Refactor Keycloak kcadm updates into custom Ansible module (see ChatGPT: https://chatgpt.com/share/692b6f0c-ebd4-800f-89e7-474d23c5dd32)

roles/web-app-keycloak/tasks/update/01_client.yml

@@ -37,4 +37,14 @@
               | list | first | default({}) ).attributes | default({}) )
           | combine({'frontchannel.logout.url': KEYCLOAK_FRONTCHANNEL_LOGOUT_URL}, recursive=True)
         }}
-  include_tasks: _update.yml
+  keycloak_kcadm_update:
+    object_kind: "{{ kc_object_kind }}"
+    lookup_value: "{{ kc_lookup_value }}"
+    desired: "{{ kc_desired }}"
+    force_attrs: "{{ kc_force_attrs }}"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    realm: "{{ KEYCLOAK_REALM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-keycloak/tasks/update/02_mail_realm.yml

@@ -1,10 +1,13 @@
 - name: "Update {{ KEYCLOAK_REALM }} REALM mail settings from realm dictionary"
-  include_tasks: _update.yml
-  vars:
-    kc_object_kind:  "realm"
-    kc_lookup_field: "id"
-    kc_lookup_value: "{{ KEYCLOAK_REALM }}"
-    kc_desired:
-      smtpServer: "{{ KEYCLOAK_DICTIONARY_REALM.smtpServer | default({}, true) }}"
-    kc_merge_path:  "smtpServer"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  keycloak_kcadm_update:
+    object_kind: "realm"
+    lookup_field: "id"
+    lookup_value: "{{ KEYCLOAK_REALM }}"
+    desired:
+      smtpServer: "{{ KEYCLOAK_DICTIONARY_REALM.smtpServer }}"
+    merge_path: "smtpServer"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-keycloak/tasks/update/03_mail_master.yml

@@ -1,10 +1,13 @@
 - name: "Update Master REALM mail settings from realm dictionary"
-  include_tasks: _update.yml
-  vars:
-    kc_object_kind:  "realm"
-    kc_lookup_field: "id"
-    kc_lookup_value: "master"
-    kc_desired:
-      smtpServer: "{{ KEYCLOAK_DICTIONARY_REALM.smtpServer | default({}, true) }}"
-    kc_merge_path:  "smtpServer"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  keycloak_kcadm_update:
+    object_kind: "realm"
+    lookup_field: "id"
+    lookup_value: "master"
+    desired:
+      smtpServer: "{{ KEYCLOAK_DICTIONARY_REALM.smtpServer }}"
+    merge_path: "smtpServer"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-keycloak/tasks/update/05_ldap.yml

@@ -1,9 +1,8 @@
 - name: "Update REALM settings (merge LDAP component .config)"
-  include_tasks: _update.yml
-  vars:
-    kc_object_kind:  "component"
-    kc_lookup_value: "{{ KEYCLOAK_LDAP_CMP_NAME }}"
-    kc_desired: >-
+  keycloak_kcadm_update:
+    object_kind: "component"
+    lookup_value: "{{ KEYCLOAK_LDAP_CMP_NAME }}"
+    desired: >-
       {{
         (
           KEYCLOAK_DICTIONARY_REALM.components['org.keycloak.storage.UserStorageProvider']
@@ -11,7 +10,11 @@
           | list | first
         )
       }}
-    kc_merge_path: "config"
+    merge_path: "config"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    realm: "{{ KEYCLOAK_REALM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: Resolve LDAP component id
   shell: >
@@ -129,11 +132,11 @@
 
 - name: Update 'ldap-roles' mapper config (merge only .config)
   when: (grp_mapper_id.stdout | trim) not in ["", "null"]
-  vars:
-    kc_object_kind:  "component"
-    kc_lookup_field: "id"
-    kc_lookup_value: "{{ grp_mapper_id.stdout | trim }}"
-    kc_desired: >-
+  keycloak_kcadm_update:
+    object_kind: "component"
+    lookup_field: "id"
+    lookup_value: "{{ grp_mapper_id.stdout | trim }}"
+    desired: >-
       {{
         desired_group_mapper
         | combine({
@@ -143,5 +146,10 @@
             'providerId':   'group-ldap-mapper'
           }, recursive=True)
       }}
-    kc_merge_path:   "config"
-  include_tasks: _update.yml
+    merge_path: "config"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    realm: "{{ KEYCLOAK_REALM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-keycloak/tasks/update/07_userprofile.yml

