kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-08-20 02:35:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updated keycloak variables

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach 2025-08-17 10:47:40 +02:00
parent fb7b3a3c8e
commit 0a83f3159a
No known key found for this signature in database
GPG Key ID: 44D8F11FD62F878E
7 changed files with 110 additions and 111 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
roles/web-app-keycloak/tasks/02_update_client_redirects.yml
View File

@ -3,13 +3,13 @@
# ── REQUIRED VARS (must be provided by caller) ─────────────────────────────── # ── REQUIRED VARS (must be provided by caller) ───────────────────────────────
# - WEB_PROTOCOL e.g. "https" # - WEB_PROTOCOL e.g. "https"
# - keycloak_realm target realm name # - KEYCLOAK_REALM target realm name
# - keycloak_server_host_url e.g. "http://127.0.0.1:8080" # - KEYCLOAK_SERVER_HOST_URL e.g. "http://127.0.0.1:8080"
# - keycloak_server_internal_url e.g. "http://127.0.0.1:8080" # - KEYCLOAK_SERVER_INTERNAL_URL e.g. "http://127.0.0.1:8080"
# - keycloak_kcadm_path e.g. "docker exec -i keycloak /opt/keycloak/bin/kcadm.sh" # - KEYCLOAK_KCADM_PATH e.g. "docker exec -i keycloak /opt/keycloak/bin/kcadm.sh"
# - keycloak_master_api_user_name # - KEYCLOAK_MASTER_API_USER_NAME
# - keycloak_master_api_user_password # - KEYCLOAK_MASTER_API_USER_PASSWORD
# - keycloak_client_id clientId to update (e.g. same as realm or an app client) # - KEYCLOAK_CLIENT_ID clientId to update (e.g. same as realm or an app client)
# - domains your domain map # - domains your domain map
# - applications your applications map # - applications your applications map
@ -17,14 +17,14 @@
assert: assert:
that: that:
- WEB_PROTOCOL is defined - WEB_PROTOCOL is defined
- keycloak_realm is defined - KEYCLOAK_REALM is defined
- keycloak_server_host_url is defined - KEYCLOAK_SERVER_HOST_URL is defined
- keycloak_server_internal_url is defined - KEYCLOAK_SERVER_INTERNAL_URL is defined
- keycloak_kcadm_path is defined - KEYCLOAK_KCADM_PATH is defined
- keycloak_master_api_user_name is defined - KEYCLOAK_MASTER_API_USER_NAME is defined
- keycloak_master_api_user_password is defined - KEYCLOAK_MASTER_API_USER_PASSWORD is defined
- keycloak_client_id is defined - KEYCLOAK_CLIENT_ID is defined
- keycloak_redirect_features is defined - KEYCLOAK_REDIRECT_FEATURES is defined
- domains is defined - domains is defined
- applications is defined - applications is defined
fail_msg: "Missing required variable(s). Provide all vars listed at the top of 02_update_client_redirects.yml." fail_msg: "Missing required variable(s). Provide all vars listed at the top of 02_update_client_redirects.yml."
