mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
00fd2847e4
* keycloak_user_rolemapping: implement user role mapping
* keycloak_user_rolemapping: additional logging
* keycloak_user_rolemapping: move to getters, use names parameters
* keycloak_user_rolemapping: add service account user example
* Add keyring and keyring_info modules (#4764)
* keycloak_user_rolemapping: write tests, address ansibullbot concerns no.1
* keycloak_user_rolemapping: address felixfontein concerns no.1
* keycloak_user_rolemapping: remove rebase mistakes
* keycloak_user_rolemapping: address felixfontein concerns no.2
* keycloak_user_rolemapping: refactor duplicate username usage example
* keycloak_user_rolemapping: fix sanity check errors no.1
* keycloak_user_rolemapping: fix sanity check errors no.2
* keycloak_user_rolemapping: fix sanity check errors no.3
* keycloak_user_rolemapping: fix sanity check errors no.4
* keycloak_user_rolemapping: write tests, address ansibullbot concerns no.1
* keycloak_user_rolemapping: resolve rebase conflicts with origin/main branch
# Conflicts:
# plugins/module_utils/identity/keycloak/keycloak.py
* keycloak_user_rolemapping: remove keycloak_role_composites from BOTMETA.yml
* keycloak_user_rolemapping: fix sanity check errors no.5
* keycloak_user_rolemapping: address felixfontein reviews concerns no.1
* keycloak_user_rolemapping: address felixfontein reviews concerns no.2
Co-authored-by: Dušan Markovič <dusan.markovic@better.care>
Co-authored-by: ahussey-redhat <93101976+ahussey-redhat@users.noreply.github.com>
(cherry picked from commit 2cac3ae879)
Co-authored-by: bratwurzt <johnny.galatikitis@gmail.com>
143 lines
4.6 KiB
YAML
143 lines
4.6 KiB
YAML
# Copyright (c) 2022, Dušan Marković (@bratwurzt)
|
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
- name: Create realm
|
|
community.general.keycloak_realm:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
id: "{{ realm }}"
|
|
realm: "{{ realm }}"
|
|
state: present
|
|
|
|
- name: Create client
|
|
community.general.keycloak_client:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
service_accounts_enabled: True
|
|
state: present
|
|
register: client
|
|
|
|
- name: Create new realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
description: "{{ description_1 }}"
|
|
state: present
|
|
|
|
- name: Map a realm role to client service account
|
|
vars:
|
|
- roles: [ {'name': '{{ role }}'} ]
|
|
community.general.keycloak_user_rolemapping:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
service_account_user_client_id: "{{ client_id }}"
|
|
roles: "{{ roles }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Assert realm role is assigned
|
|
assert:
|
|
that:
|
|
- result is changed
|
|
- result.end_state | selectattr("clientRole", "eq", false) | selectattr("name", "eq", "{{role}}") | list | count > 0
|
|
|
|
- name: Unmap a realm role from client service account
|
|
vars:
|
|
- roles: [ {'name': '{{ role }}'} ]
|
|
community.general.keycloak_user_rolemapping:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
service_account_user_client_id: "{{ client_id }}"
|
|
roles: "{{ roles }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Assert realm role is unassigned
|
|
assert:
|
|
that:
|
|
- result is changed
|
|
- (result.end_state | length) == (result.existing | length) - 1
|
|
- result.existing | selectattr("clientRole", "eq", false) | selectattr("name", "eq", "{{role}}") | list | count > 0
|
|
- result.end_state | selectattr("clientRole", "eq", false) | selectattr("name", "eq", "{{role}}") | list | count == 0
|
|
|
|
- name: Delete existing realm role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
name: "{{ role }}"
|
|
state: absent
|
|
|
|
- name: Create new client role
|
|
community.general.keycloak_role:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
name: "{{ role }}"
|
|
description: "{{ description_1 }}"
|
|
state: present
|
|
|
|
- name: Map a client role to client service account
|
|
vars:
|
|
- roles: [ {'name': '{{ role }}'} ]
|
|
community.general.keycloak_user_rolemapping:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
service_account_user_client_id: "{{ client_id }}"
|
|
roles: "{{ roles }}"
|
|
state: present
|
|
register: result
|
|
|
|
- name: Assert client role is assigned
|
|
assert:
|
|
that:
|
|
- result is changed
|
|
- result.end_state | selectattr("clientRole", "eq", true) | selectattr("name", "eq", "{{role}}") | list | count > 0
|
|
|
|
- name: Unmap a client role from client service account
|
|
vars:
|
|
- roles: [ {'name': '{{ role }}'} ]
|
|
community.general.keycloak_user_rolemapping:
|
|
auth_keycloak_url: "{{ url }}"
|
|
auth_realm: "{{ admin_realm }}"
|
|
auth_username: "{{ admin_user }}"
|
|
auth_password: "{{ admin_password }}"
|
|
realm: "{{ realm }}"
|
|
client_id: "{{ client_id }}"
|
|
service_account_user_client_id: "{{ client_id }}"
|
|
roles: "{{ roles }}"
|
|
state: absent
|
|
register: result
|
|
|
|
- name: Assert client role is unassigned
|
|
assert:
|
|
that:
|
|
- result is changed
|
|
- result.end_state == []
|
|
- result.existing | selectattr("clientRole", "eq", true) | selectattr("name", "eq", "{{role}}") | list | count > 0
|