `master` |
|
||||
|`keycloak_auth_client` | Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_quarkus_force_install` | Remove pre-existing versions of service | `False` |
|
||||
|`keycloak_quarkus_proxy_mode`| The proxy address forwarding mode if the server is behind a reverse proxy (deprecated) | `none` |
|
||||
|`keycloak_quarkus_start_dev`| Whether to start the service in development mode (start-dev) | `False` |
|
||||
|`keycloak_quarkus_transaction_xa_enabled`| Whether to use XA transactions | `True` |
|
||||
|`keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route`| If the route should be attached to cookies to reflect the node that owns a particular session. If false, route is not attached to cookies and we rely on the session affinity capabilities from reverse proxy | `True` |
|
||||
|`keycloak_quarkus_show_deprecation_warnings`| Whether deprecation warnings should be shown | `True` |
|
||||
|
||||
|
||||
#### Vault configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_ks_vault_enabled`| Whether to enable the vault SPI | `false` |
|
||||
|`keycloak_quarkus_ks_vault_file`| The keystore path for the vault SPI | `{{ keycloak_quarkus_config_dir }}/keystore.p12` |
|
||||
|`keycloak_quarkus_ks_vault_type`| Type of the keystore used for the vault SPI | `PKCS12` |
|
||||
|
||||
|
||||
#### Configuring providers
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_providers`| List of provider definitions; see below | `[]` |
|
||||
|
||||
Providers support different sources:
|
||||
|
||||
* `url`: http download for providers not requiring authentication
|
||||
* `maven`: maven download for providers hosted publicly on Apache Maven Central or private Maven repositories like Github Maven requiring authentication
|
||||
* `local_path`: static providers to be uploaded
|
||||
|
||||
Provider definition:
|
||||
|
||||
```yaml
|
||||
keycloak_quarkus_providers:
|
||||
- id: http-client # required; "{{ id }}.jar" identifies the file name on RHBK
|
||||
spi: connections # required if neither url, local_path nor maven are specified; required for setting properties
|
||||
default: true # optional, whether to set default for spi, default false
|
||||
restart: true # optional, whether to rebuild config and restart the service after deploying, default true
|
||||
url: https://.../.../custom_spi.jar # optional, url for download via http
|
||||
local_path: my_theme_spi.jar # optional, path on local controller for SPI to be uploaded
|
||||
remote: true # optional, whether to copy from localhost or remotely, see https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy_module.html#parameter-remote_src, default false
|
||||
maven: # optional, for download using maven
|
||||
repository_url: https://maven.pkg.github.com/OWNER/REPOSITORY # optional, maven repo url
|
||||
group_id: my.group # optional, maven group id
|
||||
artifact_id: artifact # optional, maven artifact id
|
||||
version: 24.0.5 # optional, defaults to latest
|
||||
username: user # optional, cf. https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-apache-maven-registry#authenticating-to-github-packages
|
||||
password: pat # optional, provide a PAT for accessing Github's Apache Maven registry
|
||||
properties: # optional, list of key-values
|
||||
- key: default-connection-pool-size
|
||||
value: 10
|
||||
checksum: sha256:D98291AC[...]B6DC7B97 # optional, checksum used to verify integrity:
|
||||
# for `url` SPIs, use format: <algorithm>:<checksum|url>, cf. <https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#parameter-checksum>;
|
||||
# for `local_path` SPIs, use SHA1 format <https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy_module.html#parameter-checksum>
|
||||
# for `maven` SPIs, this field is ignored since maven has integrity verification methods enabled by default
|
||||
```
|
||||
|
||||
the definition above will generate the following build command:
|
||||
|
||||
```
|
||||
bin/kc.sh build --spi-connections-provider=http-client --spi-connections-http-client-default-connection-pool-size=10
|
||||
```
|
||||
|
||||
|
||||
#### Configuring policies
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_quarkus_policies`| List of policy definitions; see below | `[]` |
|
||||
|
||||
Provider definition:
|
||||
|
||||
```yaml
|
||||
keycloak_quarkus_policies:
|
||||
- name: john-the-ripper.txt # required, resulting file name
|
||||
url: https://github.com/danielmiessler/SecLists/raw/master/Passwords/Software/john-the-ripper.txt # required, url for download
|
||||
type: password-blacklists # optional, defaults to `password-blacklists`; supported values: [`password-blacklists`]
|
||||
```
|
||||
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
| Variable | Description | Required |
|
||||
|:---------|:------------|----------|
|
||||
|`keycloak_quarkus_bootstrap_admin_password`| Password of console admin account | `yes` |
|
||||
|`keycloak_quarkus_admin_pass`| Deprecated, use `keycloak_quarkus_bootstrap_admin_password` instead. | |
|
||||
|`keycloak_quarkus_ks_vault_pass`| The password for accessing the keystore vault SPI | `no` |
|
||||
|`keycloak_quarkus_alternate_download_url`| Alternate location with optional authentication for downloading RHBK | `no` |
|
||||
|`keycloak_quarkus_download_user`| Optional username for http authentication | `no*` |
|
||||
|`keycloak_quarkus_download_pass`| Optional password for http authentication | `no*` |
|
||||
|`keycloak_quarkus_download_validate_certs`| Whether to validate certs for URL `keycloak_quarkus_alternate_download_url` | `no` |
|
||||
|`keycloak_quarkus_jdbc_download_user`| Optional username for http authentication | `no*` |
|
||||
|`keycloak_quarkus_jdbc_download_pass`| Optional password for http authentication | `no*` |
|
||||
|`keycloak_quarkus_jdbc_download_validate_certs`| Whether to validate certs for URL `keycloak_quarkus_download_validate_certs` | `no` |
|
||||
|
||||
`*` username/password authentication credentials must be both declared or both undefined
|
||||
|
||||
|
||||
Role custom facts
|
||||
-----------------
|
||||
|
||||
The role uses the following [custom facts](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_vars_facts.html#adding-custom-facts) found in `/etc/ansible/facts.d/keycloak.fact` (and thus identified by the `ansible_local.keycloak.` prefix):
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`general.bootstrapped` | A custom fact indicating whether this role has been used for bootstrapping keycloak on the respective host before; set to `false` (e.g., when starting off with a new, empty database) ensures that the initial admin user as defined by `keycloak_quarkus_bootstrap_admin_user[_password]` gets created |
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
|
|
@ -0,0 +1,194 @@
|
|||
---
|
||||
### Configuration specific to keycloak
|
||||
keycloak_quarkus_version: 26.6.2
|
||||
keycloak_quarkus_archive: "keycloak-{{ keycloak_quarkus_version }}.zip"
|
||||
keycloak_quarkus_download_url: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak_quarkus_version }}/{{ keycloak_quarkus_archive }}"
|
||||
keycloak_quarkus_installdir: "{{ keycloak_quarkus_dest }}/keycloak-{{ keycloak_quarkus_version }}"
|
||||
|
||||
# Authentication for Keycloak binary download (e.g. from internal artifact repository)
|
||||
keycloak_quarkus_binary_download_user:
|
||||
keycloak_quarkus_binary_download_pass:
|
||||
|
||||
# whether to install from local archive
|
||||
keycloak_quarkus_offline_install: false
|
||||
|
||||
keycloak_quarkus_show_deprecation_warnings: true
|
||||
|
||||
### Install location and service settings
|
||||
keycloak_quarkus_java_home:
|
||||
keycloak_quarkus_dest: /opt/keycloak
|
||||
keycloak_quarkus_home: "{{ keycloak_quarkus_installdir }}"
|
||||
keycloak_quarkus_config_dir: "{{ keycloak_quarkus_home }}/conf"
|
||||
keycloak_quarkus_download_path: "{{ lookup('env', 'PWD') }}"
|
||||
keycloak_quarkus_start_dev: false
|
||||
keycloak_quarkus_service_user: keycloak
|
||||
keycloak_quarkus_service_group: keycloak
|
||||
keycloak_quarkus_service_restart_always: false
|
||||
keycloak_quarkus_service_restart_on_failure: false
|
||||
keycloak_quarkus_service_restartsec: "10s"
|
||||
|
||||
keycloak_quarkus_configure_firewalld: false
|
||||
keycloak_quarkus_configure_iptables: false
|
||||
|
||||
### administrator console password
|
||||
keycloak_quarkus_bootstrap_admin_user: admin
|
||||
keycloak_quarkus_bootstrap_admin_password:
|
||||
keycloak_quarkus_master_realm: master
|
||||
|
||||
### Configuration settings
|
||||
keycloak_quarkus_bind_address: 0.0.0.0 # deprecated use keycloak_quarkus_http_host
|
||||
keycloak_quarkus_http_host: 0.0.0.0
|
||||
keycloak_quarkus_http_enabled: true
|
||||
keycloak_quarkus_http_port: 8080
|
||||
keycloak_quarkus_https_port: 8443
|
||||
keycloak_quarkus_http_management_port: 9000
|
||||
keycloak_quarkus_jgroups_port: 7800
|
||||
keycloak_quarkus_jgroups_bind_address: "{{ ansible_default_ipv4.address }}"
|
||||
keycloak_quarkus_jgroups_external_addr: "{{ keycloak_quarkus_jgroups_bind_address }}"
|
||||
keycloak_quarkus_jgroups_external_port: "{{ keycloak_quarkus_jgroups_port }}"
|
||||
keycloak_quarkus_java_heap_opts: "-Xms1024m -Xmx2048m"
|
||||
keycloak_quarkus_java_jvm_opts: >
|
||||
-XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8
|
||||
-Dsun.err.encoding=UTF-8 -Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8 -XX:+ExitOnOutOfMemoryError
|
||||
-Djava.security.egd=file:/dev/urandom -XX:+UseParallelGC -XX:GCTimeRatio=4
|
||||
-XX:AdaptiveSizePolicyWeight=90 -XX:FlightRecorderOptions=stackdepth=512
|
||||
keycloak_quarkus_jgroups_opts: >
|
||||
-Djgroups.bind.address={{ keycloak_quarkus_jgroups_bind_address }}
|
||||
-Djgroups.external_port={{ keycloak_quarkus_jgroups_external_port }}
|
||||
-Djgroups.external_addr={{ keycloak_quarkus_jgroups_external_addr }}
|
||||
keycloak_quarkus_java_opts: "{{ ' '.join((keycloak_quarkus_jgroups_opts, keycloak_quarkus_java_heap_opts, keycloak_quarkus_java_jvm_opts)) }}"
|
||||
keycloak_quarkus_additional_env_vars: []
|
||||
|
||||
### TLS/HTTPS configuration
|
||||
keycloak_quarkus_https_key_file_enabled: false
|
||||
keycloak_quarkus_key_file_copy_enabled: false
|
||||
keycloak_quarkus_key_content: ""
|
||||
keycloak_quarkus_key_file: "/etc/pki/tls/private/server.key.pem"
|
||||
keycloak_quarkus_cert_file_copy_enabled: false
|
||||
keycloak_quarkus_cert_file_src: ""
|
||||
keycloak_quarkus_cert_file: "/etc/pki/tls/certs/server.crt.pem"
|
||||
#### key store configuration
|
||||
keycloak_quarkus_https_key_store_enabled: false
|
||||
keycloak_quarkus_https_key_store_file: "{{ keycloak.home }}/conf/key_store.p12"
|
||||
keycloak_quarkus_https_key_store_password: ''
|
||||
##### trust store configuration
|
||||
keycloak_quarkus_https_trust_store_enabled: false
|
||||
keycloak_quarkus_https_trust_store_file: "{{ keycloak.home }}/conf/trust_store.p12"
|
||||
keycloak_quarkus_https_trust_store_password: ''
|
||||
### configuration key store configuration
|
||||
keycloak_quarkus_config_key_store_file: "{{ keycloak.home }}/conf/conf_store.p12"
|
||||
keycloak_quarkus_config_key_store_password: ''
|
||||
|
||||
### Enable configuration for database backend, clustering and remote caches on infinispan
|
||||
keycloak_quarkus_ha_enabled: false
|
||||
keycloak_quarkus_ha_discovery: "JDBCPING"
|
||||
### Enable database configuration, must be enabled when HA is configured
|
||||
keycloak_quarkus_db_enabled: "{{ keycloak_quarkus_ha_enabled }}"
|
||||
keycloak_quarkus_systemd_wait_for_port: "{{ keycloak_quarkus_ha_enabled }}"
|
||||
keycloak_quarkus_systemd_wait_for_port_number: "{{ keycloak_quarkus_https_port }}"
|
||||
keycloak_quarkus_systemd_wait_for_log: false
|
||||
keycloak_quarkus_systemd_wait_for_timeout: 60
|
||||
keycloak_quarkus_systemd_wait_for_delay: 10
|
||||
|
||||
### keycloak frontend url
|
||||
keycloak_quarkus_hostname:
|
||||
keycloak_quarkus_hostname_admin: ""
|
||||
|
||||
### Set the path relative to / for serving resources. The path must start with a /
|
||||
### (set to `/auth` for retrocompatibility with pre-quarkus releases)
|
||||
keycloak_quarkus_http_relative_path: /
|
||||
|
||||
# Disables dynamically resolving the hostname from request headers.
|
||||
# Should always be set to true in production, unless proxy verifies the Host header.
|
||||
keycloak_quarkus_hostname_strict: true
|
||||
# Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path.
|
||||
# Set to true if your application accesses Keycloak via a private network. If set to true, keycloak_quarkus_hostname option needs to be specified as a full URL.
|
||||
keycloak_quarkus_hostname_backchannel_dynamic: false
|
||||
|
||||
# The proxy headers that should be accepted by the server. ['', 'forwarded', 'xforwarded']
|
||||
keycloak_quarkus_proxy_headers: ""
|
||||
|
||||
# deprecated: proxy address forwarding mode if the server is behind a reverse proxy. [none, edge, reencrypt, passthrough]
|
||||
keycloak_quarkus_proxy_mode: none
|
||||
|
||||
# disable xa transactions
|
||||
keycloak_quarkus_transaction_xa_enabled: true
|
||||
|
||||
# If the route should be attached to cookies to reflect the node that owns a particular session.
|
||||
# If false, route is not attached to cookies and we rely on the session affinity capabilities from reverse proxy
|
||||
keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route: true
|
||||
|
||||
keycloak_quarkus_metrics_enabled: false
|
||||
keycloak_quarkus_health_enabled: true
|
||||
|
||||
### infinispan; must read: https://forum.keycloak.org/t/keycloak-26-4-7-ha/31202
|
||||
keycloak_quarkus_cache_managed_infinispan_config: "{{ keycloak_quarkus_version is version('26.4.0', '<') }}"
|
||||
keycloak_quarkus_cache_infinispan_template: cache-ispn.xml
|
||||
|
||||
### caches; must read: https://www.keycloak.org/2024/12/storing-sessions-in-kc26
|
||||
### embedded caches
|
||||
# https://www.keycloak.org/server/caching
|
||||
keycloak_quarkus_cache_embedded_properties: ""
|
||||
|
||||
### infinispan remote caches access (hotrod)
|
||||
# https://www.keycloak.org/server/caching#_remote_cache
|
||||
keycloak_quarkus_cache_remote: false
|
||||
keycloak_quarkus_cache_remote_username: supervisor
|
||||
keycloak_quarkus_cache_remote_password: supervisor
|
||||
keycloak_quarkus_cache_remote_host: localhost
|
||||
keycloak_quarkus_cache_remote_port: 11222
|
||||
keycloak_quarkus_cache_remote_tls_enabled: false
|
||||
keycloak_quarkus_cache_remote_sasl_mechanism: SCRAM-SHA-512
|
||||
|
||||
|
||||
### database backend engine: values [ 'postgres', 'mariadb' ]
|
||||
keycloak_quarkus_db_engine: postgres
|
||||
### database backend credentials
|
||||
keycloak_quarkus_db_user: keycloak-user
|
||||
keycloak_quarkus_db_pass: keycloak-pass
|
||||
keycloak_quarkus_db_url: "{{ keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].url }}"
|
||||
keycloak_quarkus_db_driver_version: "{{ keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].version }}"
|
||||
# override the variables above, following defaults show recommended version as per
|
||||
# https://access.redhat.com/articles/7033107
|
||||
keycloak_quarkus_default_jdbc:
|
||||
postgres:
|
||||
url: 'jdbc:postgresql://localhost:5432/keycloak'
|
||||
version: 42.7.7
|
||||
mariadb:
|
||||
url: 'jdbc:mariadb://localhost:3306/keycloak'
|
||||
version: 3.5.2
|
||||
mssql:
|
||||
url: 'jdbc:sqlserver://localhost:1433;databaseName=keycloak;'
|
||||
version: 13.2.0
|
||||
driver_jar_url: "https://repo1.maven.org/maven2/com/microsoft/sqlserver/mssql-jdbc/13.2.0.jre11/mssql-jdbc-13.2.0.jre11.jar"
|
||||
### logging configuration
|
||||
keycloak_quarkus_log: file
|
||||
keycloak_quarkus_log_level: info
|
||||
keycloak_quarkus_log_file: data/log/keycloak.log
|
||||
keycloak_quarkus_log_format: '%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n'
|
||||
keycloak_quarkus_log_target: /var/log/keycloak
|
||||
keycloak_quarkus_log_max_file_size: 10M
|
||||
keycloak_quarkus_log_max_backup_index: 10
|
||||
keycloak_quarkus_log_file_suffix: '.yyyy-MM-dd.zip'
|
||||
|
||||
# keystore-based vault
|
||||
keycloak_quarkus_ks_vault_enabled: false
|
||||
keycloak_quarkus_ks_vault_file: "{{ keycloak_quarkus_config_dir }}/keystore.p12"
|
||||
keycloak_quarkus_ks_vault_type: PKCS12
|
||||
keycloak_quarkus_ks_vault_pass:
|
||||
|
||||
keycloak_quarkus_providers: []
|
||||
keycloak_quarkus_policies: []
|
||||
keycloak_quarkus_supported_policy_types: ['password-blacklists']
|
||||
|
||||
# files in restart directory (one of [ 'serial', 'none', 'serial_then_parallel' ]), or path to file when providing custom strategy
|
||||
keycloak_quarkus_restart_strategy: restart/serial.yml
|
||||
keycloak_quarkus_restart_health_check: true
|
||||
keycloak_quarkus_restart_health_check_delay: 10
|
||||
keycloak_quarkus_restart_health_check_retries: 25
|
||||
keycloak_quarkus_validate_certs: true
|
||||
keycloak_quarkus_health_check_url_path: "realms/{{ keycloak_quarkus_master_realm }}/.well-known/openid-configuration"
|
||||
keycloak_quarkus_health_check_url: "{{ keycloak_quarkus_hostname ~ keycloak_quarkus_http_relative_path.rstrip('/') ~ '/' ~ keycloak_quarkus_health_check_url_path }}"
|
||||
keycloak_quarkus_restart_pause: 15
|
||||
|
||||
keycloak_quarkus_force_install: false
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
---
|
||||
- name: "Invalidate theme cache: {{ keycloak.service_name }}"
|
||||
ansible.builtin.include_tasks: invalidate_theme_cache.yml
|
||||
listen: "invalidate keycloak theme cache"
|
||||
# handler should be invoked anytime a [build configuration](https://www.keycloak.org/server/all-config?f=build) changes
|
||||
- name: "Rebuild config: {{ keycloak.service_name }}"
|
||||
ansible.builtin.include_tasks: rebuild_config.yml
|
||||
listen: "rebuild keycloak config"
|
||||
- name: "Bootstrapped"
|
||||
ansible.builtin.include_tasks: bootstrapped.yml
|
||||
listen: bootstrapped
|
||||
- name: "Restart {{ keycloak.service_name }}"
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ keycloak_quarkus_restart_strategy if keycloak_quarkus_ha_enabled else 'restart.yml' }}"
|
||||
listen: "restart keycloak"
|
||||
- name: "Display deprecation warning"
|
||||
ansible.builtin.fail:
|
||||
msg: "Deprecation warning: you are using the deprecated variable '{{ keycloak_quarkus_deprecated_variable | d('NotSet') }}', check docs on how to upgrade."