@ -32,18 +32,18 @@
- name: "kcadm login" - name: "kcadm login"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}" no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
shell: > shell: >
{{ keycloak_kcadm_path }} config credentials {{ KEYCLOAK_KCADM_PATH }} config credentials
--server {{ keycloak_server_internal_url }} --server {{ KEYCLOAK_SERVER_INTERNAL_URL }}
--realm master --realm master
--user {{ keycloak_master_api_user_name }} --user {{ KEYCLOAK_MASTER_API_USER_NAME }}
--password {{ keycloak_master_api_user_password }} --password {{ KEYCLOAK_MASTER_API_USER_PASSWORD }}
changed_when: false changed_when: false
# 1) Build desired sets (NO defaults) # 1) Build desired sets (NO defaults)
- name: "Build desired redirect URIs from config via filter" - name: "Build desired redirect URIs from config via filter"
set_fact: set_fact:
kc_redirect_uris: >- kc_redirect_uris: >-
{{ domains | redirect_uris(applications, WEB_PROTOCOL, '/*', keycloak_redirect_features, True) }} {{ domains | redirect_uris(applications, WEB_PROTOCOL, '/*', KEYCLOAK_REDIRECT_FEATURES, True) }}
- name: Build desired web origins (scheme://host[:port]) - name: Build desired web origins (scheme://host[:port])
set_fact: set_fact:
@ -55,11 +55,11 @@
| list | unique }} | list | unique }}
# 2) Resolve client id (strictly by provided clientId, no fallback) # 2) Resolve client id (strictly by provided clientId, no fallback)
- name: "Resolve client internal id for {{ keycloak_client_id }}" - name: "Resolve client internal id for {{ KEYCLOAK_CLIENT_ID }}"
shell: > shell: >
{{ keycloak_kcadm_path }} get clients {{ KEYCLOAK_KCADM_PATH }} get clients
-r {{ keycloak_realm }} -r {{ KEYCLOAK_REALM }}
--query 'clientId={{ keycloak_client_id }}' --query 'clientId={{ KEYCLOAK_CLIENT_ID }}'
--fields id --format json | jq -r '.[0].id' --fields id --format json | jq -r '.[0].id'
register: kc_client register: kc_client
changed_when: false changed_when: false
@ -67,13 +67,13 @@
- name: "Fail if client not found" - name: "Fail if client not found"
assert: assert:
that: kc_client.stdout is match('^[0-9a-f-]+$') that: kc_client.stdout is match('^[0-9a-f-]+$')
fail_msg: "Client '{{ keycloak_client_id }}' not found in realm '{{ keycloak_realm }}'." fail_msg: "Client '{{ KEYCLOAK_CLIENT_ID }}' not found in realm '{{ KEYCLOAK_REALM }}'."
# 3) Read current config (assume keys exist; we don't use defaults) # 3) Read current config (assume keys exist; we don't use defaults)
- name: "Read current client configuration" - name: "Read current client configuration"
shell: > shell: >
{{ keycloak_kcadm_path }} get clients/{{ kc_client.stdout }} {{ KEYCLOAK_KCADM_PATH }} get clients/{{ kc_client.stdout }}
-r {{ keycloak_realm }} --format json -r {{ KEYCLOAK_REALM }} --format json
register: kc_client_obj register: kc_client_obj
changed_when: false changed_when: false
@ -114,13 +114,13 @@
# 4) Update only when changed # 4) Update only when changed
- name: "Update client with redirectUris, webOrigins, frontchannelLogout" - name: "Update client with redirectUris, webOrigins, frontchannelLogout"
shell: > shell: >
{{ keycloak_kcadm_path }} update clients/{{ kc_client.stdout }} {{ KEYCLOAK_KCADM_PATH }} update clients/{{ kc_client.stdout }}
-r {{ keycloak_realm }} -r {{ KEYCLOAK_REALM }}
-s 'redirectUris={{ kc_redirect_uris | to_json }}' -s 'redirectUris={{ kc_redirect_uris | to_json }}'
-s 'webOrigins={{ kc_web_origins | to_json }}' -s 'webOrigins={{ kc_web_origins | to_json }}'
-s 'frontchannelLogout=true' -s 'frontchannelLogout=true'
-s 'attributes."frontchannel.logout.url"={{ kc_desired_frontchannel_logout_url | to_json }}' -s 'attributes."frontchannel.logout.url"={{ KEYCLOAK_FRONTCHANNEL_LOGOUT_URL | to_json }}'
when: kc_current_redirect_uris != kc_desired_redirect_uris when: kc_current_redirect_uris != kc_desired_redirect_uris
or kc_current_web_origins != kc_desired_web_origins or kc_current_web_origins != kc_desired_web_origins