@@ -34,10 +34,15 @@
   changed_when: false
 
 - name: "Update UserProfileProvider component (merge kc.user.profile.config)"
-  vars:
-    kc_object_kind:  "component"
-    kc_lookup_field: "id"
-    kc_lookup_value: "{{ kc_userprofile_id.stdout | trim }}"
-    kc_desired:      "{{ kc_userprofile_tpl }}"
-    kc_merge_path:   "config"
-  include_tasks: _update.yml
+  keycloak_kcadm_update:
+    object_kind: "component"
+    lookup_field: "id"
+    lookup_value: "{{ kc_userprofile_id.stdout | trim }}"
+    desired: "{{ kc_userprofile_tpl }}"
+    merge_path: "config"
+    kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
+    realm: "{{ KEYCLOAK_REALM }}"
+    assert_mode: "{{ MODE_ASSERT }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-keycloak/tasks/update/_update.yml

@@ -1,197 +0,0 @@
-# Generic updater for Keycloak client/component/realm via kcadm.
-# Flow: resolve ID → read current object → merge with desired → preserve immutable fields → update via stdin.
-#
-# Required vars (pass via include):
-# - kc_object_kind:   "client" | "component" | "client-scope" | "realm"
-# - kc_lookup_value:  e.g., KEYCLOAK_CLIENT_ID or KEYCLOAK_LDAP_CMP_NAME or KEYCLOAK_REALM
-# - kc_desired:       dict, e.g., KEYCLOAK_DICTIONARY_CLIENT or KEYCLOAK_DICTIONARY_LDAP
-#
-# Optional:
-# - kc_lookup_field:  override lookup field (defaults: clientId for client, name for component, id for realm)
-# - kc_merge_path:    if set (e.g. "config"), only that subkey is merged
-# - kc_force_attrs:   dict to force on the final payload (merged last)
-
-- name: Assert required vars
-  assert:
-    that:
-      - kc_object_kind in ['client','component','client-scope','realm']
-      - kc_lookup_value is defined
-      - kc_desired is defined
-    fail_msg: "kc_object_kind, kc_lookup_value, kc_desired are required."
-  when: MODE_ASSERT | bool
-
-- name: Derive API endpoint and lookup field
-  set_fact:
-    kc_api: >-
-      {{ 'clients' if kc_object_kind == 'client'
-         else 'components' if kc_object_kind == 'component'
-         else 'client-scopes' if kc_object_kind == 'client-scope'
-         else 'realms' if kc_object_kind == 'realm'
-         else '' }}
-    kc_lookup_field_eff: >-
-      {{ 'clientId' if kc_object_kind == 'client'
-         else (kc_lookup_field | default('name')) if kc_object_kind == 'component'
-         else 'name' if kc_object_kind == 'client-scope'
-         else 'id' if kc_object_kind == 'realm'
-         else '' }}
-
-- name: Resolve object id (direct when lookup_field is id)
-  when: kc_lookup_field_eff == 'id'
-  set_fact:
-    kc_obj_id: "{{ kc_lookup_value | string }}"
-
-- name: Resolve object id via query
-  when: kc_lookup_field_eff != 'id' and kc_object_kind != 'realm'
-  shell: >
-    {% if kc_object_kind == 'client-scope' -%}
-    {{ KEYCLOAK_EXEC_KCADM }} get client-scopes -r {{ KEYCLOAK_REALM }} --format json
-    | jq -r '.[] | select(.{{ kc_lookup_field_eff }}=="{{ kc_lookup_value }}") | .id' | head -n1
-    {%- else -%}
-    {{ KEYCLOAK_EXEC_KCADM }} get {{ kc_api }}
-    -r {{ KEYCLOAK_REALM }}
-    --query '{{ kc_lookup_field_eff }}={{ kc_lookup_value }}'
-    --fields id --format json | jq -r '.[0].id'
-    {%- endif %}
-  register: kc_obj_id_cmd
-  changed_when: false
-
-- name: Normalize resolved id to a plain string
-  set_fact:
-    kc_obj_id: >-
-      {{
-        kc_obj_id
-        if kc_lookup_field_eff == 'id'