|
||||
failed_when: false
|
||||
changed_when: true
|
||||
listen: "print deprecation warning"
|
||||
|
|
@ -0,0 +1,573 @@
|
|||
argument_specs:
|
||||
main:
|
||||
options:
|
||||
keycloak_quarkus_version:
|
||||
default: "26.6.2"
|
||||
description: "keycloak.org package version"
|
||||
type: "str"
|
||||
keycloak_quarkus_archive:
|
||||
default: "keycloak-{{ keycloak_quarkus_version }}.zip"
|
||||
description: "keycloak install archive filename"
|
||||
type: "str"
|
||||
keycloak_quarkus_download_url:
|
||||
default: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak_quarkus_version }}/{{ keycloak_quarkus_archive }}"
|
||||
description: "Download URL for keycloak"
|
||||
type: "str"
|
||||
keycloak_quarkus_installdir:
|
||||
default: "{{ keycloak_quarkus_dest }}/keycloak-{{ keycloak_quarkus_version }}"
|
||||
description: "Installation path"
|
||||
type: "str"
|
||||
keycloak_quarkus_offline_install:
|
||||
default: false
|
||||
description: "Perform an offline install"
|
||||
type: "bool"
|
||||
keycloak_quarkus_jvm_package:
|
||||
default: "java-21-openjdk-headless"
|
||||
description: "RHEL java package runtime"
|
||||
type: "str"
|
||||
keycloak_quarkus_java_home:
|
||||
description: "JAVA_HOME of installed JRE, leave empty for using specified keycloak_jvm_package RPM path"
|
||||
type: "str"
|
||||
keycloak_quarkus_dest:
|
||||
default: "/opt/keycloak"
|
||||
description: "Installation root path"
|
||||
type: "str"
|
||||
keycloak_quarkus_home:
|
||||
default: "{{ keycloak_quarkus_installdir }}"
|
||||
description: "Installation work directory"
|
||||
type: "str"
|
||||
keycloak_quarkus_config_dir:
|
||||
default: "{{ keycloak_quarkus_home }}/conf"
|
||||
description: "Path for configuration"
|
||||
type: "str"
|
||||
keycloak_quarkus_service_user:
|
||||
default: "keycloak"
|
||||
description: "Posix account username"
|
||||
type: "str"
|
||||
keycloak_quarkus_service_group:
|
||||
default: "keycloak"
|
||||
description: "Posix account group"
|
||||
type: "str"
|
||||
keycloak_quarkus_configure_firewalld:
|
||||
default: false
|
||||
description: "Ensure firewalld is running and configure keycloak ports"
|
||||
type: "bool"
|
||||
keycloak_quarkus_configure_iptables:
|
||||
default: false
|
||||
description: "Ensure firewalld is running and configure keycloak ports"
|
||||
type: "bool"
|
||||
keycloak_quarkus_service_restart_always:
|
||||
default: false
|
||||
description: "systemd restart always behavior of service; takes precedence over keycloak_service_restart_on_failure if true"
|
||||
type: "bool"
|
||||
keycloak_quarkus_service_restart_on_failure:
|
||||
default: false
|
||||
description: "systemd restart on-failure behavior of service"
|
||||
type: "bool"
|
||||
keycloak_quarkus_service_restartsec:
|
||||
default: "10s"
|
||||
description: "systemd RestartSec for service"
|
||||
type: "str"
|
||||
keycloak_quarkus_bootstrap_admin_user:
|
||||
default: "admin"
|
||||
description: "Administration user account, only for bootstrapping"
|
||||
type: "str"
|
||||
keycloak_quarkus_force_install:
|
||||
default: false
|
||||
description: "Remove pre-existing versions of service"
|
||||
type: "bool"
|
||||
keycloak_quarkus_bootstrap_admin_password:
|
||||
required: true
|
||||
description: "Password of admin account, only for bootstrapping"
|
||||
type: "str"
|
||||
keycloak_quarkus_master_realm:
|
||||
default: "master"
|
||||
description: "Name for rest authentication realm"
|
||||
type: "str"
|
||||
keycloak_quarkus_bind_address:
|
||||
default: "0.0.0.0"
|
||||
description: "Deprecated, use `keycloak_quarkus_http_host`"
|
||||
type: "str"
|
||||
keycloak_quarkus_hostname:
|
||||
description: >-
|
||||
Address at which is the server exposed.
|
||||
Can be a full URL, or just a hostname. When only hostname is provided, scheme, port and context path are resolved from the request.
|
||||
type: "str"
|
||||
keycloak_quarkus_host:
|
||||
description: "Deprecated in v26, use keycloak_quarkus_hostname instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_port:
|
||||
description: "Deprecated in v26, use keycloak_quarkus_hostname instead."
|
||||
type: "int"
|
||||
keycloak_quarkus_path:
|
||||
description: "Deprecated in v26, use keycloak_quarkus_hostname instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_http_enabled:
|
||||
default: true
|
||||
description: "Enable listener on HTTP port"
|
||||
type: "bool"
|
||||
keycloak_quarkus_http_host:
|
||||
default: '0.0.0.0'
|
||||
description: "HTTP host, address for binding service ports"
|
||||
type: "str"
|
||||
keycloak_quarkus_http_port:
|
||||
default: 8080
|
||||
description: "HTTP port"
|
||||
type: "int"
|
||||
keycloak_quarkus_health_check_url:
|
||||
default: "{{ keycloak_quarkus_hostname ~ keycloak_quarkus_http_relative_path.rstrip('/') ~ '/' ~ keycloak_quarkus_health_check_url_path }}"
|
||||
description: "Full URL (including scheme, host, path, fragment etc.) used for health check endpoint; keycloak_quarkus_hostname will NOT be prepended; helpful when health checks should happen against http port, but keycloak_quarkus_hostname uses https scheme per default"
|
||||
type: "str"
|
||||
keycloak_quarkus_health_check_url_path:
|
||||
default: "realms/{{ keycloak_quarkus_master_realm }}/.well-known/openid-configuration"
|
||||
description: "Path to the health check endpoint; keycloak_quarkus_hostname will be prepended automatically; Note that keycloak_quarkus_health_check_url takes precedence over this property"
|
||||
type: "str"
|
||||
keycloak_quarkus_https_key_file_enabled:
|
||||
default: false
|
||||
description: "Enable configuration of HTTPS via files in PEM format"
|
||||
type: "bool"
|
||||
keycloak_quarkus_key_file_copy_enabled:
|
||||
default: false
|
||||
description: "Enable copy of key file to target host"
|
||||
type: "bool"
|
||||
keycloak_quarkus_key_content:
|
||||
default: ""
|
||||
description: "Content of the TLS private key"
|
||||
type: "str"
|
||||
keycloak_quarkus_key_file:
|
||||
default: "/etc/pki/tls/private/server.key.pem"
|
||||
description: "The file path to a private key in PEM format"
|
||||
type: "str"
|
||||
keycloak_quarkus_cert_file_copy_enabled:
|
||||
default: false
|
||||
description: "Enable copy of cert file to target host"
|
||||
type: "bool"
|
||||
keycloak_quarkus_cert_file_src:
|
||||
default: ""
|
||||
description: "Set the source file path"
|
||||
type: "str"
|
||||
keycloak_quarkus_cert_file:
|
||||
default: "/etc/pki/tls/certs/server.crt.pem"
|
||||
description: "The file path to a server certificate or certificate chain in PEM format"
|
||||
type: "str"
|
||||
keycloak_quarkus_https_key_store_enabled:
|
||||
default: false
|
||||
description: "Enable configuration of HTTPS via a key store"
|
||||
type: "bool"
|
||||
keycloak_quarkus_key_store_file:
|
||||
default: ""
|
||||
description: "Deprecated, use `keycloak_quarkus_https_key_store_file` instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_key_store_password:
|
||||
default: ""
|
||||
description: "Deprecated, use `keycloak_quarkus_https_key_store_password` instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_https_key_store_file:
|
||||
default: "{{ keycloak.home }}/conf/key_store.p12"
|
||||
description: "The file path to the key store"
|
||||
type: "str"
|
||||
keycloak_quarkus_https_key_store_password:
|
||||
default: ""
|
||||
description: "Password for the key store"
|
||||
type: "str"
|
||||
keycloak_quarkus_https_trust_store_enabled:
|
||||
default: false
|
||||
description: "Enable configuration of the https trust store"
|
||||
type: "bool"
|
||||
keycloak_quarkus_https_trust_store_file:
|
||||
default: "{{ keycloak.home }}/conf/trust_store.p12"
|
||||
description: "The file path to the trust store"
|
||||
type: "str"
|
||||
keycloak_quarkus_https_trust_store_password:
|
||||
default: ""
|
||||
description: "Password for the trust store"
|
||||
type: "str"
|
||||
keycloak_quarkus_config_key_store_file:
|
||||
default: "{{ keycloak.home }}/conf/conf_store.p12"
|
||||
description: "Path to the configuration key store; only used if `keycloak_quarkus_config_key_store_password` is not empty"
|
||||
type: "str"
|
||||
keycloak_quarkus_config_key_store_password:
|
||||
default: ""
|
||||
description: >
|
||||
Password of the configuration key store; if non-empty, `keycloak_quarkus_db_pass` will be saved to the key store
|
||||
at `keycloak_quarkus_config_key_store_file` (instead of being written to the configuration file in clear text)
|
||||
type: "str"
|
||||
keycloak_quarkus_https_port:
|
||||
default: 8443
|
||||
description: "HTTPS port"
|
||||
type: "int"
|
||||
keycloak_quarkus_http_management_port:
|
||||
default: 9000
|
||||
description: "Port of the management interface. Relevant only when something is exposed on the management interface - see the guide for details."
|
||||
type: "int"
|
||||
keycloak_quarkus_jgroups_port:
|
||||
description: 'jgroups bind port'
|
||||
default: 7800
|
||||
type: "int"
|
||||
keycloak_quarkus_jgroups_bind_address:
|
||||
description: 'jgroups bind address'
|
||||
default: "{{ ansible_default_ipv4.address }}"
|
||||
type: "str"
|
||||
keycloak_quarkus_jgroups_external_addr:
|
||||
description: 'IP address that other instances in the Keycloak should use to contact this node'
|
||||
default: "{{ keycloak_quarkus_jgroups_bind_address }}"
|
||||
type: "str"
|
||||
keycloak_quarkus_jgroups_external_port:
|
||||
description: 'Port that other instances in the Keycloak cluster should use to contact this node'
|
||||
default: "{{ keycloak_quarkus_jgroups_port }}"
|
||||
type: "int"
|
||||
keycloak_quarkus_jgroups_opts:
|
||||
description: "JVM arguments for jgroups configuration"
|
||||
default: "-Djgroups.bind.address={{ keycloak_quarkus_jgroups_bind_address }} -Djgroups.external_port={{ keycloak_quarkus_jgroups_external_port }} -Djgroups.external_addr={{ keycloak_quarkus_jgroups_external_addr }}"
|
||||
type: "str"
|
||||
keycloak_quarkus_java_heap_opts:
|
||||
default: "-Xms1024m -Xmx2048m"
|
||||
description: "Heap memory JVM setting"
|
||||
type: "str"
|
||||
keycloak_quarkus_java_jvm_opts:
|
||||
default: >
|
||||
-XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.err.encoding=UTF-8
|
||||
-Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8 -XX:+ExitOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -XX:+UseParallelGC
|
||||
-XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -XX:FlightRecorderOptions=stackdepth=512
|
||||
description: "Other JVM settings"
|
||||
type: "str"
|
||||
keycloak_quarkus_java_opts:
|
||||
default: "{{ ' '.join((keycloak_quarkus_jgroups_opts, keycloak_quarkus_java_heap_opts, keycloak_quarkus_java_jvm_opts)) }}"
|
||||
description: "JVM arguments, by default heap_opts + jvm_opts, if overriden it takes precedence over them"
|
||||
type: "str"
|
||||
keycloak_quarkus_additional_env_vars:
|
||||
default: "[]"
|
||||
description: "List of additional env variables of { key: str, value: str} to be put in sysconfig file"
|
||||
type: "list"
|
||||
keycloak_quarkus_ha_enabled:
|
||||
default: false
|
||||
description: "Enable auto configuration for database backend, clustering and remote caches on infinispan"
|
||||
type: "bool"
|
||||
keycloak_quarkus_ha_discovery:
|
||||
default: "TCPPING"
|
||||
description: "Discovery protocol for HA cluster members"
|
||||
type: "str"
|
||||
keycloak_quarkus_db_enabled:
|
||||
default: "{{ True if keycloak_quarkus_ha_enabled else False }}"
|
||||
description: "Enable auto configuration for database backend"
|
||||
type: "str"
|
||||
keycloak_quarkus_http_relative_path:
|
||||
required: false
|
||||
default: /
|
||||
description: "Set the path relative to / for serving resources. The path must start with a /"
|
||||
type: "str"
|
||||
keycloak_quarkus_http_management_relative_path:
|
||||
required: false
|
||||
description: "Set the path relative to / for serving resources from management interface. The path must start with a /. If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details."
|
||||
type: "str"
|
||||
keycloak_quarkus_frontend_url:
|
||||
required: false
|
||||
description: "Deprecated in v26, use keycloak_quarkus_hostname instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_hostname_admin:
|
||||
required: false
|
||||
description: "Service URL for the admin console"
|
||||
type: "str"
|
||||
keycloak_quarkus_admin_url:
|
||||
required: false
|
||||
description: "Deprecated in v26, use keycloak_quarkus_hostname_admin instead."
