Stefan Bethke
32b5f147bc
Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas: conditions silently ignored outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn sibling bug, conditional-credential config shape/semantics, and more) before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console.
25 lines
1 KiB
YAML
25 lines
1 KiB
YAML
- name: Validate Keycloak authentication flow definitions
|
|
keycloak_auth_flow_lint:
|
|
realm: "{{ item.realm }}"
|
|
alias: "{{ item.alias }}"
|
|
providerId: "{{ item.providerId | default('basic-flow') }}"
|
|
authenticationExecutions: "{{ item.authenticationExecutions }}"
|
|
loop: "{{ keycloak_auth_flow__flows }}"
|
|
loop_control:
|
|
label: "{{ item.realm }}/{{ item.alias }}"
|
|
|
|
- name: Deploy Keycloak authentication flows
|
|
middleware_automation.keycloak.keycloak_authentication_v2:
|
|
auth_keycloak_url: "{{ keycloak_auth_flow__admin_url }}"
|
|
auth_realm: master
|
|
auth_username: "{{ keycloak_auth_flow__admin_username }}"
|
|
auth_password: "{{ keycloak_auth_flow__admin_password }}"
|
|
realm: "{{ item.realm }}"
|
|
alias: "{{ item.alias }}"
|
|
description: "{{ item.description | default(omit) }}"
|
|
providerId: "{{ item.providerId | default('basic-flow') }}"
|
|
authenticationExecutions: "{{ item.authenticationExecutions }}"
|
|
state: present
|
|
loop: "{{ keycloak_auth_flow__flows }}"
|
|
loop_control:
|
|
label: "{{ item.realm }}/{{ item.alias }}"
|