or kc_current_frontchannel_logout_url != kc_desired_frontchannel_logout_url or kc_current_frontchannel_logout_url != KEYCLOAK_FRONTCHANNEL_LOGOUT_URL

32
roles/web-app-keycloak/tasks/03_update-ldap-bind.yml
View File

@ -12,12 +12,12 @@
- name: "Assert required vars exist (strict: use ldap.* only, no defaults)" - name: "Assert required vars exist (strict: use ldap.* only, no defaults)"
assert: assert:
that: that:
- keycloak_realm is defined - KEYCLOAK_REALM is defined
- keycloak_container is defined - KEYCLOAK_CONTAINER is defined
- keycloak_server_internal_url is defined - KEYCLOAK_SERVER_INTERNAL_URL is defined
- keycloak_master_api_user_name is defined - KEYCLOAK_MASTER_API_USER_NAME is defined
- keycloak_master_api_user_password is defined - KEYCLOAK_MASTER_API_USER_PASSWORD is defined
- keycloak_ldap_component_name is defined - KEYCLOAK_LDAP_CMP_NAME is defined
- ldap is defined - ldap is defined
- ldap.dn.administrator is defined - ldap.dn.administrator is defined
- ldap.dn.administrator.data is defined - ldap.dn.administrator.data is defined
@ -35,7 +35,7 @@
- docker - docker
- exec - exec
- -i - -i
- "{{ keycloak_container }}" - "{{ KEYCLOAK_CONTAINER }}"
- /opt/keycloak/bin/kcadm.sh - /opt/keycloak/bin/kcadm.sh
- name: "kcadm login (master)" - name: "kcadm login (master)"
@ -43,19 +43,19 @@
command: command:
argv: "{{ kcadm_argv_base argv: "{{ kcadm_argv_base
+ ['config', 'credentials', + ['config', 'credentials',
'--server', keycloak_server_internal_url, '--server', KEYCLOAK_SERVER_INTERNAL_URL,
'--realm', 'master', '--realm', 'master',
'--user', keycloak_master_api_user_name, '--user', KEYCLOAK_MASTER_API_USER_NAME,
'--password', keycloak_master_api_user_password] }}" '--password', KEYCLOAK_MASTER_API_USER_PASSWORD] }}"
changed_when: false changed_when: false
# Resolve the LDAP component *by name* to avoid picking the wrong one. # Resolve the LDAP component *by name* to avoid picking the wrong one.
- name: "Resolve LDAP component id by name '{{ keycloak_ldap_component_name }}'" - name: "Resolve LDAP component id by name '{{ KEYCLOAK_LDAP_CMP_NAME }}'"
command: command:
argv: "{{ kcadm_argv_base argv: "{{ kcadm_argv_base
+ ['get', 'components', + ['get', 'components',
'-r', keycloak_realm, '-r', KEYCLOAK_REALM,
'--query', 'name=' ~ keycloak_ldap_component_name, '--query', 'name=' ~ KEYCLOAK_LDAP_CMP_NAME,
'--fields', 'id,name,providerId,config', '--fields', 'id,name,providerId,config',
'--format', 'json'] }}" '--format', 'json'] }}"
register: kc_ldap_list register: kc_ldap_list
@ -68,7 +68,7 @@
that: that:
- (parsed | length) == 1 - (parsed | length) == 1
fail_msg: >- fail_msg: >-
Expected exactly one LDAP component named '{{ keycloak_ldap_component_name }}', Expected exactly one LDAP component named '{{ KEYCLOAK_LDAP_CMP_NAME }}',
found {{ (kc_ldap_list.stdout | from_json) | length }}. found {{ (kc_ldap_list.stdout | from_json) | length }}.
- name: "Extract current LDAP component values" - name: "Extract current LDAP component values"
@ -102,7 +102,7 @@
command: command:
argv: "{{ kcadm_argv_base argv: "{{ kcadm_argv_base
+ ['update', 'components/' ~ kc_ldap_component_id, + ['update', 'components/' ~ kc_ldap_component_id,
'-r', keycloak_realm, '-r', KEYCLOAK_REALM,
'-s', 'config.bindDn=' ~ ([kc_desired_bind_dn] | to_json), '-s', 'config.bindDn=' ~ ([kc_desired_bind_dn] | to_json),
'-s', 'config.bindCredential=' ~ ([kc_desired_bind_pw] | to_json), '-s', 'config.bindCredential=' ~ ([kc_desired_bind_pw] | to_json),
'-s', 'config.connectionUrl=' ~ ([kc_desired_connection_url] | to_json) '-s', 'config.connectionUrl=' ~ ([kc_desired_connection_url] | to_json)
@ -112,7 +112,7 @@
- name: "LDAP provider updated" - name: "LDAP provider updated"
debug: debug:
msg: "LDAP bindDn/bindCredential/connectionUrl updated on component {{ keycloak_ldap_component_name }}." msg: "LDAP bindDn/bindCredential/connectionUrl updated on component {{ KEYCLOAK_LDAP_CMP_NAME }}."