|
||||
type: "str"
|
||||
keycloak_quarkus_metrics_enabled:
|
||||
default: false
|
||||
description: "Whether to enable metrics"
|
||||
type: "bool"
|
||||
keycloak_quarkus_health_enabled:
|
||||
default: true
|
||||
description: "If the server should expose health check endpoints on the management interface"
|
||||
type: "bool"
|
||||
keycloak_quarkus_cache_remote:
|
||||
description: "Whether to connect to remote cache infinispan server"
|
||||
default: false
|
||||
type: 'bool'
|
||||
keycloak_quarkus_cache_remote_username:
|
||||
default: "supervisor"
|
||||
description: "Username for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_remote_password:
|
||||
default: "supervisor"
|
||||
description: "Password for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_remote_host:
|
||||
default: "localhost"
|
||||
description: "Hostname for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_remote_port:
|
||||
default: "11222"
|
||||
description: "Port for connecting to infinispan"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_remote_sasl_mechanism:
|
||||
default: "SCRAM-SHA-512"
|
||||
description: "Infinispan auth mechanism"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_remote_tls_enabled:
|
||||
default: false
|
||||
description: "Whether infinispan uses TLS connection"
|
||||
type: "bool"
|
||||
keycloak_quarkus_db_engine:
|
||||
default: "postgres"
|
||||
description: "Database engine [mariadb,postres,mssql]"
|
||||
type: "str"
|
||||
keycloak_quarkus_db_user:
|
||||
default: "keycloak-user"
|
||||
description: "User for database connection"
|
||||
type: "str"
|
||||
keycloak_quarkus_db_pass:
|
||||
default: "keycloak-pass"
|
||||
description: "Password for database connection"
|
||||
type: "str"
|
||||
keycloak_quarkus_db_url:
|
||||
default: "{{ keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].url }}"
|
||||
description: "JDBC URL for connecting to database"
|
||||
type: "str"
|
||||
keycloak_quarkus_db_driver_version:
|
||||
default: "{{ keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].version }}"
|
||||
description: "Version for JDBC driver"
|
||||
type: "str"
|
||||
keycloak_quarkus_log:
|
||||
default: "file"
|
||||
type: "str"
|
||||
description: "Enable one or more log handlers in a comma-separated list"
|
||||
keycloak_quarkus_log_level:
|
||||
default: "info"
|
||||
type: "str"
|
||||
description: "The log level of the root category or a comma-separated list of individual categories and their levels"
|
||||
keycloak_quarkus_log_file:
|
||||
default: "data/log/keycloak.log"
|
||||
type: "str"
|
||||
description: "Set the log file path and filename relative to keycloak home"
|
||||
keycloak_quarkus_log_format:
|
||||
default: '%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n'
|
||||
type: "str"
|
||||
description: "Set a format specific to file log entries"
|
||||
keycloak_quarkus_log_target:
|
||||
default: '/var/log/keycloak'
|
||||
type: "str"
|
||||
description: "Set the destination of the keycloak log folder link"
|
||||
keycloak_quarkus_log_max_file_size:
|
||||
default: 10M
|
||||
type: "str"
|
||||
description: >
|
||||
Set the maximum log file size before a log rotation happens; A size configuration option recognises string in this format (shown as a regular
|
||||
expression): [0-9]+[KkMmGgTtPpEeZzYy]?. If no suffix is given, assume bytes.
|
||||
keycloak_quarkus_log_max_backup_index:
|
||||
default: 10
|
||||
type: "str"
|
||||
description: "Set the maximum number of archived log files to keep"
|
||||
keycloak_quarkus_log_file_suffix:
|
||||
default: '.yyyy-MM-dd.zip'
|
||||
type: "str"
|
||||
description: >
|
||||
Set the log file handler rotation file suffix. When used, the file will be rotated based on its suffix. Note: If the suffix ends
|
||||
with .zip or .gz, the rotation file will also be compressed.
|
||||
keycloak_quarkus_proxy_mode:
|
||||
default: 'none'
|
||||
type: "str"
|
||||
description: "The proxy address forwarding mode if the server is behind a reverse proxy. Set to 'none' as it is deprecated according to Keycloak documentation"
|
||||
keycloak_quarkus_proxy_headers:
|
||||
default: ""
|
||||
type: "str"
|
||||
description: "Parse reverse proxy headers (`forwarded` or `xforwarded`), overrides the deprecated keycloak_quarkus_proxy_mode argument"
|
||||
keycloak_quarkus_start_dev:
|
||||
default: false
|
||||
type: "bool"
|
||||
description: "Whether to start the service in development mode (start-dev)"
|
||||
keycloak_quarkus_transaction_xa_enabled:
|
||||
default: true
|
||||
type: "bool"
|
||||
description: "Enable or disable XA transactions which may not be supported by some DBMS"
|
||||
keycloak_quarkus_hostname_strict:
|
||||
default: true
|
||||
type: "bool"
|
||||
description: >
|
||||
Disables dynamically resolving the hostname from request headers. Should always be set to true in production, unless
|
||||
proxy verifies the Host header.
|
||||
keycloak_quarkus_hostname_backchannel_dynamic:
|
||||
default: false
|
||||
type: "bool"
|
||||
description: >
|
||||
Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path.
|
||||
Set to true if your application accesses Keycloak via a private network. If set to true, hostname option needs to be specified as a full URL.
|
||||
keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route:
|
||||
default: true
|
||||
type: "bool"
|
||||
description: >
|
||||
If the route should be attached to cookies to reflect the node that owns a particular session. If false, route is not attached to cookies
|
||||
and we rely on the session affinity capabilities from reverse proxy
|
||||
keycloak_quarkus_ks_vault_enabled:
|
||||
default: false
|
||||
type: "bool"
|
||||
description: "Whether to enable vault SPI"
|
||||
keycloak_quarkus_ks_vault_file:
|
||||
default: "{{ keycloak_quarkus_config_dir }}/keystore.p12"
|
||||
type: "str"
|
||||
description: "The keystore path for the vault SPI"
|
||||
keycloak_quarkus_ks_vault_type:
|
||||
default: "PKCS12"
|
||||
type: "str"
|
||||
description: "Type of the keystore used for the vault SPI"
|
||||
keycloak_quarkus_ks_vault_pass:
|
||||
required: false
|
||||
type: "str"
|
||||
description: "The password for accessing the keystore vault SPI"
|
||||
keycloak_quarkus_systemd_wait_for_port:
|
||||
description: 'Whether systemd unit should wait for keycloak port before returning'
|
||||
default: "{{ keycloak_quarkus_ha_enabled }}"
|
||||
type: "bool"
|
||||
keycloak_quarkus_systemd_wait_for_port_number:
|
||||
default: "{{ keycloak_quarkus_https_port }}"
|
||||
description: "The port the systemd unit should wait for, by default the https port"
|
||||
type: "int"
|
||||
keycloak_quarkus_systemd_wait_for_log:
|
||||
description: 'Whether systemd unit should wait for service to be up in logs'
|
||||
default: false
|
||||
type: "bool"
|
||||
keycloak_quarkus_systemd_wait_for_timeout:
|
||||
description: "How long to wait for service to be alive (seconds)"
|
||||
default: 60
|
||||
type: 'int'
|
||||
keycloak_quarkus_systemd_wait_for_delay:
|
||||
description: "Activation delay for service systemd unit (seconds)"
|
||||
default: 10
|
||||
type: 'int'
|
||||
keycloak_quarkus_providers:
|
||||
description: >
|
||||
List of provider definition dicts: { 'id': str, 'spi': str, 'url': str, 'local_path': str,
|
||||
'maven': {
|
||||
'repository_url': str, 'group_id': str, 'artifact_id': str, 'version': str, 'username': str, optional, 'password': str, optional
|
||||
},
|
||||
'default': bool,
|
||||
'properties': list of key/value }
|
||||
default: []
|
||||
type: "list"
|
||||
keycloak_quarkus_supported_policy_types:
|
||||
description: "List of str of supported policy types"
|
||||
default: ['password-blacklists']
|
||||
type: "list"
|
||||
keycloak_quarkus_policies:
|
||||
description: "List of policy definition dicts: { 'name': str, 'url': str, 'type': str }"
|
||||
default: []
|
||||
type: "list"
|
||||
keycloak_quarkus_jdbc_download_url:
|
||||
description: "Override the default Maven Central download URL for the JDBC driver"
|
||||
type: "str"
|
||||
keycloak_quarkus_jdbc_download_user:
|
||||
description: "Set a username with which to authenticate when downloading JDBC drivers from an alternative location"
|
||||
type: "str"
|
||||
keycloak_quarkus_jdbc_download_pass:
|
||||
description: >
|
||||
Set a password with which to authenticate when downloading JDBC drivers from an alternative location
|
||||
(requires `keycloak_quarkus_jdbc_download_user``)
|
||||
type: "str"
|
||||
keycloak_quarkus_jdbc_download_validate_certs:
|
||||
default: true
|
||||
description: "Allow the option to ignore invalid certificates when downloading JDBC drivers from a custom URL"
|
||||
type: "bool"
|
||||
keycloak_quarkus_restart_health_check:
|
||||
default: true
|
||||
description: "Whether to wait for successful health check after restart"
|
||||
type: "bool"
|
||||
keycloak_quarkus_restart_strategy:
|
||||
description: >
|
||||
Strategy task file for restarting in HA, one of restart/[ 'serial', 'none', 'serial_then_parallel' ].yml, or path to
|
||||
file when providing custom strategy; when keycloak_quarkus_ha_enabled and keycloak_quarkus_restart_health_check == true
|
||||
default: "restart/serial.yml"
|
||||
type: "str"
|
||||
keycloak_quarkus_restart_pause:
|
||||
description: "Seconds to wait between restarts in HA strategy"
|
||||
default: 15
|
||||
type: int
|
||||
keycloak_quarkus_restart_health_check_delay:
|
||||
description: "Seconds to let pass before starting healch checks"
|
||||
default: 10
|
||||
type: 'int'
|
||||
keycloak_quarkus_restart_health_check_retries:
|
||||
description: "Number of attempts for successful health check before failing"
|
||||
default: 25
|
||||
type: 'int'
|
||||
keycloak_quarkus_validate_certs:
|
||||
description: "Whether to validate SSL certificates when performing health checks"
|
||||
default: true
|
||||
type: "bool"
|
||||
keycloak_quarkus_show_deprecation_warnings:
|
||||
default: true
|
||||
description: "Whether or not deprecation warnings should be shown"
|
||||
type: "bool"
|
||||
keycloak_quarkus_download_path:
|
||||
description: "Path local to controller for offline/download of install archives"
|
||||
default: "{{ lookup('env', 'PWD') }}"
|
||||
type: "str"
|
||||
keycloak_quarkus_cache_managed_infinispan_config:
|
||||
description: "Manage infinispan configuration"
|
||||
default: "{{ keycloak_quarkus_version is version('26.4.0', '<') }}"
|
||||
type: bool
|
||||
keycloak_quarkus_cache_infinispan_template:
|
||||
description: "Infinispan cache template file"
|
||||
default: "cache-ispn.xml"
|
||||
type: str
|
||||
keycloak_quarkus_cache_embedded_properties:
|
||||
description: Embedded cache properties
|
||||
default: ""
|
||||
type: str
|
||||
keycloak_quarkus_binary_download_user:
|
||||
description: "Username for HTTP Basic Auth when downloading Keycloak binary"
|
||||
type: "str"
|
||||
required: false
|
||||
keycloak_quarkus_binary_download_pass:
|
||||
description: "Password for HTTP Basic Auth when downloading Keycloak binary"
|
||||
type: "str"
|
||||
required: false
|
||||
downstream:
|
||||
options:
|
||||
rhbk_version:
|
||||
default: "26.4.11"
|
||||
description: "Red Hat Build of Keycloak version"
|
||||
type: "str"
|
||||
rhbk_archive:
|
||||
default: "rhbk-{{ rhbk_version }}.zip"
|
||||
description: "Red Hat Build of Keycloak install archive filename"
|
||||
type: "str"
|
||||
rhbk_dest:
|
||||
default: "/opt/rhbk"
|
||||
description: "Root installation directory"
|
||||
type: "str"
|
||||
rhbk_installdir:
|
||||
default: "{{ rhbk_dest }}/rhbk-{{ rhbk_version }}"
|
||||
description: "Installation path for Red Hat Build of Keycloak"
|
||||
type: "str"
|
||||
rhbk_apply_patches:
|
||||
default: false
|
||||
description: "Install Red Hat Build of Keycloak most recent cumulative patch"
|
||||
type: "bool"
|
||||
rhbk_enable:
|
||||
default: true
|
||||
description: "Enable Red Hat Build of Keycloak installation"
|
||||
type: "bool"
|
||||
rhbk_offline_install:
|
||||
default: false
|
||||
description: "Perform an offline install"
|
||||
type: "bool"
|
||||
rhbk_service_name:
|
||||
default: "rhbk"
|
||||
description: "systemd service name for Red Hat Build of Keycloak"
|
||||
type: "str"
|
||||
rhbk_service_desc:
|
||||
default: "Red Hat Build of Keycloak"
|
||||
description: "systemd description for Red Hat Build of Keycloak"
|
||||
type: "str"
|
||||
rhbk_patch_version:
|
||||
required: false
|
||||
description: "Red Hat Build of Keycloak latest cumulative patch version to apply; defaults to latest version when rhbk_apply_patches is True"
|
||||
type: "str"
|
||||
rhbk_patch_bundle:
|
||||
default: "rhbk-{{ rhbk_patch_version | default('[0-9]+[.][0-9]+[.][0-9]+') }}-patch.zip"
|
||||
description: "Red Hat Build of Keycloak patch archive filename"
|
||||
type: "str"
|
||||
rhbk_product_category:
|
||||
default: "RHBK"
|
||||
description: "Unified Downloads API category for Red Hat Build of Keycloak"
|
||||
type: "str"
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
galaxy_info:
|
||||
role_name: keycloak_quarkus
|
||||
namespace: middleware_automation
|
||||
author: Guido Grazioli
|
||||
description: Install keycloak on quarkus server configurations
|
||||
company: Red Hat, Inc.
|
||||
|
||||
license: Apache License 2.0
|
||||
|
||||
min_ansible_version: "2.16"
|
||||
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "8"
|
||||
- "9"
|
||||
- name: Fedora
|
||||
- name: Debian
|
||||
- name: Ubuntu
|
||||
|
||||
|
||||
galaxy_tags:
|
||||
- keycloak
|
||||
- quarkus
|
||||
- redhat
|
||||
- rhel
|
||||
- sso
|
||||
- authentication
|
||||
- identity
|
||||
- security
|
||||
- rhbk
|
||||
- debian
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
---
|
||||
- name: Save ansible custom facts
|
||||
become: "{{ keycloak_quarkus_bootstrapped_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak.fact.j2
|
||||
dest: /etc/ansible/facts.d/keycloak.fact
|
||||
mode: '0644'
|
||||
vars:
|
||||
bootstrapped: true
|
||||
|
||||
- name: Refresh custom facts
|
||||
ansible.builtin.setup:
|
||||
filter: ansible_local
|
||||
|
||||
- name: Ensure that `KEYCLOAK_ADMIN[_PASSWORD]` get purged
|
||||
ansible.builtin.include_tasks: systemd.yml
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
---
|
||||
- name: "Initialize configuration key store variables to be written"
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_store_items:
|
||||
- key: "kc.db-password"
|
||||
value: "{{ keycloak_quarkus_db_pass }}"
|
||||
|
||||
- name: "Initialize empty configuration key store"
|
||||
become: "{{ keycloak_quarkus_config_store_require_privilege_escalation | default(true) }}"
|
||||
# keytool doesn't allow creating an empty key store, so this is a hacky way around it
|
||||
ansible.builtin.shell: | # noqa blocked_modules shell is necessary here
|
||||
set -o nounset # abort on unbound variable
|
||||
set -o pipefail # do not hide errors within pipes
|
||||
set -o errexit # abort on nonzero exit status
|
||||
|
||||
echo dummy | keytool -noprompt -importpass -alias dummy -keystore {{ keycloak_quarkus_config_key_store_file | quote }} -storepass {{ keycloak_quarkus_config_key_store_password | quote }} -storetype PKCS12
|
||||
keytool -delete -alias dummy -keystore {{ keycloak_quarkus_config_key_store_file | quote }} -storepass {{ keycloak_quarkus_config_key_store_password | quote }}
|
||||
args:
|
||||
creates: "{{ keycloak_quarkus_config_key_store_file }}"
|
||||
|
||||
- name: "Set configuration key store using keytool"
|
||||
ansible.builtin.shell: | # noqa blocked_modules shell is necessary here
|
||||
set -o nounset # abort on unbound variable
|
||||
set -o pipefail # do not hide errors within pipes
|
||||
|
||||
keytool -list -alias {{ item.key | quote }} -keystore {{ keycloak_quarkus_config_key_store_file | quote }} -storepass {{ keycloak_quarkus_config_key_store_password | quote }}
|
||||
retVal=$?
