Stefan Bethke
32b5f147bc
Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas: conditions silently ignored outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn sibling bug, conditional-credential config shape/semantics, and more) before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console.
24 lines
929 B
YAML
24 lines
929 B
YAML
---
|
|
argument_specs:
|
|
main:
|
|
options:
|
|
keycloak_auth_flow__flows:
|
|
description: >-
|
|
List of authentication flow definitions to validate and deploy. Each item needs
|
|
C(realm), C(alias) and C(authenticationExecutions) (nested tree, see
|
|
middleware_automation.keycloak.keycloak_authentication_v2), and may set C(providerId)
|
|
and C(description).
|
|
type: list
|
|
elements: dict
|
|
keycloak_auth_flow__admin_url:
|
|
description: Base URL of the Keycloak Admin REST API.
|
|
type: str
|
|
default: "http://127.0.0.1:8080"
|
|
keycloak_auth_flow__admin_username:
|
|
description: Username of a Keycloak admin (in the C(master) realm) used to manage flows.
|
|
type: str
|
|
default: admin
|
|
keycloak_auth_flow__admin_password:
|
|
description: Password for O(keycloak_auth_flow__admin_username).
|
|
type: str
|
|
required: true
|