when: when:
- kc_bind_update is defined - kc_bind_update is defined
- kc_bind_update.rc == 0 - kc_bind_update.rc == 0

30
roles/web-app-keycloak/tasks/04_ssh_public_key.yml
View File

@ -1,17 +1,17 @@
# Configure Credentials # Configure Credentials
- name: Ensure Keycloak CLI credentials are configured - name: Ensure Keycloak CLI credentials are configured
shell: | shell: |
{{ keycloak_kcadm_path }} config credentials \ {{ KEYCLOAK_KCADM_PATH }} config credentials \
--server {{ keycloak_server_internal_url }} \ --server {{ KEYCLOAK_SERVER_INTERNAL_URL }} \
--realm master \ --realm master \
--user {{ keycloak_master_api_user_name }} \ --user {{ KEYCLOAK_MASTER_API_USER_NAME }} \
--password {{ keycloak_master_api_user_password }} --password {{ KEYCLOAK_MASTER_API_USER_PASSWORD }}
# LDAP Source # LDAP Source
- name: Get ID of LDAP storage provider - name: Get ID of LDAP storage provider
shell: | shell: |
{{ keycloak_kcadm_path }} get components \ {{ KEYCLOAK_KCADM_PATH }} get components \
-r {{ keycloak_realm }} \ -r {{ KEYCLOAK_REALM }} \
--query 'providerId=ldap' \ --query 'providerId=ldap' \
--fields id,name \ --fields id,name \
--format json --format json
@ -24,7 +24,7 @@
- name: Ensure {{ ldap.user.attributes.ssh_public_key }} LDAP Mapper exists - name: Ensure {{ ldap.user.attributes.ssh_public_key }} LDAP Mapper exists
shell: | shell: |
docker exec -i keycloak_application bash -c ' docker exec -i keycloak_application bash -c '
/opt/keycloak/bin/kcadm.sh get components -r {{ keycloak_realm }} \ /opt/keycloak/bin/kcadm.sh get components -r {{ KEYCLOAK_REALM }} \
| grep -q "\"name\" : \"{{ ldap.user.attributes.ssh_public_key }}\"" \ | grep -q "\"name\" : \"{{ ldap.user.attributes.ssh_public_key }}\"" \
|| printf "%s\n" "{ || printf "%s\n" "{
\"name\": \"{{ ldap.user.attributes.ssh_public_key }}\", \"name\": \"{{ ldap.user.attributes.ssh_public_key }}\",
@ -39,7 +39,7 @@
\"always.read.value.from.ldap\": [\"false\"], \"always.read.value.from.ldap\": [\"false\"],
\"multivalued\": [\"true\"] \"multivalued\": [\"true\"]
} }
}" | /opt/keycloak/bin/kcadm.sh create components -r {{ keycloak_realm }} -f -' }" | /opt/keycloak/bin/kcadm.sh create components -r {{ KEYCLOAK_REALM }} -f -'
register: mapper_create register: mapper_create
changed_when: mapper_create.rc == 0 and mapper_create.stdout != "" changed_when: mapper_create.rc == 0 and mapper_create.stdout != ""
@ -47,16 +47,16 @@
- name: Enable user profile in realm - name: Enable user profile in realm
shell: > shell: >
{{ keycloak_kcadm_path }} update realms/{{ keycloak_realm }} {{ KEYCLOAK_KCADM_PATH }} update realms/{{ KEYCLOAK_REALM }}
-s 'attributes.userProfileEnabled=true' -s 'attributes.userProfileEnabled=true'
- name: Re-authenticate to Keycloak after enabling user profile - name: Re-authenticate to Keycloak after enabling user profile
shell: | shell: |
{{ keycloak_kcadm_path }} config credentials \ {{ KEYCLOAK_KCADM_PATH }} config credentials \
--server {{ keycloak_server_internal_url }} \ --server {{ KEYCLOAK_SERVER_INTERNAL_URL }} \
--realm master \ --realm master \
--user {{ keycloak_master_api_user_name }} \ --user {{ KEYCLOAK_MASTER_API_USER_NAME }} \
--password {{ keycloak_master_api_user_password }} --password {{ KEYCLOAK_MASTER_API_USER_PASSWORD }}
- name: Render user-profile JSON for SSH key - name: Render user-profile JSON for SSH key
