CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 20 Pull requests 14 Wiki Activity Actions

Manage the CCCHH browser authentication flow as YAML #150

Open
stb wants to merge 2 commits from keycloak-browser-flow into main
pull from: keycloak-browser-flow
merge into: CCCHH:main
Conversation 1 Commits 2 Files changed 168 +35015
stb commented 2026-09-02 11:10:28 +02:00
Owner
Copy link

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

For review, concentrate on the second commit; the vendoring of middleware_automation.keycloak is huge.

Closes #148

Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console. For review, concentrate on the second commit; the vendoring of middleware_automation.keycloak is huge. Closes #148
Needed for keycloak_authentication_v2, to manage Keycloak
authentication flows (e.g. the CCCHH browser flow) as YAML.
Chosen over community.general's own copy of the module (deprecated in
favor of this collection, and limited to 4 sub-flow levels there vs.
10 here).
Manage the CCCHH browser authentication flow as YAML
All checks were successful
/ build (pull_request) Successful in 47s
Details
/ Ansible Lint (push) Successful in 5m31s
Details
/ Ansible Lint (pull_request) Successful in 4m35s
Details
32b5f147bc 
Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.
forgejo-actions commented 2026-09-02 11:11:11 +02:00
Copy link

You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr150/

You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr150/
All checks were successful
/ build (pull_request) Successful in 47s
Required
Details
/ Ansible Lint (push) Successful in 5m31s
Required
Details
/ Ansible Lint (pull_request) Successful in 4m35s
Required
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin keycloak-browser-flow:keycloak-browser-flow
git switch keycloak-browser-flow
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
renovate
Created automatically by Renovate.

  
waiting on upstream
Waiting on upstream until this can be merged.

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
renovate
waiting on upstream
wontfix
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
CCCHH/ansible-infra!150
No description provided.