|
||||
|
||||
set -o errexit # abort on nonzero exit status
|
||||
|
||||
if [ $retVal -eq 0 ]; then
|
||||
# value is already in keystore, but keytool has no replace function: delete and re-create instead
|
||||
# note that we can not read whether the value has changed either[^1], so we need to override it
|
||||
# [^1]: https://stackoverflow.com/a/37491400
|
||||
keytool -delete -alias {{ item.key | quote }} -keystore {{ keycloak_quarkus_config_key_store_file | quote }} -storepass {{ keycloak_quarkus_config_key_store_password | quote }}
|
||||
fi
|
||||
|
||||
echo {{ item.value | quote }} | keytool -noprompt -importpass -alias {{ item.key | quote }} -keystore {{ keycloak_quarkus_config_key_store_file | quote }} -storepass {{ keycloak_quarkus_config_key_store_password | quote }} -storetype PKCS12
|
||||
loop: "{{ keycloak_quarkus_store_items }}"
|
||||
no_log: true
|
||||
become: "{{ keycloak_quarkus_config_store_require_privilege_escalation | default(true) }}"
|
||||
changed_when: true
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: "Set owner of configuration key store {{ keycloak_quarkus_config_key_store_file }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak_quarkus_config_key_store_file }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0400'
|
||||
become: "{{ keycloak_quarkus_config_store_require_privilege_escalation | default(true) }}"
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
- name: Include firewall config tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: iptables.yml
|
||||
apply:
|
||||
tags:
|
||||
- firewall
|
||||
when: keycloak_quarkus_configure_iptables
|
||||
tags:
|
||||
- firewall
|
||||
|
|
@ -0,0 +1,162 @@
|
|||
---
|
||||
- name: Check deprecation keycloak_quarkus_key_store -> keycloak_quarkus_http_key_store
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_quarkus_https_key_store_enabled
|
||||
block:
|
||||
- name: Ensure backward compatibility for `keycloak_quarkus_key_store_file`, superseded by `keycloak_quarkus_https_key_store_file`
|
||||
when:
|
||||
- keycloak_quarkus_key_store_file is defined
|
||||
- keycloak_quarkus_key_store_file != ''
|
||||
- keycloak_quarkus_https_key_store_file == keycloak.home + "/conf/key_store.p12" # default value
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_https_key_store_file: "{{ keycloak_quarkus_key_store_file }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_file" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Ensure backward compatibility for `keycloak_quarkus_key_store_password`, superseded by `keycloak_quarkus_https_key_store_password`
|
||||
when:
|
||||
- keycloak_quarkus_key_store_password is defined
|
||||
- keycloak_quarkus_key_store_password != ''
|
||||
- keycloak_quarkus_https_key_store_password == "" # default value
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_https_key_store_password: "{{ keycloak_quarkus_key_store_password }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_key_store_password" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
# https://access.redhat.com/documentation/en-us/red_hat_build_of_keycloak/24.0/html-single/upgrading_guide/index#deprecated_literal_proxy_literal_option
|
||||
- name: Check deprecation of keycloak_quarkus_proxy_mode
|
||||
when:
|
||||
- keycloak_quarkus_proxy_mode is defined
|
||||
- keycloak_quarkus_proxy_headers is defined and keycloak_quarkus_proxy_headers | length == 0
|
||||
- keycloak_quarkus_version.split('.') | first | int >= 24
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_proxy_mode" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html-single/upgrading_guide/index#new_hostname_options
|
||||
- name: Check deprecation of keycloak_quarkus_frontend_url -> keycloak_quarkus_hostname
|
||||
when:
|
||||
- keycloak_quarkus_hostname is not defined
|
||||
- keycloak_quarkus_frontend_url is defined
|
||||
- keycloak_quarkus_frontend_url != ''
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_hostname: "{{ keycloak_quarkus_frontend_url }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_frontend_url" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html-single/upgrading_guide/index#new_hostname_options
|
||||
- name: Check deprecation of keycloak_quarkus_hostname_strict_https + keycloak_quarkus_host + keycloak_quarkus_port + keycloak_quarkus_path -> keycloak_quarkus_hostname
|
||||
when:
|
||||
- keycloak_quarkus_hostname is not defined
|
||||
- keycloak_quarkus_hostname_strict_https is defined or keycloak_quarkus_frontend_url is defined or keycloak_quarkus_port is defined or keycloak_quarkus_path is defined
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_hostname: >-
|
||||
{% set protocol = '' %}
|
||||
{% if keycloak_quarkus_hostname_strict_https %}
|
||||
{% set protocol = 'https://' %}
|
||||
{% elif keycloak_quarkus_hostname_strict_https is defined and keycloak_quarkus_hostname_strict_https is False %}
|
||||
{% set protocol = 'http://' %}
|
||||
{% endif %}
|
||||
{{ protocol }}{{ keycloak_quarkus_host }}:{{ keycloak_quarkus_port }}/{{ keycloak_quarkus_path }}
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_strict_https or keycloak_quarkus_frontend_url or keycloak_quarkus_frontend_url or keycloak_quarkus_hostname" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html-single/upgrading_guide/index#new_hostname_options
|
||||
- name: Check deprecation of keycloak_quarkus_admin_url -> keycloak_quarkus_hostname_admin
|
||||
when:
|
||||
- keycloak_quarkus_hostname_admin is not defined
|
||||
- keycloak_quarkus_admin_url is defined
|
||||
- keycloak_quarkus_admin_url != ''
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_hostname_admin: "{{ keycloak_quarkus_admin_url }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_url" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html-single/upgrading_guide/index#new_hostname_options
|
||||
- name: Check deprecation of keycloak_quarkus_hostname_strict_backchannel -> keycloak_quarkus_hostname_backchannel_dynamic
|
||||
when:
|
||||
- keycloak_quarkus_hostname_backchannel_dynamic is not defined
|
||||
- keycloak_quarkus_hostname_strict_backchannel is defined
|
||||
- keycloak_quarkus_hostname_strict_backchannel != ''
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_hostname_backchannel_dynamic: "{{ keycloak_quarkus_hostname_strict_backchannel == False }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_hostname_backchannel_dynamic" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://github.com/keycloak/keycloak/issues/30009
|
||||
- name: Check deprecation of keycloak_quarkus_admin_user -> keycloak_quarkus_bootstrap_admin_user
|
||||
when:
|
||||
- keycloak_quarkus_bootstrap_admin_user is not defined
|
||||
- keycloak_quarkus_admin_user is defined
|
||||
- keycloak_quarkus_admin_user != ''
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_user }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_user" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
# https://github.com/keycloak/keycloak/issues/30009
|
||||
- name: Check deprecation of keycloak_quarkus_admin_pass -> keycloak_quarkus_bootstrap_admin_password
|
||||
when:
|
||||
- keycloak_quarkus_bootstrap_admin_password is not defined
|
||||
- keycloak_quarkus_admin_pass is defined
|
||||
- keycloak_quarkus_admin_pass != ''
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_bootstrap_admin_user: "{{ keycloak_quarkus_admin_pass }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_admin_pass" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
- name: Check deprecation of keycloak_quarkus_bind_address -> keycloak_quarkus_http_host
|
||||
when:
|
||||
- keycloak_quarkus_bind_address is defined
|
||||
- keycloak_quarkus_bind_address != '0.0.0.0'
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
changed_when: keycloak_quarkus_show_deprecation_warnings
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_http_host: "{{ keycloak_quarkus_bind_address }}"
|
||||
keycloak_quarkus_deprecated_variable: "keycloak_quarkus_bind_address" # read in deprecation handler
|
||||
notify:
|
||||
- print deprecation warning
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
- name: "Check if packages are already installed" # noqa command-instead-of-module this runs faster
|
||||
ansible.builtin.command: "rpm -q {{ packages_list | join(' ') }}"
|
||||
register: keycloak_quarkus_rpm_info
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Add missing packages to the yum install list"
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_packages_to_install: "{{ keycloak_quarkus_packages_to_install | default([]) + keycloak_quarkus_rpm_info.stdout_lines | \
|
||||
map('regex_findall', 'package (.+) is not installed$') | default([]) | flatten }}"
|
||||
when: ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Install packages: {{ keycloak_quarkus_packages_to_install }}"
|
||||
become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ keycloak_quarkus_packages_to_install }}"
|
||||
state: present
|
||||
when:
|
||||
- keycloak_quarkus_packages_to_install | default([]) | length > 0
|
||||
- ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: "Install packages: {{ packages_list }}"
|
||||
become: "{{ keycloak_quarkus_fastpackages_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.package:
|
||||
name: "{{ packages_list }}"
|
||||
state: present
|
||||
when:
|
||||
- packages_list | default([]) | length > 0
|
||||
- ansible_facts.os_family == "Debian"
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
---
|
||||
- name: Ensure required package firewalld are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list:
|
||||
- firewalld
|
||||
|
||||
- name: Enable and start the firewalld service
|
||||
become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.systemd:
|
||||
name: firewalld
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
- name: "Configure firewall for http port: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ item }}"
|
||||
permanent: true
|
||||
state: enabled
|
||||
immediate: true
|
||||
loop:
|
||||
- "{{ keycloak_quarkus_http_port }}/tcp"
|
||||
when: keycloak_quarkus_http_enabled | bool
|
||||
|
||||
- name: "Configure firewall for ports: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_firewalld_require_privilege_escalation | default(true) }}"
|
||||
ansible.posix.firewalld:
|
||||
port: "{{ item }}"
|
||||
permanent: true
|
||||
state: enabled
|
||||
immediate: true
|
||||
loop:
|
||||
- "{{ keycloak_quarkus_https_port }}/tcp"
|
||||
- "{{ keycloak_quarkus_http_management_port }}/tcp"
|
||||
- "{{ keycloak_quarkus_jgroups_port }}/tcp"
|
||||
|
|
@ -0,0 +1,319 @@
|
|||
---
|
||||
- name: Validate parameters
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak.home is defined
|
||||
- keycloak_quarkus_service_user is defined
|
||||
- keycloak_quarkus_dest is defined
|
||||
- keycloak_quarkus_archive is defined
|
||||
- keycloak_quarkus_download_url is defined
|
||||
- keycloak_quarkus_version is defined
|
||||
- keycloak_quarkus_local_path is defined
|
||||
quiet: true
|
||||
|
||||
- name: Check for an existing deployment
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak.home }}"
|
||||
register: keycloak_quarkus_existing_deploy
|
||||
|
||||
- name: Stop and restart if existing deployment exists and install forced
|
||||
when: keycloak_quarkus_existing_deploy.stat.exists and keycloak_quarkus_force_install | bool
|
||||
block:
|
||||
- name: "Stop the old service: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
failed_when: false
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
state: stopped
|
||||
- name: "Remove the old deployment: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak_quarkus_home }}"
|
||||
state: absent
|
||||
|
||||
- name: Check for an existing deployment after possible forced removal
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_quarkus_home }}"
|
||||
register: keycloak_quarkus_existing_deploy
|
||||
|
||||
- name: "Create service user/group: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.user:
|
||||
name: "{{ keycloak.service_user }}"
|
||||
home: /opt/keycloak
|
||||
system: true
|
||||
create_home: false
|
||||
|
||||
- name: "Create install location: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
dest: "{{ keycloak_quarkus_dest }}"
|
||||
state: directory
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0750'
|
||||
|
||||
- name: Create directory for ansible custom facts
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
recurse: true
|
||||
path: /etc/ansible/facts.d
|
||||
|
||||
## check remote archive
|
||||
- name: Set download archive path
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_archive_full_path: "{{ keycloak_quarkus_dest }}/{{ keycloak.bundle }}"
|
||||
|
||||
- name: Check download archive path
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_quarkus_archive_full_path }}"
|
||||
register: keycloak_quarkus_archive_path
|
||||
|
||||
## download to controller
|
||||
- name: Download keycloak archive
|
||||
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
|
||||
url: "{{ keycloak_quarkus_download_url }}"
|
||||
dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
mode: '0640'
|
||||
url_username: "{{ keycloak_quarkus_binary_download_user | default(omit) }}"
|
||||
url_password: "{{ keycloak_quarkus_binary_download_pass | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_quarkus_archive_path is defined
|
||||
- keycloak_quarkus_archive_path.stat is defined
|
||||
- not keycloak_quarkus_archive_path.stat.exists
|
||||
- not keycloak.offline_install
|
||||
- not rhbk_enable is defined or not rhbk_enable
|
||||
|
||||
- name: Perform download from RHN using the Unified Downloads API
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when:
|
||||
- keycloak_quarkus_archive_path is defined
|
||||
- keycloak_quarkus_archive_path.stat is defined
|
||||
- not keycloak_quarkus_archive_path.stat.exists
|
||||
- rhbk_enable is defined and rhbk_enable
|
||||
- not keycloak.offline_install
|
||||
- keycloak_quarkus_alternate_download_url is undefined
|
||||
block:
|
||||
- name: Retrieve product download using Unified Downloads API
|
||||
middleware_automation.common.product_search:
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_type: DISTRIBUTION
|
||||
product_version: "{{ rhbk_version }}"
|
||||
product_category: "{{ rhbk_product_category }}"
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
register: keycloak_quarkus_rhn_products
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Determine install zipfile from search results
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_rhn_filtered_products: "{{ keycloak_quarkus_rhn_products.results | selectattr('file_name', 'match', '[^/]*/' + rhbk_archive + '$') }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Download Red Hat Build of Keycloak
|
||||
middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
|
||||
client_id: "{{ rhn_username }}"
|
||||
client_secret: "{{ rhn_password }}"
|
||||
product_id: "{{ (keycloak_quarkus_rhn_filtered_products | first).id }}"
|
||||
dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
mode: '0640'
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
no_log: "{{ omit_rhn_output | default(true) }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
become: false
|
||||
|
||||
- name: Perform download of RHBK from alternate download location
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
become: false
|
||||
when:
|
||||
- keycloak_quarkus_archive_path is defined
|
||||
- keycloak_quarkus_archive_path.stat is defined
|
||||
- not keycloak_quarkus_archive_path.stat.exists
|
||||
- rhbk_enable is defined and rhbk_enable
|
||||
- not keycloak.offline_install
|
||||
- keycloak_quarkus_alternate_download_url is defined
|
||||
ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
|
||||
url: "{{ keycloak_quarkus_alternate_download_url }}"
|
||||
dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
mode: '0640'
|
||||
url_username: "{{ keycloak_quarkus_download_user | default(omit) }}"
|
||||
url_password: "{{ keycloak_quarkus_download_pass | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
|
||||
- name: Check downloaded archive
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
register: keycloak_quarkus_local_archive_path
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
|
||||
## copy and unpack
|
||||
- name: Copy archive to target nodes
|
||||
ansible.builtin.copy:
|
||||
src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
dest: "{{ keycloak_quarkus_archive_full_path }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
register: keycloak_quarkus_new_version_downloaded
|
||||
when:
|
||||
- not keycloak_quarkus_archive_path.stat.exists
|
||||
- keycloak_quarkus_local_archive_path.stat is defined
|
||||
- keycloak_quarkus_local_archive_path.stat.exists
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Check target directory /bin/: {{ keycloak.home }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak.home }}/bin/"
|
||||
register: keycloak_quarkus_path_to_workdir
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Extract Keycloak archive on target" # noqa no-handler need to run this here
|
||||
ansible.builtin.unarchive:
|
||||
remote_src: true
|
||||
src: "{{ keycloak_quarkus_archive_full_path }}"
|
||||
dest: "{{ keycloak_quarkus_dest }}"
|
||||
creates: "{{ keycloak.home }}/bin/"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
when:
|
||||
- (not keycloak_quarkus_path_to_workdir.stat.exists) or keycloak_quarkus_new_version_downloaded.changed
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
||||
- name: Inform decompression was not executed
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ keycloak.home }} already exists and version unchanged, skipping decompression"
|
||||
when:
|
||||
- (not keycloak_quarkus_new_version_downloaded.changed) and keycloak_quarkus_path_to_workdir.stat.exists
|
||||
|
||||
- name: "Copy private key to target"
|
||||
ansible.builtin.copy:
|
||||
content: "{{ keycloak_quarkus_key_content }}"
|
||||
dest: "{{ keycloak_quarkus_key_file }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
when:
|
||||
- keycloak_quarkus_https_key_file_enabled is defined and keycloak_quarkus_https_key_file_enabled
|
||||
- keycloak_quarkus_key_file_copy_enabled is defined and keycloak_quarkus_key_file_copy_enabled
|
||||
- keycloak_quarkus_key_content | length > 0
|
||||
|
||||
- name: "Copy certificate to target"
|
||||
ansible.builtin.copy:
|
||||
src: "{{ keycloak_quarkus_cert_file_src }}"
|
||||
dest: "{{ keycloak_quarkus_cert_file }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0644'
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
when:
|
||||
- keycloak_quarkus_https_key_file_enabled is defined and keycloak_quarkus_https_key_file_enabled
|
||||
- keycloak_quarkus_cert_file_copy_enabled is defined and keycloak_quarkus_cert_file_copy_enabled
|
||||
- keycloak_quarkus_cert_file_src | length > 0
|
||||
|
||||
- name: "Install JDBC driver: {{ keycloak_quarkus_db_engine }}"
|
||||
ansible.builtin.include_tasks: jdbc_driver.yml
|
||||
when:
|
||||
- rhbk_enable is defined and rhbk_enable
|
||||
- keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].driver_jar_url is defined
|
||||
|
||||
- name: "Download custom providers via http"
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ item.url }}"
|
||||
dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
checksum: "{{ item.checksum | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_providers }}"
|
||||
when: item.url is defined and item.url | length > 0
|
||||
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
|
||||
notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
|
||||
|
||||
# this requires the `lxml` package to be installed; we redirect this step to localhost such that we do need to install it on the remote hosts
|
||||
- name: "Download custom providers to localhost using maven"
|
||||
middleware_automation.common.maven_artifact:
|
||||
repository_url: "{{ item.maven.repository_url }}"
|
||||
group_id: "{{ item.maven.group_id }}"
|
||||
artifact_id: "{{ item.maven.artifact_id }}"
|
||||
version: "{{ item.maven.version | default(omit) }}"
|
||||
username: "{{ item.maven.username | default(omit) }}"
|
||||
password: "{{ item.maven.password | default(omit) }}"
|
||||
dest: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
delegate_to: "localhost"
|
||||
run_once: true
|
||||
loop: "{{ keycloak_quarkus_providers }}"
|
||||
when: item.maven is defined
|
||||
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
|
||||
|
||||
- name: "Copy maven providers"
|
||||
ansible.builtin.copy:
|
||||
src: "{{ keycloak_quarkus_local_path.stat.path }}/{{ item.id }}.jar"
|
||||
dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
checksum: "{{ item.checksum | default(omit) }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_providers }}"
|
||||
when: item.maven is defined
|
||||
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
|
||||
notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
|
||||
|
||||
- name: "Copy local providers"
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.local_path }}"
|
||||
dest: "{{ keycloak.home }}/providers/{{ item.id }}.jar"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
remote_src: "{{ item.remote | default(false) }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_providers }}"
|
||||
when: item.local_path is defined
|
||||
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
|
||||
notify: "{{ ['invalidate keycloak theme cache', 'rebuild keycloak config', 'restart keycloak'] if not item.restart is defined or item.restart else [] }}"
|
||||
|
||||
- name: Ensure required folder structure for policies exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak.home }}/data/{{ item | lower }}"
|
||||
state: directory
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0750'
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_supported_policy_types }}"
|
||||
|
||||
- name: "Install custom policies"
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ item.url }}"
|
||||
dest: "{{ keycloak.home }}/data/{{ item.type | default(keycloak_quarkus_supported_policy_types | first) | lower }}/{{ item.name }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
validate_certs: "{{ keycloak_quarkus_download_validate_certs | default(omit) }}"
|
||||
become: "{{ keycloak_quarkus_install_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_policies }}"
|
||||
when: item.url is defined and item.url | length > 0
|
||||
notify: "restart keycloak"
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
# From https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/24.0/html/server_developer_guide/themes#creating_a_theme:
|
||||
# If you want to manually delete the content of the themes cache,
|
||||
# you can do so by deleting the data/tmp/kc-gzip-cache directory of the server distribution
|
||||
# It can be useful for instance if you redeployed custom providers or custom themes without
|
||||
# disabling themes caching in the previous server executions.
|
||||
- name: "Delete theme cache directory: {{ keycloak.service_name }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ keycloak.home }}/data/tmp/kc-gzip-cache"
|
||||
state: absent
|
||||
become: "{{ keycloak_quarkus_invalidate_theme_cache_require_privilege_escalation | default(true) }}"
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
---
|
||||
- name: Ensure required package iptables are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list:
|
||||
- iptables
|
||||
|
||||
- name: "Configure firewall ports for {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_iptables_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.iptables:
|
||||
destination_port: "{{ item }}"
|
||||
action: "insert"
|
||||
rule_num: 6 # magic number I forget why
|
||||
chain: "INPUT"
|
||||
policy: "ACCEPT"
|
||||
protocol: tcp
|
||||
loop:
|
||||
- "{{ keycloak_quarkus_http_port }}"
|
||||
- "{{ keycloak_quarkus_https_port }}"
|
||||
- "{{ keycloak_quarkus_jgroups_port }}"
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
- name: "Verify valid parameters for download credentials when specified"
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
When JDBC driver download credentials are set, both the username and the password MUST be set
|
||||
when: >
|
||||
(keycloak_quarkus_jdbc_download_user is undefined and keycloak_quarkus_jdbc_download_pass is not undefined) or
|
||||
(keycloak_quarkus_jdbc_download_pass is undefined and keycloak_quarkus_jdbc_download_user is not undefined)
|
||||
|
||||
- name: "Retrieve JDBC Driver from {{ keycloak_jdbc_download_url | default(keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].driver_jar_url) }}"
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ keycloak_quarkus_jdbc_download_url | default(keycloak_quarkus_default_jdbc[keycloak_quarkus_db_engine].driver_jar_url) }}"
|
||||
dest: "{{ keycloak.home }}/providers"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
url_username: "{{ keycloak_quarkus_jdbc_download_user | default(omit) }}"
|
||||
url_password: "{{ keycloak_quarkus_jdbc_download_pass | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_quarkus_jdbc_download_validate_certs | default(omit) }}"
|
||||
mode: '0640'
|
||||
become: "{{ keycloak_quarkus_jdbc_driver_require_privilege_escalation | default(true) }}"
|
||||
notify:
|
||||
- restart keycloak
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
---
|
||||
# tasks file for keycloak
|
||||
- name: Check prerequisites
|
||||
ansible.builtin.include_tasks:
|
||||
file: prereqs.yml
|
||||
apply:
|
||||
tags:
|
||||
- prereqs
|
||||
tags:
|
||||
- prereqs
|
||||
- always
|
||||
|
||||
- name: Check for deprecations
|
||||
ansible.builtin.include_tasks:
|
||||
file: deprecations.yml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Distro specific tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: "{{ ansible_os_family | lower }}.yml"
|
||||
apply:
|
||||
tags:
|
||||
- unbound
|
||||
tags:
|
||||
- unbound
|
||||
|
||||
- name: Include install tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: install.yml
|
||||
apply:
|
||||
tags:
|
||||
- install
|
||||
tags:
|
||||
- install
|
||||
|
||||
- name: Include systemd tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: systemd.yml
|
||||
apply:
|
||||
tags:
|
||||
- systemd
|
||||
tags:
|
||||
- systemd
|
||||
|
||||
- name: Include configuration key store tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: config_store.yml
|
||||
apply:
|
||||
tags:
|
||||
- install
|
||||
when: keycloak.config_key_store_enabled
|
||||
tags:
|
||||
- install
|
||||
|
||||
- name: Create tcpping cluster node list
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_cluster_nodes: >
|
||||
{{ keycloak_quarkus_cluster_nodes | default([]) + [
|
||||
{
|
||||
"name": item,
|
||||
"address": 'jgroups-' + item,
|
||||
"inventory_host": hostvars[item].keycloak_quarkus_jgroups_ip | default(item) + '[' + (keycloak_quarkus_jgroups_port | string) + ']',
|
||||
"value": hostvars[item].keycloak_quarkus_jgroups_ip | default(item)
|
||||
}
|
||||
] }}
|
||||
loop: "{{ ansible_play_batch }}"
|
||||
when: keycloak_quarkus_ha_enabled and keycloak_quarkus_ha_discovery == 'TCPPING'
|
||||
|
||||
|
||||
- name: Determine the config files
|
||||
ansible.builtin.set_fact:
|
||||
keycloak_quarkus_config_files: "{{ ['keycloak.conf', 'quarkus.properties'] + (keycloak_quarkus_cache_managed_infinispan_config | ternary([keycloak_quarkus_cache_infinispan_template], [])) }}"
|
||||
|
||||
- name: "Configure config files for keycloak service"
|
||||
ansible.builtin.template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "{{ keycloak.home }}/conf/{{ item }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0640'
|
||||
become: "{{ keycloak_quarkus_require_privilege_escalation | default(true) }}"
|
||||
loop: "{{ keycloak_quarkus_config_files }}"
|
||||
notify:
|
||||
- rebuild keycloak config
|
||||
- restart keycloak
|
||||
|
||||
- name: Ensure logdirectory exists
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: "{{ keycloak.log.file | dirname }}"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0775'
|
||||
become: "{{ keycloak_quarkus_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: Ensure tmp-directory exists
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: "{{ keycloak.home }}/data/tmp"
|
||||
owner: "{{ keycloak.service_user }}"
|
||||
group: "{{ keycloak.service_group }}"
|
||||
mode: '0755'
|
||||
become: "{{ keycloak_quarkus_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: Flush pending handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: "Start and wait for keycloak service"
|
||||
ansible.builtin.include_tasks: start.yml
|
||||
|
||||
- name: Link default logs directory
|
||||
ansible.builtin.file:
|
||||
state: link
|
||||
src: "{{ keycloak.log.file | dirname }}"
|
||||
dest: "{{ keycloak_quarkus_log_target }}"
|
||||
force: true
|
||||
become: "{{ keycloak_quarkus_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: Check service status
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ keycloak.service_name }}"
|
||||
register: keycloak_quarkus_service_status
|
||||
changed_when: false
|
||||
|
||||
- name: "Notify to remove `keycloak_quarkus_bootstrap_admin_user[_password]` env vars"
|
||||
when:
|
||||
- not ansible_local.keycloak.general.bootstrapped | default(false) | bool # it was not bootstrapped prior to the current role's execution
|
||||
- keycloak_quarkus_service_status.status.ActiveState == "active" # but it is now
|
||||
ansible.builtin.assert: { that: true, quiet: true }
|
||||
changed_when: true
|
||||
notify:
|
||||
- bootstrapped
|
||||
|
||||
- name: Flush pending handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
---
|
||||
- name: Validate admin console password
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_bootstrap_admin_password is defined
|
||||
- keycloak_quarkus_bootstrap_admin_password is not none
|
||||
- keycloak_quarkus_bootstrap_admin_password | length > 12
|
||||
quiet: true
|
||||
fail_msg: "The console administrator password is empty or invalid. Please set the keycloak_quarkus_bootstrap_admin_password to a 12+ char long string"
|
||||
success_msg: "{{ 'Console administrator password OK' }}"
|
||||
|
||||
- name: Validate http_relative_path
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_http_relative_path is regex('^/.*')
|
||||
quiet: true
|
||||
fail_msg: "The relative path for keycloak_quarkus_http_relative_path must begin with /"
|
||||
success_msg: "{{ 'Relative path OK' }}"
|
||||
|
||||
- name: Validate http_management_relative_path
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_http_management_relative_path is regex('^/.*')
|
||||
quiet: true
|
||||
fail_msg: "The relative path for keycloak_quarkus_http_management_relative_path must begin with /"
|
||||
success_msg: "{{ 'Relative mgmt path OK' }}"
|
||||
when: keycloak_quarkus_http_management_relative_path is defined
|
||||
|
||||
- name: Validate configuration
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (keycloak_quarkus_ha_enabled and keycloak_quarkus_db_enabled) or
|
||||
(not keycloak_quarkus_ha_enabled and keycloak_quarkus_db_enabled) or
|
||||
(not keycloak_quarkus_ha_enabled and not keycloak_quarkus_db_enabled)
|
||||
quiet: true
|
||||
fail_msg: "HA setup requires a backend database service. Check keycloak_quarkus_ha_enabled and keycloak_quarkus_db_enabled"
|
||||
success_msg: "{{ 'Configuring HA' if keycloak_quarkus_ha_enabled else 'Configuring standalone' }}"
|
||||
|
||||
- name: Validate OS family
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_os_family in ["RedHat", "Debian"]
|
||||
quiet: true
|
||||
fail_msg: "Can only install on RedHat or Debian OS families; found {{ ansible_os_family }}"
|
||||
success_msg: "Installing on {{ ansible_os_family }}"
|
||||
|
||||
- name: Load OS specific variables
|
||||
ansible.builtin.include_vars: "vars/{{ ansible_os_family | lower }}.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Ensure required packages are installed
|
||||
ansible.builtin.include_tasks: fastpackages.yml
|
||||
vars:
|
||||
packages_list: "{{ keycloak_quarkus_prereq_package_list }}"
|
||||
|
||||
- name: Check local download archive path
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_quarkus_download_path }}"
|
||||
register: keycloak_quarkus_local_path
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
become: false
|
||||
|
||||
- name: Validate local download path
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_local_path.stat.exists
|
||||
- keycloak_quarkus_local_path.stat.readable
|
||||
- keycloak_quarkus_offline_install or keycloak_quarkus_local_path.stat.writeable
|
||||
quiet: true
|
||||
fail_msg: "Defined controller path for downloading resources is incorrect or unreadable: {{ keycloak_quarkus_download_path }}"
|
||||
success_msg: "Will download resource to controller path: {{ keycloak_quarkus_download_path }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Check downloaded archive if offline
|
||||
ansible.builtin.stat:
|
||||
path: "{{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
when: keycloak_quarkus_offline_install
|
||||
register: keycloak_quarkus_local_archive_path_check
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Validate local downloaded archive if offline
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_local_archive_path_check.stat.exists
|
||||
- keycloak_quarkus_local_archive_path_check.stat.readable
|
||||
quiet: true
|
||||
fail_msg: "Configured for offline install but install archive not found at: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
success_msg: "Will install offline with expected archive: {{ keycloak_quarkus_local_path.stat.path }}/{{ keycloak.bundle }}"
|
||||
when: keycloak_quarkus_offline_install
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: "Validate keytool"
|
||||
when: keycloak_quarkus_config_key_store_password | length > 0
|
||||
block:
|
||||
- name: "Check run keytool"
|
||||
changed_when: false
|
||||
ansible.builtin.command: keytool -help
|
||||
register: keycloak_quarkus_keytool_check
|
||||
ignore_errors: true
|
||||
|
||||
- name: "Fail when no keytool found"
|
||||
when: keycloak_quarkus_keytool_check.rc != 0
|
||||
ansible.builtin.fail:
|
||||
msg: "keytool NOT found in the PATH, but is required for setting up the configuration key store"
|
||||
|
||||
- name: "Validate providers"
|
||||
ansible.builtin.assert:
|
||||
that: >
|
||||
item.id is defined and item.id | length > 0 and
|
||||
( (item.spi is defined and item.spi | length > 0) or
|
||||
(item.url is defined and item.url | length > 0) or
|
||||
( item.maven is defined and item.maven.repository_url is defined and item.maven.repository_url | length > 0 and
|
||||
item.maven.group_id is defined and item.maven.group_id | length > 0 and
|
||||
item.maven.artifact_id is defined and item.maven.artifact_id | length > 0) or
|
||||
(item.local_path is defined and item.local_path | length > 0)
|
||||
)
|
||||
quiet: true
|
||||
fail_msg: >
|
||||
Providers definition incorrect; `id` and one of `spi`, `url`, `local_path`, or `maven` are mandatory. `key` and `value` are mandatory for each property
|
||||
loop: "{{ keycloak_quarkus_providers }}"
|
||||
no_log: "{{ item.maven.password is defined and item.maven.password | length > 0 | default(false) }}"
|
||||
|
||||
- name: "Validate policies"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- item.name is defined and item.name | length > 0
|
||||
- item.url is defined and item.url | length > 0
|
||||
- item.type is not defined or item.type | lower in keycloak_quarkus_supported_policy_types
|
||||
quiet: true
|
||||
fail_msg: >
|
||||
Policy definition is incorrect: `name` and one of `url` are mandatory, `type` needs to be left empty or one of {{ keycloak_quarkus_supported_policy_types }}.
|
||||
loop: "{{ keycloak_quarkus_policies }}"
|
||||
|
||||
- name: "Validate additional env variables"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- item.key is defined and item.key | length > 0
|
||||
- item.value is defined and item.value | length > 0
|
||||
quiet: true
|
||||
fail_msg: "Additional env variable definition is incorrect: `key` and `value` are mandatory."