template: template:
@ -67,5 +67,5 @@
- name: Apply SSH Public Key to user-profile via kcadm - name: Apply SSH Public Key to user-profile via kcadm
shell: | shell: |
docker exec -i {{ keycloak_container }} \ docker exec -i {{ KEYCLOAK_CONTAINER }} \
/opt/keycloak/bin/kcadm.sh update realms/{{ keycloak_realm }} -f {{ keycloak_docker_import_directory }}user-profile.json /opt/keycloak/bin/kcadm.sh update realms/{{ KEYCLOAK_REALM }} -f {{ KEYCLOAK_DOCKER_IMPORT_DIR }}user-profile.json

8
roles/web-app-keycloak/tasks/main.yml
View File

@ -10,10 +10,12 @@
- name: "load docker, db and proxy for {{ application_id }}" - name: "load docker, db and proxy for {{ application_id }}"
include_role: include_role:
name: cmp-db-docker-proxy name: cmp-db-docker-proxy
vars:
docker_compose_flush_handlers: true
- name: "Wait until Keycloak is reachable at {{ keycloak_server_host_url }}" - name: "Wait until Keycloak is reachable at {{ KEYCLOAK_SERVER_HOST_URL }}"
uri: uri:
url: "{{ keycloak_server_host_url }}/realms/master" url: "{{ KEYCLOAK_SERVER_HOST_URL }}/realms/master"
method: GET method: GET
status_code: 200 status_code: 200
validate_certs: false validate_certs: false
@ -26,7 +28,7 @@
include_tasks: 02_update_client_redirects.yml include_tasks: 02_update_client_redirects.yml
- name: "Update LDAP bind credentials from ldap.*" - name: "Update LDAP bind credentials from ldap.*"
when: keycloak_update_ldap_bind | bool when: KEYCLOAK_UPDATE_LDAP_BIND | bool
include_tasks: 03_update-ldap-bind.yml include_tasks: 03_update-ldap-bind.yml
# Deactivated temporary. Import now via realm.yml # Deactivated temporary. Import now via realm.yml

10
roles/web-app-keycloak/templates/docker-compose.yml.j2
View File

@ -1,14 +1,14 @@
{% include 'roles/docker-compose/templates/base.yml.j2' %} {% include 'roles/docker-compose/templates/base.yml.j2' %}
application: application:
image: "{{ keycloak_image }}:{{ keycloak_version }}" image: "{{ KEYCLOAK_IMAGE }}:{{ KEYCLOAK_VERSION }}"
container_name: {{ keycloak_container }} container_name: {{ KEYCLOAK_CONTAINER }}
command: start{% if keycloak_import_realm %} --import-realm{% endif %}{% if keycloak_debug_enabled %} --verbose{% endif %} command: start{% if KEYCLOAK_IMPORT_REALM_ENABLED %} --import-realm{% endif %}{% if KEYCLOAK_DEBUG_ENABLED %} --verbose{% endif %}
{% include 'roles/docker-container/templates/base.yml.j2' %} {% include 'roles/docker-container/templates/base.yml.j2' %}
ports: ports:
- "{{ keycloak_server_host }}:8080" - "{{ KEYCLOAK_SERVER_HOST }}:8080"
volumes: volumes:
- "{{ keycloak_host_import_directory }}:{{keycloak_docker_import_directory}}" - "{{ keycloak_host_import_directory }}:{{KEYCLOAK_DOCKER_IMPORT_DIR}}"
{% include 'roles/docker-container/templates/depends_on/dmbs_excl.yml.j2' %} {% include 'roles/docker-container/templates/depends_on/dmbs_excl.yml.j2' %}
{% include 'roles/docker-container/templates/networks.yml.j2' %} {% include 'roles/docker-container/templates/networks.yml.j2' %}
{% set container_port = 9000 %} {% set container_port = 9000 %}

38
roles/web-app-keycloak/templates/import/realm.json.j2
View File

@ -1,6 +1,6 @@
{ {
"id": "3b03105b-5fe6-4b53-ba24-c8796525be0e", "id": "3b03105b-5fe6-4b53-ba24-c8796525be0e",
"realm": "{{ keycloak_realm }}", "realm": "{{ KEYCLOAK_REALM }}",
"displayName": "", "displayName": "",
"displayNameHtml": "", "displayNameHtml": "",
