mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
f96c6476fe
Keycloak set client authentification flows by name (#8428)
* first commit
* Add change logs
* fix sanity
* Sanity 2
* Test unset flows
* Update plugins/modules/keycloak_client.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/keycloak_client.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update changelogs/fragments/8428-assign-auth-flow-by-name-keycloak-client.yaml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Remove double traitement from "alias"
* Update plugins/modules/keycloak_client.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/keycloak_client.py
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Andre Desrosiers <andre.desrosiers@ssss.gouv.qc.ca>
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit b11da288d2)
Co-authored-by: desand01 <desrosiers.a@hotmail.com>
233 lines
No EOL
8.7 KiB
YAML
233 lines
No EOL
8.7 KiB
YAML
---
|
|
# Copyright (c) Ansible Project
|
|
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
- name: Wait for Keycloak
|
|
uri:
|
|
url: "{{ url }}/admin/"
|
|
status_code: 200
|
|
validate_certs: no
|
|
register: result
|
|
until: result.status == 200
|
|
retries: 10
|
|
delay: 10
|
|
|
|
- name: Delete realm
|
|
community.general.keycloak_realm:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
id: "{{ realm }}"
|
|
realm: "{{ realm }}"
|
|
state: absent
|
|
|
|
- name: Create realm
|
|
community.general.keycloak_realm:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
id: "{{ realm }}"
|
|
realm: "{{ realm }}"
|
|
state: present
|
|
|
|
- name: Desire client
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
register: desire_client_not_present
|
|
|
|
- name: Desire client again with same props
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
register: desire_client_when_present_and_same
|
|
|
|
- name: Check client again with same props
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authorization_services_enabled: False
|
|
check_mode: true
|
|
register: check_client_when_present_and_same
|
|
|
|
- name: Assert changes not detected in last two tasks (desire when same, and check)
|
|
assert:
|
|
that:
|
|
- desire_client_when_present_and_same is not changed
|
|
- check_client_when_present_and_same is not changed
|
|
|
|
- name: Check client again with changed props
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authorization_services_enabled: False
|
|
service_accounts_enabled: True
|
|
check_mode: true
|
|
register: check_client_when_present_and_changed
|
|
|
|
- name: Assert changes detected in last tasks
|
|
assert:
|
|
that:
|
|
- check_client_when_present_and_changed is changed
|
|
|
|
- name: Desire client with flow binding overrides
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authentication_flow_binding_overrides:
|
|
browser_name: browser
|
|
direct_grant_name: direct grant
|
|
register: desire_client_with_flow_binding_overrides
|
|
|
|
- name: Assert flows are set
|
|
assert:
|
|
that:
|
|
- desire_client_with_flow_binding_overrides is changed
|
|
- "'authenticationFlowBindingOverrides' in desire_client_with_flow_binding_overrides.end_state"
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.browser | length > 0
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.direct_grant | length > 0
|
|
|
|
- name: Backup flow UUIDs
|
|
set_fact:
|
|
flow_browser_uuid: "{{ desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.browser }}"
|
|
flow_direct_grant_uuid: "{{ desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.direct_grant }}"
|
|
|
|
- name: Desire client with flow binding overrides remove direct_grant_name
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authentication_flow_binding_overrides:
|
|
browser_name: browser
|
|
register: desire_client_with_flow_binding_overrides
|
|
|
|
- name: Assert flows are updated
|
|
assert:
|
|
that:
|
|
- desire_client_with_flow_binding_overrides is changed
|
|
- "'authenticationFlowBindingOverrides' in desire_client_with_flow_binding_overrides.end_state"
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.browser | length > 0
|
|
- "'direct_grant' not in desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides"
|
|
|
|
- name: Desire client with flow binding overrides remove browser add direct_grant
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authentication_flow_binding_overrides:
|
|
direct_grant_name: direct grant
|
|
register: desire_client_with_flow_binding_overrides
|
|
|
|
- name: Assert flows are updated
|
|
assert:
|
|
that:
|
|
- desire_client_with_flow_binding_overrides is changed
|
|
- "'authenticationFlowBindingOverrides' in desire_client_with_flow_binding_overrides.end_state"
|
|
- "'browser' not in desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides"
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.direct_grant | length > 0
|
|
|
|
- name: Desire client with flow binding overrides with UUIDs
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authentication_flow_binding_overrides:
|
|
browser: "{{ flow_browser_uuid }}"
|
|
direct_grant: "{{ flow_direct_grant_uuid }}"
|
|
register: desire_client_with_flow_binding_overrides
|
|
|
|
- name: Assert flows are updated
|
|
assert:
|
|
that:
|
|
- desire_client_with_flow_binding_overrides is changed
|
|
- "'authenticationFlowBindingOverrides' in desire_client_with_flow_binding_overrides.end_state"
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.browser == flow_browser_uuid
|
|
- desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides.direct_grant == flow_direct_grant_uuid
|
|
|
|
- name: Unset flow binding overrides
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
state: present
|
|
redirect_uris: '{{redirect_uris1}}'
|
|
attributes: '{{client_attributes1}}'
|
|
protocol_mappers: '{{protocol_mappers1}}'
|
|
authentication_flow_binding_overrides:
|
|
browser: "{{ None }}"
|
|
direct_grant: null
|
|
register: desire_client_with_flow_binding_overrides
|
|
|
|
- name: Assert flows are removed
|
|
assert:
|
|
that:
|
|
- desire_client_with_flow_binding_overrides is changed
|
|
- "'authenticationFlowBindingOverrides' in desire_client_with_flow_binding_overrides.end_state"
|
|
- "'browser' not in desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides"
|
|
- "'direct_grant' not in desire_client_with_flow_binding_overrides.end_state.authenticationFlowBindingOverrides" |