|
||||
no_log: true
|
||||
loop: "{{ keycloak_quarkus_additional_env_vars }}"
|
||||
|
||||
- name: "Validate proxy-headers"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- keycloak_quarkus_proxy_headers | lower in ['', 'forwarded', 'xforwarded']
|
||||
quiet: true
|
||||
fail_msg: "keycloak_quarkus_proxy_headers must be either '', 'forwarded' or 'xforwarded'"
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
# cf. https://www.keycloak.org/server/configuration#_optimize_the_keycloak_startup
|
||||
- name: "Rebuild config: {{ keycloak.service_name }}"
|
||||
ansible.builtin.shell: | # noqa blocked_modules shell is necessary here
|
||||
env -i bash -c "set -a ; source {{ keycloak_quarkus_sysconf_file }} ; {{ keycloak.home }}/bin/kc.sh build "
|
||||
become: "{{ keycloak_quarkus_rebuild_config_require_privilege_escalation | default(true) }}"
|
||||
changed_when: true
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
- name: Include firewall config tasks
|
||||
ansible.builtin.include_tasks:
|
||||
file: firewalld.yml
|
||||
apply:
|
||||
tags:
|
||||
- firewall
|
||||
when: keycloak_quarkus_configure_firewalld
|
||||
tags:
|
||||
- firewall
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
---
|
||||
- name: "Restart and enable service: {{ keycloak.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ keycloak.service_name }}"
|
||||
enabled: true
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Wait until service becomes active: {{ keycloak.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak.health_url }}"
|
||||
validate_certs: "{{ keycloak_quarkus_validate_certs }}"
|
||||
register: keycloak_quarkus_status
|
||||
until: keycloak_quarkus_status.status == 200
|
||||
retries: "{{ keycloak_quarkus_restart_health_check_retries }}"
|
||||
delay: "{{ keycloak_quarkus_restart_health_check_delay }}"
|
||||
when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)
|
||||
|
||||
- name: Wait to give distributed ispn caches time to (re-)replicate back onto first host
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ keycloak_quarkus_restart_pause }}"
|
||||
when:
|
||||
- keycloak_quarkus_ha_enabled
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
- name: "Display message"
|
||||
ansible.builtin.debug:
|
||||
msg: "keycloak_quarkus_restart_strategy is none, skipping restart"
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
- name: "Restart services in serial, with optional healtch check (keycloak_quarkus_restart_health_check)"
|
||||
throttle: 1
|
||||
block:
|
||||
- name: "Restart and enable service: {{ keycloak.service_name }}"
|
||||
ansible.builtin.include_tasks:
|
||||
file: restart.yml
|
||||
apply:
|
||||
delegate_to: "{{ item }}"
|
||||
run_once: true
|
||||
loop: "{{ ansible_play_hosts }}"
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
---
|
||||
- name: Verify first restarted service with health URL, then rest restart in parallel
|
||||
block:
|
||||
- name: "Restart and enable service on initial host: {{ keycloak.service_name }}"
|
||||
ansible.builtin.include_tasks:
|
||||
file: restart.yml
|
||||
apply:
|
||||
delegate_to: "{{ ansible_play_hosts | first }}"
|
||||
run_once: true
|
||||
vars:
|
||||
internal_force_health_check: true
|
||||
|
||||
- name: "Restart and enable service on other hosts: {{ keycloak.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ keycloak.service_name }}"
|
||||
enabled: true
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
become: "{{ keycloak_quarkus_restart_require_privilege_escalation | default(true) }}"
|
||||
when: inventory_hostname != ansible_play_hosts | first
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
- name: "Start service: {{ keycloak.service_name }}"
|
||||
ansible.builtin.systemd:
|
||||
name: keycloak
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
become: "{{ keycloak_quarkus_start_require_privilege_escalation | default(true) }}"
|
||||
|
||||
- name: "Wait until service becomes active: {{ keycloak.service_name }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak.health_url }}"
|
||||
validate_certs: "{{ keycloak_quarkus_validate_certs }}"
|
||||
register: keycloak_quarkus_status
|
||||
until: keycloak_quarkus_status.status == 200
|
||||
retries: 25
|
||||
delay: 10
|
||||
when: internal_force_health_check | default(keycloak_quarkus_restart_health_check)
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
- name: "Configure sysconfig file for service: {{ keycloak.service_name }}"
|
||||
become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
|
||||
ansible.builtin.template:
|
||||
src: keycloak-sysconfig.j2
|
||||
dest: "{{ keycloak_quarkus_sysconf_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
vars:
|
||||
keycloak_sys_pkg_java_home: "{{ keycloak_quarkus_pkg_java_home }}"
|
||||
notify:
|
||||
- rebuild keycloak config
|
||||
- restart keycloak
|
||||
|
||||
- name: "Configure systemd unit file for keycloak service"
|
||||
ansible.builtin.template:
|
||||
src: keycloak.service.j2
|
||||
dest: /etc/systemd/system/keycloak.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: "{{ keycloak_quarkus_systemd_require_privilege_escalation | default(true) }}"
|
||||
register: keycloak_quarkus_systemdunit
|
||||
notify:
|
||||
- rebuild keycloak config
|
||||
- restart keycloak
|
||||
|
|
@ -0,0 +1,119 @@
|
|||
{{ ansible_managed | comment('xml') }}
|
||||
<!--
|
||||
~ Copyright 2019 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<infinispan
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="urn:infinispan:config:15.0 http://www.infinispan.org/schemas/infinispan-config-15.0.xsd"
|
||||
xmlns="urn:infinispan:config:15.0">
|
||||
|
||||
{% set stack_expression='' %}
|
||||
{% if keycloak_quarkus_version is version_compare('26.2.0', '<') %}
|
||||
{% if keycloak_quarkus_ha_enabled %}
|
||||
{% if keycloak_quarkus_ha_discovery == 'TCPPING' %}
|
||||
{% set stack_expression='stack="tcpping"' %}
|
||||
<jgroups>
|
||||
<stack name="tcpping" extends="tcp">
|
||||
<!-- <TCP external_addr="${env.KC_EXTERNAL_ADDR}" bind_addr="{{ keycloak_quarkus_http_host }}" bind_port="{{ keycloak_quarkus_jgroups_port }}" /> -->
|
||||
<TCPPING
|
||||
initial_hosts="{{ keycloak_quarkus_cluster_nodes | map(attribute='inventory_host') | join (',') }}"
|
||||
port_range="0"
|
||||
stack.combine="REPLACE"
|
||||
stack.position="MPING"
|
||||
/>
|
||||
</stack>
|
||||
</jgroups>
|
||||
{% elif keycloak_quarkus_ha_discovery == 'JDBCPING' %}
|
||||
{% set stack_expression='stack="JDBC_PING2"' %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
<cache-container name="keycloak">
|
||||
<transport lock-timeout="60000" {{ stack_expression }}/>
|
||||
<local-cache name="realms" simple-cache="true">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<memory max-count="10000"/>
|
||||
</local-cache>
|
||||
<local-cache name="users" simple-cache="true">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<memory max-count="10000"/>
|
||||
</local-cache>
|
||||
<distributed-cache name="sessions" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
<memory max-count="10000"/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="authenticationSessions" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="offlineSessions" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
<memory max-count="10000"/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="clientSessions" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
<memory max-count="10000"/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="offlineClientSessions" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
<memory max-count="10000"/>
|
||||
</distributed-cache>
|
||||
<distributed-cache name="loginFailures" owners="2">
|
||||
<expiration lifespan="-1"/>
|
||||
</distributed-cache>
|
||||
<local-cache name="authorization" simple-cache="true">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<memory max-count="10000"/>
|
||||
</local-cache>
|
||||
<replicated-cache name="work">
|
||||
<expiration lifespan="-1"/>
|
||||
</replicated-cache>
|
||||
<local-cache name="keys" simple-cache="true">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<expiration max-idle="3600000"/>
|
||||
<memory max-count="1000"/>
|
||||
</local-cache>
|
||||
<local-cache name="crl" simple-cache="true">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<expiration lifespan="-1"/>
|
||||
<memory max-count="1000"/>
|
||||
</local-cache>
|
||||
<distributed-cache name="actionTokens" owners="2">
|
||||
<encoding>
|
||||
<key media-type="application/x-java-object"/>
|
||||
<value media-type="application/x-java-object"/>
|
||||
</encoding>
|
||||
<expiration max-idle="-1" lifespan="-1" interval="300000"/>
|
||||
<memory max-count="-1"/>
|
||||
</distributed-cache>
|
||||
</cache-container>
|
||||
</infinispan>
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{{ ansible_managed | comment }}
|
||||
{% if not ansible_local.keycloak.general.bootstrapped | default(false) | bool %}
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME={{ keycloak_quarkus_bootstrap_admin_user }}
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD='{{ keycloak_quarkus_bootstrap_admin_password }}'
|
||||
{% else %}
|
||||
{{ keycloak.bootstrap_mnemonic }}
|
||||
{% endif %}
|
||||
PATH="{{ keycloak_quarkus_java_home | default(keycloak_sys_pkg_java_home, true) }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
JAVA_HOME="{{ keycloak_quarkus_java_home | default(keycloak_sys_pkg_java_home, true) }}"
|
||||
JAVA_OPTS="{{ keycloak_quarkus_java_opts }}"
|
||||
|
||||
# Custom ENV variables
|
||||
{% for env in keycloak_quarkus_additional_env_vars %}
|
||||
{{ env.key }}={{ env.value }}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
{% if keycloak_quarkus_db_enabled %}
|
||||
# Database
|
||||
db={{ keycloak_quarkus_db_engine }}
|
||||
db-url={{ keycloak_quarkus_db_url }}
|
||||
db-username={{ keycloak_quarkus_db_user }}
|
||||
{% if not keycloak.config_key_store_enabled %}
|
||||
db-password={{ keycloak_quarkus_db_pass }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if keycloak.config_key_store_enabled %}
|
||||
# Config store
|
||||
config-keystore={{ keycloak_quarkus_config_key_store_file }}
|
||||
config-keystore-password={{ keycloak_quarkus_config_key_store_password }}
|
||||
{% endif %}
|
||||
|
||||
# Observability
|
||||
metrics-enabled={{ keycloak_quarkus_metrics_enabled | lower }}
|
||||
health-enabled={{ keycloak_quarkus_health_enabled | lower }}
|
||||
|
||||
# HTTP
|
||||
http-enabled={{ keycloak_quarkus_http_enabled | lower }}
|
||||
{% if keycloak_quarkus_http_enabled %}
|
||||
http-port={{ keycloak_quarkus_http_port }}
|
||||
{% endif %}
|
||||
http-relative-path={{ keycloak_quarkus_http_relative_path }}
|
||||
http-host={{ keycloak_quarkus_http_host }}
|
||||
|
||||
# Management
|
||||
http-management-port={{ keycloak_quarkus_http_management_port }}
|
||||
{% if keycloak_quarkus_http_management_relative_path is defined and keycloak_quarkus_http_management_relative_path | length > 0 %}
|
||||
http-management-relative-path={{ keycloak_quarkus_http_management_relative_path }}
|
||||
{% endif %}
|
||||
|
||||
# HTTPS
|
||||
https-port={{ keycloak_quarkus_https_port }}
|
||||
{% if keycloak_quarkus_https_key_file_enabled %}
|
||||
https-certificate-file={{ keycloak_quarkus_cert_file}}
|
||||
https-certificate-key-file={{ keycloak_quarkus_key_file }}
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_https_key_store_enabled %}
|
||||
https-key-store-file={{ keycloak_quarkus_https_key_store_file }}
|
||||
https-key-store-password={{ keycloak_quarkus_https_key_store_password }}
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_https_trust_store_enabled %}
|
||||
https-trust-store-file={{ keycloak_quarkus_https_trust_store_file }}
|
||||
https-trust-store-password={{ keycloak_quarkus_https_trust_store_password }}
|
||||
{% endif %}
|
||||
|
||||
# Client URL configuration
|
||||
hostname={{ keycloak_quarkus_hostname }}
|
||||
hostname-admin={{ keycloak_quarkus_hostname_admin }}
|
||||
hostname-strict={{ keycloak_quarkus_hostname_strict | lower }}
|
||||
hostname-backchannel-dynamic={{ keycloak_quarkus_hostname_backchannel_dynamic | lower }}
|
||||
|
||||
# Cluster
|
||||
{% if keycloak_quarkus_ha_enabled %}
|
||||
cache=ispn
|
||||
{% if keycloak_quarkus_cache_managed_infinispan_config %}
|
||||
cache-config-file=cache-ispn.xml
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_cache_remote %}
|
||||
cache-remote-username={{ keycloak_quarkus_cache_remote_username }}
|
||||
cache-remote-password={{ keycloak_quarkus_cache_remote_password }}
|
||||
cache-remote-host={{ keycloak_quarkus_cache_remote_host }}
|
||||
cache-remote-port={{ keycloak_quarkus_cache_remote_port }}
|
||||
cache-remote-tls-enabled={{ keycloak_quarkus_cache_remote_tls_enabled | lower }}
|
||||
{% endif %}
|
||||
{{ keycloak_quarkus_cache_embedded_properties }}
|
||||
{% endif %}
|
||||
|
||||
{% if keycloak_quarkus_proxy_headers | length > 0 %}
|
||||
proxy-headers={{ keycloak_quarkus_proxy_headers | lower }}
|
||||
{% elif keycloak_quarkus_proxy_mode is defined and keycloak_quarkus_proxy_mode != "none" %}
|
||||
# Deprecated Proxy configuration
|
||||
proxy={{ keycloak_quarkus_proxy_mode }}
|
||||
{% endif %}
|
||||
|
||||
spi-sticky-session-encoder-infinispan-should-attach-route={{ keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route | d(true) | lower }}
|
||||
|
||||
# Transaction
|
||||
transaction-xa-enabled={{ keycloak_quarkus_transaction_xa_enabled | lower }}
|
||||
|
||||
# Logging
|
||||
#log-format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n
|
||||
log={{ keycloak_quarkus_log }}
|
||||
log-level={{ keycloak.log.level }}
|
||||
log-file={{ keycloak.log.file }}
|
||||
log-file-format={{ keycloak.log.format }}
|
||||
|
||||
# Vault
|
||||
{% if keycloak_quarkus_ks_vault_enabled %}
|
||||
vault=keystore
|
||||
vault-file={{ keycloak_quarkus_ks_vault_file }}
|
||||
vault-type={{ keycloak_quarkus_ks_vault_type }}
|
||||
vault-pass={{ keycloak_quarkus_ks_vault_pass }}
|
||||
{% endif %}
|
||||
|
||||
|
||||
# Providers
|
||||
{% for provider in keycloak_quarkus_providers %}
|
||||
{% if provider.default is defined and provider.default %}
|
||||
spi-{{ provider.spi }}-provider={{ provider.id }}
|
||||
{% endif %}
|
||||
{% if provider.properties is defined %}{% for property in provider.properties %}
|
||||
spi-{{ provider.spi }}-{{ provider.id }}-{{ property.key }}={{ property.value }}
|
||||
{% endfor %}{% endif %}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
[general]
|
||||
bootstrapped={{ bootstrapped | lower }}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{{ ansible_managed | comment }}
|
||||
[Unit]
|
||||
Description=Keycloak Server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-{{ keycloak_quarkus_sysconf_file }}
|
||||
{% if keycloak_quarkus_start_dev %}
|
||||
ExecStart={{ keycloak.home }}/bin/kc.sh start-dev
|
||||
{% else %}
|
||||
ExecStart={{ keycloak.home }}/bin/kc.sh start --optimized
|
||||
{% endif %}
|
||||
User={{ keycloak.service_user }}
|
||||
Group={{ keycloak.service_group }}
|
||||
SuccessExitStatus=0 143
|
||||
{% if keycloak_quarkus_service_restart_always %}
|
||||
Restart=always
|
||||
{% elif keycloak_quarkus_service_restart_on_failure %}
|
||||
Restart=on-failure
|
||||
{% endif %}
|
||||
RestartSec={{ keycloak_quarkus_service_restartsec }}
|
||||
{% if keycloak_quarkus_http_port | int < 1024 or keycloak_quarkus_https_port | int < 1024 %}
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_systemd_wait_for_port %}
|
||||
ExecStartPost=/usr/bin/timeout {{ keycloak_quarkus_systemd_wait_for_timeout }} sh -c 'while ! ss -H -t -l -n sport = :{{ keycloak_quarkus_systemd_wait_for_port_number }} | grep -q "^LISTEN.*:{{ keycloak_quarkus_systemd_wait_for_port_number }}"; do sleep 1; done && /bin/sleep {{ keycloak_quarkus_systemd_wait_for_delay }}'
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_systemd_wait_for_log %}
|
||||
ExecStartPost=/usr/bin/timeout {{ keycloak_quarkus_systemd_wait_for_timeout }} sh -c 'cat {{ keycloak.log.file }} | sed "/Profile.*activated/ q" && /bin/sleep {{ keycloak_quarkus_systemd_wait_for_delay }}'
|
||||
{% endif %}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{{ ansible_managed | comment }}
|
||||
{% if keycloak_quarkus_ha_enabled %}
|
||||
{% if keycloak_quarkus_version.split('.')[0] | int < 22 %}
|
||||
quarkus.infinispan-client.server-list={{ keycloak_quarkus_cache_remote_host }}:{{ keycloak_quarkus_cache_remote_port }}
|
||||
quarkus.infinispan-client.auth-username={{ keycloak_quarkus_cache_remote_username }}
|
||||
quarkus.infinispan-client.auth-password={{ keycloak_quarkus_cache_remote_password }}
|
||||