"notBefore": 0, "notBefore": 0,
@ -60,7 +60,7 @@
}, },
{ {
"id": "01d9dd2a-75b2-47a2-af36-b14251f1b956", "id": "01d9dd2a-75b2-47a2-af36-b14251f1b956",
"name": "default-roles-{{ keycloak_realm }}", "name": "default-roles-{{ KEYCLOAK_REALM }}",
"description": "${role_default-roles}", "description": "${role_default-roles}",
"composite": true, "composite": true,
"composites": { "composites": {
@ -302,7 +302,7 @@
"attributes": {} "attributes": {}
} }
], ],
"{{ keycloak_realm }}": [], "{{ KEYCLOAK_REALM }}": [],
"security-admin-console": [], "security-admin-console": [],
"admin-cli": [], "admin-cli": [],
"account-console": [], "account-console": [],
@ -410,7 +410,7 @@
"groups": [], "groups": [],
"defaultRole": { "defaultRole": {
"id": "01d9dd2a-75b2-47a2-af36-b14251f1b956", "id": "01d9dd2a-75b2-47a2-af36-b14251f1b956",
"name": "default-roles-{{ keycloak_realm }}", "name": "default-roles-{{ KEYCLOAK_REALM }}",
"description": "${role_default-roles}", "description": "${role_default-roles}",
"composite": true, "composite": true,
"clientRole": false, "clientRole": false,
@ -464,18 +464,18 @@
"users": [ "users": [
{ {
"id": "19ecedfd-acf2-49e8-9f66-91ab71d54fc3", "id": "19ecedfd-acf2-49e8-9f66-91ab71d54fc3",
"username": "service-account-{{ keycloak_realm }}", "username": "service-account-{{ KEYCLOAK_REALM }}",
"emailVerified": false, "emailVerified": false,
"createdTimestamp": 1737925519602, "createdTimestamp": 1737925519602,
"enabled": true, "enabled": true,
"totp": false, "totp": false,
"serviceAccountClientId": "{{ keycloak_realm }}", "serviceAccountClientId": "{{ KEYCLOAK_REALM }}",
"disableableCredentialTypes": [], "disableableCredentialTypes": [],
"requiredActions": [ "requiredActions": [
"CONFIGURE_TOTP" "CONFIGURE_TOTP"
], ],
"realmRoles": [ "realmRoles": [
"default-roles-{{ keycloak_realm }}" "default-roles-{{ KEYCLOAK_REALM }}"
], ],
"notBefore": 0, "notBefore": 0,
"groups": [] "groups": []
@ -508,13 +508,13 @@
"description": "", "description": "",
"rootUrl": "${authBaseUrl}", "rootUrl": "${authBaseUrl}",
"adminUrl": "", "adminUrl": "",
"baseUrl": "/realms/{{ keycloak_realm }}/account/", "baseUrl": "/realms/{{ KEYCLOAK_REALM }}/account/",
"surrogateAuthRequired": false, "surrogateAuthRequired": false,
"enabled": true, "enabled": true,
"alwaysDisplayInConsole": false, "alwaysDisplayInConsole": false,
"clientAuthenticatorType": "desktop-secret", "clientAuthenticatorType": "desktop-secret",
"redirectUris": [ "redirectUris": [
"/realms/{{ keycloak_realm }}/account/*" "/realms/{{ KEYCLOAK_REALM }}/account/*"
], ],
"webOrigins": [ "webOrigins": [
"{{ domains | get_url('web-app-keycloak', WEB_PROTOCOL) }}" "{{ domains | get_url('web-app-keycloak', WEB_PROTOCOL) }}"
@ -530,7 +530,7 @@
"frontchannelLogout": true, "frontchannelLogout": true,
"protocol": "openid-connect", "protocol": "openid-connect",
"attributes": { "attributes": {
"frontchannel.logout.url": "{{ kc_desired_frontchannel_logout_url }}", "frontchannel.logout.url": "{{ KEYCLOAK_FRONTCHANNEL_LOGOUT_URL }}",
"realm_client": "false", "realm_client": "false",
"oidc.ciba.grant.enabled": "false", "oidc.ciba.grant.enabled": "false",
"backchannel.logout.session.required": "true", "backchannel.logout.session.required": "true",
@ -565,13 +565,13 @@
"description": "", "description": "",
"rootUrl": "${authBaseUrl}", "rootUrl": "${authBaseUrl}",
