Vendor middleware_automation.keycloak collection
Needed for keycloak_authentication_v2, to manage Keycloak authentication flows (e.g. the CCCHH browser flow) as YAML. Chosen over community.general's own copy of the module (deprecated in favor of this collection, and limited to 4 sub-flow levels there vs. 10 here).
This commit is contained in:
parent
4540dc5516
commit
4832e5da5d
159 changed files with 34399 additions and 0 deletions
|
|
@ -0,0 +1,119 @@
|
|||
---
|
||||
- name: Generate keycloak auth token
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
|
||||
method: POST
|
||||
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
register: keycloak_realm_auth_response
|
||||
until: keycloak_realm_auth_response.status == 200
|
||||
retries: 5
|
||||
delay: 2
|
||||
|
||||
- name: "Determine if realm exists"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
- 404
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_realm_exists
|
||||
|
||||
- name: Create Realm
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms"
|
||||
method: POST
|
||||
body: "{{ lookup('template', 'realm.json.j2') }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 201
|
||||
when: keycloak_realm_realm_exists.status == 404
|
||||
|
||||
- name: Create user federation
|
||||
middleware_automation.keycloak.keycloak_user_federation:
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
provider_id: "{{ item.provider_id }}"
|
||||
provider_type: "{{ item.provider_type | default('org.keycloak.storage.UserStorageProvider') }}"
|
||||
config: "{{ item.config }}"
|
||||
mappers: "{{ item.mappers | default(omit) }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
register: keycloak_realm_create_user_federation_result
|
||||
loop: "{{ keycloak_realm_user_federation | flatten }}"
|
||||
when: keycloak_realm_user_federation is defined
|
||||
|
||||
- name: Validate Keycloak clients
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- item.name is defined and item.name | length > 0
|
||||
- (item.client_id is defined and item.client_id | length > 0) or (item.id is defined and item.id | length > 0)
|
||||
fail_msg: "For each keycloak client, attributes `name` and either `id` or `client_id` is required"
|
||||
quiet: true
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
label: "{{ item.name | default('unnamed client') }}"
|
||||
|
||||
- name: Create or update a Keycloak client
|
||||
middleware_automation.keycloak.keycloak_client:
|
||||
auth_client_id: "{{ keycloak_realm_auth_client }}"
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
realm: "{{ item.realm | default(keycloak_realm_realm) }}"
|
||||
default_roles: "{{ item.roles | default(omit) }}"
|
||||
client_id: "{{ item.client_id | default(omit) }}"
|
||||
id: "{{ item.id | default(omit) }}"
|
||||
secret: "{{ item.secret | default(omit) }}"
|
||||
name: "{{ item.name | default(omit) }}"
|
||||
description: "{{ item.description | default(omit) }}"
|
||||
root_url: "{{ item.root_url | default('') }}"
|
||||
admin_url: "{{ item.admin_url | default('') }}"
|
||||
base_url: "{{ item.base_url | default('') }}"
|
||||
enabled: "{{ item.enabled | default(True) }}"
|
||||
redirect_uris: "{{ item.redirect_uris | default(omit) }}"
|
||||
web_origins: "{{ item.web_origins | default(omit) }}"
|
||||
bearer_only: "{{ item.bearer_only | default(omit) }}"
|
||||
standard_flow_enabled: "{{ item.standard_flow_enabled | default(omit) }}"
|
||||
implicit_flow_enabled: "{{ item.implicit_flow_enabled | default(omit) }}"
|
||||
direct_access_grants_enabled: "{{ item.direct_access_grants_enabled | default(omit) }}"
|
||||
service_accounts_enabled: "{{ item.service_accounts_enabled | default(omit) }}"
|
||||
public_client: "{{ item.public_client | default(False) }}"
|
||||
protocol: "{{ item.protocol | default(omit) }}"
|
||||
attributes: "{{ item.attributes | default(omit) }}"
|
||||
state: present
|
||||
no_log: "{{ keycloak_realm_no_log | default('false') }}"
|
||||
register: keycloak_realm_create_client_result
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
when: (item.name is defined and item.client_id is defined) or (item.name is defined and item.id is defined)
|
||||
|
||||
- name: Create client roles
|
||||
ansible.builtin.include_tasks: manage_client_roles.yml
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client
|
||||
when: "'roles' in client"
|
||||
|
||||
- name: Create client users
|
||||
ansible.builtin.include_tasks: manage_client_users.yml
|
||||
loop: "{{ keycloak_realm_clients | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client
|
||||
when: "'users' in client"
|
||||
|
||||
- name: Provide Access token lifespan
|
||||
ansible.builtin.include_tasks: manage_token_lifespan.yml
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
- name: Create client roles
|
||||
middleware_automation.keycloak.keycloak_role:
|
||||
name: "{{ item }}"
|
||||
realm: "{{ client.realm | default(keycloak_realm_realm) }}"
|
||||
client_id: "{{ client.client_id }}"
|
||||
auth_client_id: "{{ keycloak_realm_auth_client }}"
|
||||