{% else %}
|
||||
quarkus.infinispan-client.hosts={{ keycloak_quarkus_cache_remote_host }}:{{ keycloak_quarkus_cache_remote_port }}
|
||||
quarkus.infinispan-client.username={{ keycloak_quarkus_cache_remote_username }}
|
||||
quarkus.infinispan-client.password={{ keycloak_quarkus_cache_remote_password }}
|
||||
{% endif %}
|
||||
quarkus.infinispan-client.client-intelligence=HASH_DISTRIBUTION_AWARE
|
||||
quarkus.infinispan-client.use-auth=true
|
||||
quarkus.infinispan-client.auth-realm=default
|
||||
quarkus.infinispan-client.auth-server-name=infinispan
|
||||
quarkus.infinispan-client.sasl-mechanism={{ keycloak_quarkus_cache_remote_sasl_mechanism }}
|
||||
{% if keycloak_quarkus_cache_remote_tls_enabled %}
|
||||
quarkus.infinispan-client.trust-store={{ keycloak_quarkus_https_trust_store_file }}
|
||||
quarkus.infinispan-client.trust-store-password={{ keycloak_quarkus_https_trust_store_password }}
|
||||
quarkus.infinispan-client.trust-store-type=jks
|
||||
{% endif %}
|
||||
#quarkus.infinispan-client.use-schema-registration=true
|
||||
{% endif %}
|
||||
quarkus.log.file.rotation.max-file-size={{ keycloak_quarkus_log_max_file_size }}
|
||||
quarkus.log.file.rotation.max-backup-index={{ keycloak_quarkus_log_max_backup_index }}
|
||||
quarkus.log.file.rotation.file-suffix={{ keycloak_quarkus_log_file_suffix }}
|
||||
{% if keycloak_quarkus_db_enabled %}
|
||||
quarkus.transaction-manager.enable-recovery=true
|
||||
{% endif %}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{{ ansible_managed | comment }}
|
||||
{% if not ansible_local.keycloak.general.bootstrapped | default(false) | bool %}
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME={{ keycloak_quarkus_bootstrap_admin_user }}
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD='{{ keycloak_quarkus_bootstrap_admin_password }}'
|
||||
{% else %}
|
||||
{{ keycloak.bootstrap_mnemonic }}
|
||||
{% endif %}
|
||||
PATH="{{ keycloak_quarkus_java_home | default(keycloak_sys_pkg_java_home, true) }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
JAVA_HOME="{{ keycloak_quarkus_java_home | default(keycloak_sys_pkg_java_home, true) }}"
|
||||
JAVA_OPTS="{{ keycloak_quarkus_java_opts }}"
|
||||
|
||||
# Custom ENV variables
|
||||
{% for env in keycloak_quarkus_additional_env_vars %}
|
||||
{{ env.key }}={{ env.value }}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
{% if keycloak_quarkus_db_enabled %}
|
||||
# Database
|
||||
db={{ keycloak_quarkus_db_engine }}
|
||||
db-url={{ keycloak_quarkus_db_url }}
|
||||
db-username={{ keycloak_quarkus_db_user }}
|
||||
{% if not keycloak.config_key_store_enabled %}
|
||||
db-password={{ keycloak_quarkus_db_pass }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if keycloak.config_key_store_enabled %}
|
||||
# Config store
|
||||
config-keystore={{ keycloak_quarkus_config_key_store_file }}
|
||||
config-keystore-password={{ keycloak_quarkus_config_key_store_password }}
|
||||
{% endif %}
|
||||
|
||||
# Observability
|
||||
metrics-enabled={{ keycloak_quarkus_metrics_enabled | lower }}
|
||||
health-enabled={{ keycloak_quarkus_health_enabled | lower }}
|
||||
|
||||
# HTTP
|
||||
http-enabled={{ keycloak_quarkus_http_enabled | lower }}
|
||||
{% if keycloak_quarkus_http_enabled %}
|
||||
http-port={{ keycloak_quarkus_http_port }}
|
||||
{% endif %}
|
||||
http-relative-path={{ keycloak_quarkus_http_relative_path }}
|
||||
http-host={{ keycloak_quarkus_http_host }}
|
||||
|
||||
# Management
|
||||
http-management-port={{ keycloak_quarkus_http_management_port }}
|
||||
{% if keycloak_quarkus_http_management_relative_path is defined and keycloak_quarkus_http_management_relative_path | length > 0 %}
|
||||
http-management-relative-path={{ keycloak_quarkus_http_management_relative_path }}
|
||||
{% endif %}
|
||||
|
||||
# HTTPS
|
||||
https-port={{ keycloak_quarkus_https_port }}
|
||||
{% if keycloak_quarkus_https_key_file_enabled %}
|
||||
https-certificate-file={{ keycloak_quarkus_cert_file}}
|
||||
https-certificate-key-file={{ keycloak_quarkus_key_file }}
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_https_key_store_enabled %}
|
||||
https-key-store-file={{ keycloak_quarkus_https_key_store_file }}
|
||||
https-key-store-password={{ keycloak_quarkus_https_key_store_password }}
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_https_trust_store_enabled %}
|
||||
https-trust-store-file={{ keycloak_quarkus_https_trust_store_file }}
|
||||
https-trust-store-password={{ keycloak_quarkus_https_trust_store_password }}
|
||||
{% endif %}
|
||||
|
||||
# Client URL configuration
|
||||
hostname={{ keycloak_quarkus_hostname }}
|
||||
hostname-admin={{ keycloak_quarkus_hostname_admin }}
|
||||
hostname-strict={{ keycloak_quarkus_hostname_strict | lower }}
|
||||
hostname-backchannel-dynamic={{ keycloak_quarkus_hostname_backchannel_dynamic | lower }}
|
||||
|
||||
# Cluster
|
||||
{% if keycloak_quarkus_ha_enabled %}
|
||||
cache=ispn
|
||||
{% if keycloak_quarkus_cache_managed_infinispan_config %}
|
||||
cache-config-file=cache-ispn.xml
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_cache_remote %}
|
||||
cache-remote-username={{ keycloak_quarkus_cache_remote_username }}
|
||||
cache-remote-password={{ keycloak_quarkus_cache_remote_password }}
|
||||
cache-remote-host={{ keycloak_quarkus_cache_remote_host }}
|
||||
cache-remote-port={{ keycloak_quarkus_cache_remote_port }}
|
||||
cache-remote-tls-enabled={{ keycloak_quarkus_cache_remote_tls_enabled | lower }}
|
||||
{% endif %}
|
||||
{{ keycloak_quarkus_cache_embedded_properties }}
|
||||
{% endif %}
|
||||
|
||||
{% if keycloak_quarkus_proxy_headers | length > 0 %}
|
||||
proxy-headers={{ keycloak_quarkus_proxy_headers | lower }}
|
||||
{% elif keycloak_quarkus_proxy_mode is defined and keycloak_quarkus_proxy_mode != "none" %}
|
||||
# Deprecated Proxy configuration
|
||||
proxy={{ keycloak_quarkus_proxy_mode }}
|
||||
{% endif %}
|
||||
|
||||
spi-sticky-session-encoder-infinispan-should-attach-route={{ keycloak_quarkus_spi_sticky_session_encoder_infinispan_should_attach_route | d(true) | lower }}
|
||||
|
||||
# Transaction
|
||||
transaction-xa-enabled={{ keycloak_quarkus_transaction_xa_enabled | lower }}
|
||||
|
||||
# Logging
|
||||
#log-format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n
|
||||
log={{ keycloak_quarkus_log }}
|
||||
log-level={{ keycloak.log.level }}
|
||||
log-file={{ keycloak.log.file }}
|
||||
log-file-format={{ keycloak.log.format }}
|
||||
|
||||
# Vault
|
||||
{% if keycloak_quarkus_ks_vault_enabled %}
|
||||
vault=keystore
|
||||
vault-file={{ keycloak_quarkus_ks_vault_file }}
|
||||
vault-type={{ keycloak_quarkus_ks_vault_type }}
|
||||
vault-pass={{ keycloak_quarkus_ks_vault_pass }}
|
||||
{% endif %}
|
||||
|
||||
|
||||
# Providers
|
||||
{% for provider in keycloak_quarkus_providers %}
|
||||
{% if provider.default is defined and provider.default %}
|
||||
spi-{{ provider.spi }}-provider={{ provider.id }}
|
||||
{% endif %}
|
||||
{% if provider.properties is defined %}{% for property in provider.properties %}
|
||||
spi-{{ provider.spi }}-{{ provider.id }}-{{ property.key }}={{ property.value }}
|
||||
{% endfor %}{% endif %}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
[general]
|
||||
bootstrapped={{ bootstrapped | lower }}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{{ ansible_managed | comment }}
|
||||
[Unit]
|
||||
Description=Keycloak Server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-{{ keycloak_quarkus_sysconf_file }}
|
||||
{% if keycloak_quarkus_start_dev %}
|
||||
ExecStart={{ keycloak.home }}/bin/kc.sh start-dev
|
||||
{% else %}
|
||||
ExecStart={{ keycloak.home }}/bin/kc.sh start --optimized
|
||||
{% endif %}
|
||||
User={{ keycloak.service_user }}
|
||||
Group={{ keycloak.service_group }}
|
||||
SuccessExitStatus=0 143
|
||||
{% if keycloak_quarkus_service_restart_always %}
|
||||
Restart=always
|
||||
{% elif keycloak_quarkus_service_restart_on_failure %}
|
||||
Restart=on-failure
|
||||
{% endif %}
|
||||
RestartSec={{ keycloak_quarkus_service_restartsec }}
|
||||
{% if keycloak_quarkus_http_port | int < 1024 or keycloak_quarkus_https_port | int < 1024 %}
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_systemd_wait_for_port %}
|
||||
ExecStartPost=/usr/bin/timeout {{ keycloak_quarkus_systemd_wait_for_timeout }} sh -c 'while ! ss -H -t -l -n sport = :{{ keycloak_quarkus_systemd_wait_for_port_number }} | grep -q "^LISTEN.*:{{ keycloak_quarkus_systemd_wait_for_port_number }}"; do sleep 1; done && /bin/sleep {{ keycloak_quarkus_systemd_wait_for_delay }}'
|
||||
{% endif %}
|
||||
{% if keycloak_quarkus_systemd_wait_for_log %}
|
||||
ExecStartPost=/usr/bin/timeout {{ keycloak_quarkus_systemd_wait_for_timeout }} sh -c 'cat {{ keycloak.log.file }} | sed "/Profile.*activated/ q" && /bin/sleep {{ keycloak_quarkus_systemd_wait_for_delay }}'
|
||||
{% endif %}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
---
|
||||
keycloak_quarkus_varjvm_package: "{{ keycloak_quarkus_jvm_package | default('openjdk-21-jdk-headless') }}"
|
||||
keycloak_quarkus_prereq_package_list:
|
||||
- "{{ keycloak_quarkus_varjvm_package }}"
|
||||
- bash
|
||||
- unzip
|
||||
- procps
|
||||
- apt
|
||||
- tzdata
|
||||
keycloak_quarkus_sysconf_file: /etc/default/keycloak
|
||||
keycloak_quarkus_pkg_java_home: "/usr/lib/jvm/java-{{ keycloak_quarkus_varjvm_package | \
|
||||
regex_search('(?!:openjdk-)[0-9.]+') }}-openjdk-{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
keycloak: # noqa var-naming this is an internal dict of interpolated values
|
||||
home: "{{ keycloak_quarkus_home }}"
|
||||
config_dir: "{{ keycloak_quarkus_config_dir }}"
|
||||
bundle: "{{ keycloak_quarkus_archive }}"
|
||||
service_name: "keycloak"
|
||||
health_url: "{{ keycloak_quarkus_health_check_url }}"
|
||||
cli_path: "{{ keycloak_quarkus_home }}/bin/kcadm.sh"
|
||||
service_user: "{{ keycloak_quarkus_service_user }}"
|
||||
service_group: "{{ keycloak_quarkus_service_group }}"
|
||||
offline_install: "{{ keycloak_quarkus_offline_install }}"
|
||||
config_key_store_enabled: "{{ keycloak_quarkus_config_key_store_password != '' }}"
|
||||
log:
|
||||
file: "{{ keycloak_quarkus_home }}/{{ keycloak_quarkus_log_file }}"
|
||||
level: "{{ keycloak_quarkus_log_level }}"
|
||||
format: "{{ keycloak_quarkus_log_format }}"
|
||||
bootstrap_mnemonic: "# ansible-middleware/keycloak: bootstrapped"
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
keycloak_quarkus_varjvm_package: "{{ keycloak_quarkus_jvm_package | default('java-21-openjdk-headless') }}"
|
||||
keycloak_quarkus_prereq_package_list:
|
||||
- "{{ keycloak_quarkus_varjvm_package }}"
|
||||
- bash
|
||||
- unzip
|
||||
- procps-ng
|
||||
- initscripts
|
||||
- tzdata-java
|
||||
keycloak_quarkus_sysconf_file: /etc/sysconfig/keycloak
|
||||
keycloak_quarkus_pkg_java_home: "/etc/alternatives/jre_{{ keycloak_quarkus_varjvm_package | regex_search('(?<=java-)[0-9.]+') }}"
|
||||
|
|
@ -0,0 +1,196 @@
|
|||
keycloak_realm
|
||||
==============
|
||||
<!--start description_realm -->
|
||||
|
||||
Create realms and clients in [keycloak](https://keycloak.org/) or [Red Hat Single Sign-On](https://access.redhat.com/products/red-hat-single-sign-on) services.
|
||||
<!--end description_realm -->
|
||||
|
||||
Role Defaults
|
||||
-------------
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:--------|
|
||||
|`keycloak_realm_admin_user`| Administration console user account | `admin` |
|
||||
|`keycloak_realm_host`| hostname | `localhost` |
|
||||
|`keycloak_realm_context`| Context path for rest calls (set to `/auth` for legacy WildFly-based Keycloak) | `` |
|
||||
|`keycloak_realm_http_port`| HTTP port | `8080` |
|
||||
|`keycloak_realm_https_port`| TLS HTTP port | `8443` |
|
||||
|`keycloak_realm_auth_realm`| Name of the main authentication realm | `master` |
|
||||
|`keycloak_realm_management_http_port`| Management port | `9990` |
|
||||
|`keycloak_realm_auth_client`| Authentication client for configuration REST calls | `admin-cli` |
|
||||
|`keycloak_realm_client_public`| Configure a public realm client | `True` |
|
||||
|`keycloak_realm_client_web_origins`| Web origins for realm client | `/*` |
|
||||
|`keycloak_realm_url`| URL for configuration rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port }}` |
|
||||
|`keycloak_realm_management_url`| URL for management console rest calls | `http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port }}` |
|
||||
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
The following are a set of _required_ variables for the role:
|
||||
|
||||
| Variable | Description |
|
||||
|:---------|:------------|
|
||||
|`keycloak_realm_realm` | Name of the realm to be created |
|
||||
|`keycloak_realm_admin_password`| Password for the administration console user account |
|
||||
|
||||
|
||||
The following variables are available for creating clients:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_realm_clients` | List of _client_ declarations for the realm | `[]` |
|
||||
|`keycloak_realm_client_default_roles` | List of default role name for clients | `[]` |
|
||||
|`keycloak_realm_client_users` | List of user/role mappings for a client | `[]` |
|
||||
|
||||
|
||||
The following variables are available for creating user federation:
|
||||
|
||||
| Variable | Description | Default |
|
||||
|:---------|:------------|:---------|
|
||||
|`keycloak_realm_user_federation` | List of _keycloak_user_federation_ for the realm | `[]` |
|
||||
|
||||
|
||||
Variable formats
|
||||
----------------
|
||||
|
||||
* `keycloak_realm_user_federation`, a list of:
|
||||
|
||||
```yaml
|
||||
- realm: <name of the realm in which user federation should be configured, required>
|
||||
name: <name of the user federation provider, required>
|
||||
provider_id: <type of the user federation provider, required>
|
||||
provider_type: <Provider Type, default is set to org.keycloak.storage.UserStorageProvider>
|
||||
config: <dictionary of supported configuration values, required>
|
||||
mappers: <list of supported configuration values, required>
|
||||
```
|
||||
|
||||
Refer to [docs](https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_user_federation_module.html) for information on supported variables.
|
||||
|
||||
|
||||
* `keycloak_realm_clients`, a list of:
|
||||
|
||||
```yaml
|
||||
- name: <name of the client>
|
||||
id: <id of the client>
|
||||
client_id: <id of the client>
|
||||
secret: <secret of the client (Optional)>
|
||||
roles: <keycloak_realm_client_default_roles>
|
||||
realm: <name of the realm that contains the client>
|
||||
public_client: <true for public, false for confidential>
|
||||
web_origins: <list of allowed we origins for the client>
|
||||
users: <keycloak_realm_client_users>
|
||||
```
|
||||
|
||||
`name` and either `id` or `client_id` are required.
|
||||
|
||||
|
||||
* `keycloak_realm_client_users`, a list of:
|
||||
|
||||
```yaml
|
||||
- username: <username, required>
|
||||
password: <password, required>
|
||||
firstName: <firstName, optional>
|
||||
lastName: <lastName, optional>
|
||||
email: <email, optional>
|
||||
client_roles: <list of client user/role mappings>
|
||||
```
|
||||
|
||||
* Client user/role mappings, a list of:
|
||||
|
||||
```yaml
|
||||
- client: <name of the client>
|
||||
role: <name of the role>
|
||||
realm: <name of the realm>
|
||||
```
|
||||
|
||||
For a comprehensive example, refer to the [playbook](../../playbooks/keycloak_realm.yml).
|
||||
|
||||
|
||||
Related Modules
|
||||
---------------
|
||||
|
||||
For features not covered by this role, the collection provides dedicated modules:
|
||||
|
||||
| Module | What It Manages |
|
||||
|:-------|:----------------|
|
||||
| `keycloak_client_scope` | Client scopes and protocol mappers — see [example playbook](../../playbooks/keycloak_client_scope.yml) |
|
||||
| `keycloak_authentication_flow` | Authentication flows and execution steps — see [example playbook](../../playbooks/keycloak_authentication_flow.yml) |
|
||||
| `keycloak_client` | Clients (also used internally by this role) |
|
||||
| `keycloak_role` | Realm and client roles |
|
||||
| `keycloak_realm_user_federation` | User federations such as LDAP (also used internally by this role) |
|
||||
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
The following is an example playbook that makes use of the role to create a realm in keycloak.
|
||||
|
||||
```yaml
|
||||
---
|
||||
- hosts: ...
|
||||
collections:
|
||||
- middleware_automation.keycloak
|
||||
tasks:
|
||||
- name: Include keycloak role
|
||||
include_role:
|
||||
name: keycloak_realm
|
||||
vars:
|
||||
keycloak_admin_password: "changeme"
|
||||
keycloak_realm: TestRealm
|
||||
keycloak_clients: [...]