"adminUrl": "", "adminUrl": "",
"baseUrl": "/realms/{{ keycloak_realm }}/account/", "baseUrl": "/realms/{{ KEYCLOAK_REALM }}/account/",
"surrogateAuthRequired": false, "surrogateAuthRequired": false,
"enabled": true, "enabled": true,
"alwaysDisplayInConsole": false, "alwaysDisplayInConsole": false,
"clientAuthenticatorType": "desktop-secret", "clientAuthenticatorType": "desktop-secret",
"redirectUris": [ "redirectUris": [
"/realms/{{ keycloak_realm }}/account/*" "/realms/{{ KEYCLOAK_REALM }}/account/*"
], ],
"webOrigins": [ "webOrigins": [
"*" "*"
@ -757,13 +757,13 @@
"clientId": "security-admin-console", "clientId": "security-admin-console",
"name": "${client_security-admin-console}", "name": "${client_security-admin-console}",
"rootUrl": "${authAdminUrl}", "rootUrl": "${authAdminUrl}",
"baseUrl": "/admin/{{ keycloak_realm }}/console/", "baseUrl": "/admin/{{ KEYCLOAK_REALM }}/console/",
"surrogateAuthRequired": false, "surrogateAuthRequired": false,
"enabled": true, "enabled": true,
"alwaysDisplayInConsole": false, "alwaysDisplayInConsole": false,
"clientAuthenticatorType": "desktop-secret", "clientAuthenticatorType": "desktop-secret",
"redirectUris": [ "redirectUris": [
"/admin/{{ keycloak_realm }}/console/*" "/admin/{{ KEYCLOAK_REALM }}/console/*"
], ],
"webOrigins": [ "webOrigins": [
"+" "+"
@ -823,12 +823,12 @@
}, },
{ {
"id": "7b5f97e3-7fa8-4d86-b1e9-80aac996da26", "id": "7b5f97e3-7fa8-4d86-b1e9-80aac996da26",
"clientId": "{{ keycloak_realm }}", "clientId": "{{ KEYCLOAK_REALM }}",
"name": "", "name": "",
"description": "", "description": "",
"rootUrl": "{{ WEB_PROTOCOL }}://{{ keycloak_realm }}/", "rootUrl": "{{ WEB_PROTOCOL }}://{{ KEYCLOAK_REALM }}/",
"adminUrl": "{{ WEB_PROTOCOL }}://{{ keycloak_realm }}/", "adminUrl": "{{ WEB_PROTOCOL }}://{{ KEYCLOAK_REALM }}/",
"baseUrl": "{{ WEB_PROTOCOL }}://{{ keycloak_realm }}/", "baseUrl": "{{ WEB_PROTOCOL }}://{{ KEYCLOAK_REALM }}/",
"surrogateAuthRequired": false, "surrogateAuthRequired": false,
"enabled": true, "enabled": true,
"alwaysDisplayInConsole": false, "alwaysDisplayInConsole": false,
@ -1823,7 +1823,7 @@
"org.keycloak.storage.UserStorageProvider": [ "org.keycloak.storage.UserStorageProvider": [
{ {
"id": "bBD2l6kVRMaSABbfOJVRaw", "id": "bBD2l6kVRMaSABbfOJVRaw",
"name": "{{ keycloak_ldap_component_name }}", "name": "{{ KEYCLOAK_LDAP_CMP_NAME }}",
"providerId": "ldap", "providerId": "ldap",
"subComponents": { "subComponents": {
"org.keycloak.storage.ldap.mappers.LDAPStorageMapper": [ "org.keycloak.storage.ldap.mappers.LDAPStorageMapper": [

41
roles/web-app-keycloak/vars/main.yml
View File

@ -3,25 +3,22 @@ application_id: "web-app-keycloak"
database_type: "postgres" # Database which will be used database_type: "postgres" # Database which will be used
# Keycloak # Keycloak
keycloak_container: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.name') }}" # Name of the keycloak docker container KEYCLOAK_CONTAINER: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.name') }}" # Name of the keycloak docker container
keycloak_docker_import_directory: "/opt/keycloak/data/import/" # Directory in which keycloak import files are placed in the running docker container KEYCLOAK_DOCKER_IMPORT_DIR: "/opt/keycloak/data/import/" # Directory in which keycloak import files are placed in the running docker container