auth_keycloak_url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}"
|
||||
auth_realm: "{{ keycloak_realm_auth_realm }}"
|
||||
auth_username: "{{ keycloak_realm_admin_user }}"
|
||||
auth_password: "{{ keycloak_realm_admin_password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
state: present
|
||||
loop: "{{ client.roles | flatten }}"
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
- name: Manage Users
|
||||
ansible.builtin.include_tasks: manage_user.yml
|
||||
loop: "{{ client.users | flatten }}"
|
||||
loop_control:
|
||||
loop_var: user
|
||||
|
||||
- name: Manage User Roles
|
||||
ansible.builtin.include_tasks: manage_user_roles.yml
|
||||
loop: "{{ client.users | flatten }}"
|
||||
loop_control:
|
||||
loop_var: user
|
||||
when: "'client_roles' in user"
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
- name: "Update Access token lifespan"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}"
|
||||
method: PUT
|
||||
body:
|
||||
accessTokenLifespan: 300
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
status_code:
|
||||
- 200
|
||||
- 204
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
- name: "Check if User Already Exists"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user_search_result
|
||||
|
||||
- name: "Create User"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users"
|
||||
method: POST
|
||||
body:
|
||||
enabled: true
|
||||
attributes: "{{ user.attributes | default(omit) }}"
|
||||
username: "{{ user.username }}"
|
||||
email: "{{ user.email | default(omit) }}"
|
||||
firstName: "{{ user.firstName | default(omit) }}"
|
||||
lastName: "{{ user.lastName | default(omit) }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 201
|
||||
when: keycloak_realm_user_search_result.json | length == 0
|
||||
|
||||
- name: "Get User"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
||||
- name: "Update User Password"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users/{{ (keycloak_realm_user.json | first).id }}/reset-password"
|
||||
method: PUT
|
||||
body:
|
||||
type: password
|
||||
temporary: false
|
||||
value: "{{ user.password }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
status_code:
|
||||
- 200
|
||||
- 204
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
---
|
||||
- name: "Get Realm for role"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | default(keycloak_realm_realm) }}"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_client_role_realm
|
||||
|
||||
- name: Check if Mapping is available
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
|
||||
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
|
||||
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}/available"
|
||||
method: GET
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
status_code:
|
||||
- 200
|
||||
headers:
|
||||
Accept: "application/json"
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_client_role_user_available
|
||||
|
||||
- name: "Create Role Mapping"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ client_role.realm | \
|
||||
default(keycloak_realm_realm) }}/users/{{ (keycloak_realm_user.json | first).id }}/role-mappings/clients/{{ (keycloak_realm_create_client_result.results | \
|
||||
selectattr('end_state.clientId', 'equalto', client_role.client) | list | first).end_state.id }}"
|
||||
method: POST
|
||||
body:
|
||||
- id: "{{ item.id }}"
|
||||
clientRole: "{{ item.clientRole }}"
|
||||
containerId: "{{ item.containerId }}"
|
||||
name: "{{ item.name }}"
|
||||
composite: "{{ item.composite }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
status_code: 204
|
||||
loop: "{{ keycloak_realm_client_role_user_available.json | flatten }}"
|
||||
when: item.name == client_role.role
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: "Get User {{ user.username }}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/admin/realms/{{ keycloak_realm_realm }}/users?username={{ user.username }}"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
headers:
|
||||
Authorization: "Bearer {{ keycloak_realm_auth_response.json.access_token }}"
|
||||
register: keycloak_realm_user
|
||||
|
||||
- name: Refresh keycloak auth token
|
||||
ansible.builtin.uri:
|
||||
url: "{{ keycloak_realm_url }}{{ keycloak_realm_context }}/realms/master/protocol/openid-connect/token"
|
||||
method: POST
|
||||
body: "client_id={{ keycloak_realm_auth_client }}&username={{ keycloak_realm_admin_user }}&password={{ keycloak_realm_admin_password }}&grant_type=password"
|
||||
validate_certs: "{{ keycloak_realm_validate_certs | default(omit) }}"
|
||||
register: keycloak_realm_auth_response
|
||||
no_log: "{{ keycloak_realm_no_log | default('True') }}"
|
||||
until: keycloak_realm_auth_response.status == 200
|
||||
retries: 5
|
||||
delay: 2
|
||||
|
||||
- name: "Manage Client Role Mapping for {{ user.username }}"
|
||||
ansible.builtin.include_tasks: manage_user_client_roles.yml
|
||||
loop: "{{ user.client_roles | flatten }}"
|
||||
loop_control:
|
||||
loop_var: client_role
|
||||
Loading…
Reference in a new issue