|
||||
```
|
||||
|
||||
The following example uses the `keycloak_client_scope` module to create a client scope with protocol mappers:
|
||||
|
||||
```yaml
|
||||
- name: Create client scope
|
||||
middleware_automation.keycloak.keycloak_client_scope:
|
||||
auth_keycloak_url: http://localhost:8080
|
||||
auth_realm: master
|
||||
auth_username: admin
|
||||
auth_password: changeme
|
||||
realm: TestRealm
|
||||
name: my-scope
|
||||
protocol_mappers:
|
||||
- name: email
|
||||
protocolMapper: oidc-usermodel-attribute-mapper
|
||||
config:
|
||||
user.attribute: email
|
||||
claim.name: email
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
state: present
|
||||
```
|
||||
|
||||
The following example uses the `keycloak_authentication_flow` module to create a custom authentication flow:
|
||||
|
||||
```yaml
|
||||
- name: Create authentication flow
|
||||
middleware_automation.keycloak.keycloak_authentication_flow:
|
||||
auth_keycloak_url: http://localhost:8080
|
||||
auth_realm: master
|
||||
auth_username: admin
|
||||
auth_password: changeme
|
||||
realm: TestRealm
|
||||
alias: my-browser-flow
|
||||
executions:
|
||||
- provider_id: auth-cookie
|
||||
requirement: ALTERNATIVE
|
||||
- provider_id: auth-password
|
||||
requirement: REQUIRED
|
||||
state: present
|
||||
```
|
||||
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache License 2.0
|
||||
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
* [Guido Grazioli](https://github.com/guidograzioli)
|
||||
* [Romain Pelisse](https://github.com/rpelisse)
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
---
|
||||
### Keycloak configuration settings
|
||||
keycloak_realm_host: localhost
|
||||
keycloak_realm_http_port: 8080
|
||||
keycloak_realm_https_port: 8443
|
||||
keycloak_realm_management_http_port: 9990
|
||||
|
||||
### Keycloak administration console user
|
||||
keycloak_realm_admin_user: admin
|
||||
keycloak_realm_auth_realm: master
|
||||
keycloak_realm_auth_client: admin-cli
|
||||
keycloak_realm_context: ''
|
||||
|
||||
# administrator console password, this is a required variable
|
||||
keycloak_realm_admin_password: ''
|
||||
|
||||
### Keycloak realms, clients, roles, federation
|
||||
# list of clients to create in the realm
|
||||
#
|
||||
# Refer to the playbook for a comprehensive example.
|
||||
# Also refer to meta/argument_specs.yml for specifications.
|
||||
#
|
||||
# Each client has the form:
|
||||
# { name: '', roles: [], realm: '', public_client: bool, web_origins: '', users: [] }
|
||||
# where roles is a list of default role names for the client
|
||||
# and users is a list of account, see below for the format definition
|
||||
# an empty name will skip the creation of the client
|
||||
#
|
||||
# keycloak_realm_clients:
|
||||
# - name: ''
|
||||
# roles: "{{ keycloak_realm_client_default_roles }}"
|
||||
# realm: "{{ keycloak_realm_realm }}"
|
||||
# public_client: "{{ keycloak_realm_client_public }}"
|
||||
# web_origins: "{{ keycloak_realm_client_web_origins }}"
|
||||
# redirect_uris: "{{ keycloak_realm_client_redirect_uris }}"
|
||||
# users: "{{ keycloak_realm_client_users }}"
|
||||
keycloak_realm_clients: []
|
||||
|
||||
# list of roles to create in the client
|
||||
keycloak_realm_client_default_roles: []
|
||||
|
||||
# if True, create a public client; otherwise, a confidetial client
|
||||
keycloak_realm_client_public: true
|
||||
|
||||
# allowed web origins for the client
|
||||
keycloak_realm_client_web_origins: '/*'
|
||||
|
||||
# list of user and role mappings to create in the client
|
||||
# Each user has the form:
|
||||
# { username: '', password: '', email: '', firstName: '', lastName: '', client_roles: [] }
|
||||
# where each client_role has the form:
|
||||
# { client: '', role: '', realm: '' }
|
||||
keycloak_realm_client_users: []
|
||||
|
||||
### List of Keycloak User Federation
|
||||
keycloak_realm_user_federation: []
|
||||
|
||||
# other settings
|
||||
keycloak_realm_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
|
||||
keycloak_realm_management_url: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + (keycloak_realm_jboss_port_offset | default(0)) }}"
|
||||
keycloak_realm_no_log: true
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
argument_specs:
|
||||
main:
|
||||
options:
|
||||
keycloak_realm_host:
|
||||
# line 3 of keycloak_realm/defaults/main.yml
|
||||
default: "localhost"
|
||||
description: "Hostname for rest calls"
|
||||
type: "str"
|
||||
keycloak_realm_context:
|
||||
# line 5 of keycloak_realm/defaults/main.yml
|
||||
default: ""
|
||||
description: "Context path for rest calls (was /auth for legacy WildFly-based Keycloak, empty for Quarkus-based Keycloak/RHBK)"
|
||||
type: "str"
|
||||
keycloak_realm_http_port:
|
||||
# line 4 of keycloak_realm/defaults/main.yml
|
||||
default: 8080
|
||||
description: "HTTP port"
|
||||
type: "int"
|
||||
keycloak_realm_https_port:
|
||||
# line 5 of keycloak_realm/defaults/main.yml
|
||||
default: 8443
|
||||
description: "HTTPS port"
|
||||
type: "int"
|
||||
keycloak_realm_management_http_port:
|
||||
# line 6 of keycloak_realm/defaults/main.yml
|
||||
default: 9990
|
||||
description: "Management port"
|
||||
type: "int"
|
||||
keycloak_realm_admin_user:
|
||||
# line 10 of keycloak_realm/defaults/main.yml
|
||||
default: "admin"
|
||||
description: "Administration console user account"
|
||||
type: "str"
|
||||
keycloak_realm_auth_realm:
|
||||
# line 11 of keycloak_realm/defaults/main.yml
|
||||
default: "master"
|
||||
description: "Name of the main authentication realm"
|
||||
type: "str"
|
||||
keycloak_realm_auth_client:
|
||||
# line 12 of keycloak_realm/defaults/main.yml
|
||||
default: "admin-cli"
|
||||
description: "Authentication client for configuration REST calls"
|
||||
type: "str"
|
||||
keycloak_realm_client_default_roles:
|
||||
# line 36 of keycloak_realm/defaults/main.yml
|
||||
default: "[]"
|
||||
description: "List of roles to configure as client default"
|
||||
type: "list"
|
||||
keycloak_realm_client_public:
|
||||
# line 39 of keycloak_realm/defaults/main.yml
|
||||
default: true
|
||||
description: "Configure a public realm client"
|
||||
type: "bool"
|
||||
keycloak_realm_client_web_origins:
|
||||
# line 42 of keycloak_realm/defaults/main.yml
|
||||
default: "/*"
|
||||
description: "Web origins for realm client"
|
||||
type: "str"
|
||||
keycloak_realm_client_users:
|
||||
# line 49 of keycloak_realm/defaults/main.yml
|
||||
default: "[]"
|
||||
description: "List of users to configure in the realm client"
|
||||
type: "list"
|
||||
keycloak_realm_user_federation:
|
||||
# line 52 of keycloak_realm/defaults/main.yml
|
||||
default: "[]"
|
||||
description: "List of user federations to configure in the realm"
|
||||
type: "list"
|
||||
keycloak_realm_admin_password:
|
||||
# line 5 of keycloak_realm/vars/main.yml
|
||||
required: true
|
||||
description: "Password for the administration console user account"
|
||||
type: "str"
|
||||
keycloak_realm_realm:
|
||||
# line 8 of keycloak_realm/vars/main.yml
|
||||
required: true
|
||||
description: "Name of the realm to be configured"
|
||||
type: "str"
|
||||
keycloak_realm_clients:
|
||||
# line 11 of keycloak_realm/vars/main.yml
|
||||
default: "[]"
|
||||
description: "List of client declarations for the realm"
|
||||
type: "list"
|
||||
keycloak_realm_url:
|
||||
# line 14 of keycloak_realm/vars/main.yml
|
||||
default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
|
||||
description: "URL for configuration rest calls"
|
||||
type: "str"
|
||||
keycloak_realm_management_url:
|
||||
# line 15 of keycloak_realm/vars/main.yml
|
||||
default: "http://{{ keycloak_realm_host }}:{{ keycloak_realm_management_http_port + ( keycloak_realm_jboss_port_offset | default(0) ) }}"
|
||||
description: "URL for management console rest calls"
|
||||
type: "str"
|
||||
downstream:
|
||||
options:
|
||||
sso_version:
|
||||
default: "7.6.0"
|
||||
description: "Red Hat Single Sign-On version"
|
||||
type: "str"
|
||||
sso_dest:
|
||||
default: "/opt/sso"
|
||||
description: "Root installation directory"
|
||||
type: "str"
|
||||
sso_installdir:
|
||||
default: "{{ sso_dest }}/rh-sso-{{ sso_version.split('.')[0] }}.{{ sso_version.split('.')[1] }}"
|
||||
description: "Installation path for Red Hat SSO"
|
||||
type: "str"
|
||||
sso_apply_patches:
|
||||
default: false
|
||||
description: "Install Red Hat SSO most recent cumulative patch"
|
||||
type: "bool"
|
||||
sso_enable:
|
||||
default: true
|
||||
description: "Enable Red Hat Single Sign-on installation"
|
||||
type: "bool"
|
||||
rhbk_version:
|
||||
default: "22.0.6"
|
||||
description: "Red Hat Build of Keycloak version"
|
||||
type: "str"
|
||||
rhbk_archive:
|
||||
default: "rhbk-{{ rhbk_version }}.zip"
|
||||
description: "Red Hat Build of Keycloak install archive filename"
|
||||
type: "str"
|
||||
rhbk_dest:
|
||||
default: "/opt/rhbk"
|
||||
description: "Root installation directory"
|
||||
type: "str"
|
||||
rhbk_installdir:
|
||||
default: "{{ rhbk_dest }}/rhbk-{{ rhbk_version.split('.')[0] }}.{{ rhbk_version.split('.')[1] }}"
|
||||
description: "Installation path for Red Hat Build of Keycloak"
|
||||
type: "str"
|
||||
rhbk_enable:
|
||||
default: true
|
||||
description: "Enable Red Hat Build of Keycloak installation"
|
||||
type: "bool"
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
galaxy_info:
|
||||
role_name: keycloak_realm
|
||||
namespace: middleware_automation
|
||||
author: Romain Pelisse, Guido Grazioli
|
||||
description: Create realms and clients in keycloak or Red Hat Single Sign-On
|
||||
company: Red Hat, Inc.
|
||||
|
||||
license: Apache License 2.0
|
||||
|
||||
min_ansible_version: "2.16"
|
||||
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- "8"
|
||||
|
||||
galaxy_tags:
|
||||
- keycloak
|
||||
- redhat
|
||||
- rhel
|
||||
- sso
|
||||
|
|
@ -0,0 +1,119 @@
|
|||
---
|
||||
- name: Generate keycloak auth token
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
|
||||
method: POST
|
||||
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
register: keycloak_realm_auth_response
|
||||
until: keycloak_realm_auth_response.status == 200
|
||||
retries: 5
|
||||
delay: 2
|
||||
|
||||
- name: "Determine if realm exists"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
- 404
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_realm_exists
|
||||
|
||||
- name: Create Realm
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms"
|
||||
method: POST
|
||||
body: "{{ lookup('template', 'realm.json.j2') }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 201
|
||||
when: keycloak_realm_realm_exists.status == 404
|
||||
|
||||
- name: Create user federation
|
||||
middleware_automation.keycloak.keycloak_user_federation:
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
provider_id: "{{ item.provider_id }}"
|
||||
provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}"
|
||||
config: "{{ item.config }}"
|
||||
mappers: "{{ item.mappers | default(omit) }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
register: keycloak_realm_create_user_federation_result
|
||||
loop: "{{ keycloak_realm_user_federation | flatten }}"
|
||||
when: keycloak_realm_user_federation is defined
|
||||
|
||||
- name: Validate Keycloak clients
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- item.name is defined and item.name | length > 0
|
||||
- (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0)
|
||||
fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required"
|
||||
quiet: true
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
label: "{{ item.name | default('unnamed client') }}"
|
||||
|
||||
- name: Create or update a Keycloak client
|
||||
middleware_automation.keycloak.keycloak_client:
|
||||
auth_client_id: "{{ keycloak_realm_auth_client }}"
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
|
||||
default_roles: "{{ item.roles | default(omit) }}"
|
||||
client_id: "{{ item.client_id | default(omit) }}"
|
||||
id: "{{ item.id | default(omit) }}"
|
||||
secret: "{{ item.secret | default(omit) }}"
|
||||
name: "{{ item.name | default(omit) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
root_url: "{{ item.root_url | default('') }}"
|
||||
admin_url: "{{ item.admin_url | default('') }}"
|
||||
base_url: "{{ item.base_url | default('') }}"
|
||||
enabled: "{{ item.enabled | default(True) }}"
|
||||
redirect_uris: "{{ item.redirect_uris | default(omit) }}"
|
||||
web_origins: "{{ item.web_origins | default(omit) }}"
|
||||
bearer_only: "{{ item.bearer_only | default(omit) }}"
|
||||
standard_flow_enabled: "{{ item.standard_flow_enabled | default(omit) }}"
|
||||
implicit_flow_enabled: "{{ item.implicit_flow_enabled | default(omit) }}"
|
||||
direct_access_grants_enabled: "{{ item.direct_access_grants_enabled | default(omit) }}"
|
||||
service_accounts_enabled: "{{ item.service_accounts_enabled | default(omit) }}"
|
||||
public_client: "{{ item.public_client | default(False) }}"
|
||||
protocol: "{{ item.protocol | default(omit) }}"
|
||||
attributes: "{{ item.attributes | default(omit) }}"
|
||||
state: present
|
||||
no_log: "{{ keycloak_realm_no_log | default('false') }}"
|
||||
register: keycloak_realm_create_client_result
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined)
|
||||
|
||||
- name: Create client roles
|
||||
ansible.builtin.include_tasks: manage_client_roles.yml
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client
|
||||
when: "'roles' in client"
|
||||
|
||||
- name: Create client users
|
||||
ansible.builtin.include_tasks: manage_client_users.yml
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client
|
||||
when: "'users' in client"
|
||||
|
||||
- name: Provide Access token lifespan
|
||||
ansible.builtin.include_tasks: manage_token_lifespan.yml
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
- name: Create client roles
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: "{{ item }}"
|
||||
realm: "{{ client.realm | default(keycloak_realm_realm) }}"
|
||||
client_id: "{{ client.client_id }}"
|
||||
auth_client_id: "{{ keycloak_realm_auth_client }}"
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
state: present
|
||||
loop: "{{ client.roles | flatten }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
- name: Manage Users
|
||||
ansible.builtin.include_tasks: manage_user.yml
|
||||
loop: "{{ client.users | flatten }}"
|
||||
loop_control:
|
||||
loop_var: user
|
||||
|
||||
- name: Manage User Roles
|
||||
ansible.builtin.include_tasks: manage_user_roles.yml
|
||||
loop: "{{ client.users | flatten }}"
|
||||
loop_control:
|
||||
loop_var: user
|
||||
when: "'client_roles' in user"
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
- name: "Update Access token lifespan"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
|
||||
method: PUT
|
||||
body:
|
||||
accessTokenLifespan: 300
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
status_code:
|
||||
- 200
|
||||
- 204
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
- name: "Check if User Already Exists"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user_search_result
|
||||
|
||||
- name: "Create User"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users"
|
||||
method: POST
|
||||
body:
|
||||
enabled: true
|
||||
attributes: "{{ user.attributes | default(omit) }}"
|
||||
username: "{{ user.username }}"
|
||||
email: "{{ user.email | default(omit) }}"
|
||||
firstName: "{{ user.firstName | default(omit) }}"
|
||||
lastName: "{{ user.lastName | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 201
|
||||
when: keycloak_realm_user_search_result.json | length == 0
|
||||
|
||||
- name: "Get User"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
||||
- name: "Update User Password"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users/{{ (keycloak_realm_user.json | first).id }}/reset-password"
|
||||
method: PUT
|
||||
body:
|
||||
type: password
|
||||
temporary: false
|
||||
value: "{{ user.password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
status_code:
|
||||
- 200
|
||||
- 204
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
---
|
||||
- name: "Get Realm for role"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm_realm) }}"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_client_role_realm
|
||||
|
||||
- name: Check if Mapping is available
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
|
||||
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
|
||||
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_client_role_user_available
|
||||
|
||||
- name: "Create Role Mapping"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
|
||||
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
|
||||
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}"
|
||||
method: POST
|
||||
body:
|
||||
- id: "{{ item.id }}"
|
||||
clientRole: "{{ item.clientRole }}"
|
||||
containerId: "{{ item.containerId }}"
|
||||
name: "{{ item.name }}"
|
||||
composite: "{{ item.composite }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 204
|
||||
loop: "{{ keycloak_realm_client_role_user_available.json | flatten }}"
|
||||
when: item.name == client_role.role
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: "Get User {{ user.username }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
||||
- name: Refresh keycloak auth token
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
|
||||
method: POST
|
||||
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
register: keycloak_realm_auth_response
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
until: keycloak_realm_auth_response.status == 200
|
||||
retries: 5
|
||||
delay: 2
|
||||
|
||||
- name: "Manage Client Role Mapping for {{ user.username }}"
|
||||
ansible.builtin.include_tasks: manage_user_client_roles.yml
|
||||
loop: "{{ user.client_roles | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client_role
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"id": "{{ keycloak_realm_realm }}",
|
||||
"realm": "{{ keycloak_realm_realm }}",
|
||||
"enabled": true,
|
||||
"eventsEnabled": true,
|
||||
"eventsExpiration": 7200
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
# vars file for keycloak_realm
|
||||
|
||||
# name of the realm to create, this is a required variable
|
||||
keycloak_realm_realm:
|
||||
Loading…
Reference in a new issue