keycloak_realm: "{{ OIDC.CLIENT.REALM }}" # This is the name of the default realm which is used by the applications KEYCLOAK_REALM: "{{ OIDC.CLIENT.REALM }}" # This is the name of the default realm which is used by the applications
keycloak_master_api_user: "{{ applications | get_app_conf(application_id, 'users.administrator') }}" # Master Administrator KEYCLOAK_MASTER_API_USER: "{{ applications | get_app_conf(application_id, 'users.administrator') }}" # Master Administrator
keycloak_master_api_user_name: "{{ keycloak_master_api_user.username }}" # Master Administrator Username KEYCLOAK_MASTER_API_USER_NAME: "{{ KEYCLOAK_MASTER_API_USER.username }}" # Master Administrator Username
keycloak_master_api_user_password: "{{ keycloak_master_api_user.password }}" # Master Administrator Password KEYCLOAK_MASTER_API_USER_PASSWORD: "{{ KEYCLOAK_MASTER_API_USER.password }}" # Master Administrator Password
keycloak_kcadm_path: "docker exec -i {{ keycloak_container }} /opt/keycloak/bin/kcadm.sh" # Init script for keycloak KEYCLOAK_KCADM_PATH: "docker exec -i {{ KEYCLOAK_CONTAINER }} /opt/keycloak/bin/kcadm.sh" # Init script for keycloak
keycloak_server_internal_url: "http://127.0.0.1:8080" KEYCLOAK_SERVER_INTERNAL_URL: "http://127.0.0.1:8080"
keycloak_server_host: "127.0.0.1:{{ ports.localhost.http[application_id] }}" KEYCLOAK_SERVER_HOST: "127.0.0.1:{{ ports.localhost.http[application_id] }}"
keycloak_server_host_url: "http://{{ keycloak_server_host }}" KEYCLOAK_SERVER_HOST_URL: "http://{{ KEYCLOAK_SERVER_HOST }}"
keycloak_image: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.image') }}" # Keycloak docker image KEYCLOAK_IMAGE: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.image') }}" # Keycloak docker image
keycloak_version: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.version') }}" # Keycloak docker version KEYCLOAK_VERSION: "{{ applications | get_app_conf(application_id, 'docker.services.keycloak.version') }}" # Keycloak docker version
keycloak_debug_enabled: "{{ MODE_DEBUG }}" KEYCLOAK_DEBUG_ENABLED: "{{ MODE_DEBUG }}"
keycloak_redirect_features: ["features.oauth2","features.oidc"] KEYCLOAK_REDIRECT_FEATURES: ["features.oauth2","features.oidc"]
keycloak_client_id: "{{ OIDC.CLIENT.ID }}" KEYCLOAK_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
keycloak_ldap_component_name: "{{ ldap.server.domain }}" # Name of the LDAP User Federation component in Keycloak (as shown in UI) KEYCLOAK_LDAP_CMP_NAME: "{{ ldap.server.domain }}" # Name of the LDAP User Federation component in Keycloak (as shown in UI)
keycloak_import_realm: "{{ applications | get_app_conf(application_id, 'actions.import_realm') }}" # Activate realm import KEYCLOAK_IMPORT_REALM_ENABLED: "{{ applications | get_app_conf(application_id, 'actions.import_realm') }}" # Activate realm import
keycloak_update_ldap_bind: "{{ applications | get_app_conf(application_id, 'actions.update_ldap_bind') }}" # Toggle the LDAP bind update step KEYCLOAK_UPDATE_LDAP_BIND: "{{ applications | get_app_conf(application_id, 'actions.update_ldap_bind') }}" # Toggle the LDAP bind update step
kc_desired_frontchannel_logout_url: "{{ domains | get_url('web-svc-logout', WEB_PROTOCOL) }}/" KEYCLOAK_FRONTCHANNEL_LOGOUT_URL: "{{ domains | get_url('web-svc-logout', WEB_PROTOCOL) }}/"
# Docker
docker_compose_flush_handlers: true # Remember to copy realm import before flush when set to true