-        else (kc_obj_id_cmd.stdout | default('') | trim)
-      }}
-
-- name: Fail if object not found
-  assert:
-    that:
-      - (kc_obj_id | trim) != ''
-      - (kc_obj_id | trim) != 'null'
-    fail_msg: "{{ kc_object_kind | capitalize }} '{{ kc_lookup_value }}' not found."
-  when: MODE_ASSERT | bool
-
-- name: Read current object
-  shell: >
-    {% if kc_object_kind == 'realm' -%}
-    {{ KEYCLOAK_EXEC_KCADM }} get {{ kc_api }}/{{ kc_obj_id }} --format json
-    {%- else -%}
-    {{ KEYCLOAK_EXEC_KCADM }} get {{ kc_api }}/{{ kc_obj_id }} -r {{ KEYCLOAK_REALM }} --format json
-    {%- endif %}
-  register: kc_cur
-  changed_when: false
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Parse current object
-  set_fact:
-    cur_obj: "{{ kc_cur.stdout | from_json }}"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: "Safety check: providerId must match when updating a component"
-  assert:
-    that:
-      - (cur_obj.providerId | default('') ) == (kc_desired.providerId | default('') )
-    fail_msg: >-
-      Refusing to update component '{{ kc_obj_id | default("<unknown>") }}'
-      because providerId mismatch:
-      current='{{ cur_obj.providerId | default("<undefined>") }}'
-      desired='{{ kc_desired.providerId | default("<undefined>") }}'.
-  when: MODE_ASSERT | default(true) | bool
-
-- name: Prepare merge payload (subpath)
-  when: kc_merge_path is defined and (kc_merge_path | length) > 0
-  set_fact:
-    merge_payload: "{{ { (kc_merge_path): (kc_desired[kc_merge_path] | default({}, true)) } }}"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Prepare merge payload (full object)
-  when: kc_merge_path is not defined or (kc_merge_path | length) == 0
-  set_fact:
-    merge_payload: "{{ kc_desired }}"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Build desired object (base merge)
-  set_fact:
-    desired_obj: "{{ cur_obj | combine(merge_payload, recursive=True) }}"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-# Preserve immutable fields
-- name: Preserve immutable fields for client
-  when: kc_object_kind == 'client'
-  set_fact:
-    desired_obj: >-
-      {{
-        desired_obj
-        | combine({
-            'id': cur_obj.id,
-            'clientId': cur_obj.clientId
-          }, recursive=True)
-      }}
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Preserve immutable fields for component
-  when: kc_object_kind == 'component'
-  set_fact:
-    desired_obj: >-
-      {{
-        desired_obj
-        | combine({
-            'id': cur_obj.id,
-            'providerId': cur_obj.providerId,
-            'providerType': cur_obj.providerType,
-            'parentId': cur_obj.parentId
-          }, recursive=True)
-      }}
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Drop unsupported fields for components (e.g. subComponents)
-  when: kc_object_kind == 'component'
-  set_fact:
-    desired_obj: >-
-      {{
-        desired_obj
-        | dict2items
-        | rejectattr('key', 'equalto', 'subComponents')
-        | list
-        | items2dict
-      }}
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: Preserve immutable fields for client-scope
-  when: kc_object_kind == 'client-scope'
-  set_fact:
-    desired_obj: "{{ desired_obj | combine({'id': cur_obj.id, 'name': cur_obj.name}, recursive=True) }}"
-
-- name: Preserve immutable fields for realm
-  when: kc_object_kind == 'realm'
-  set_fact:
-    desired_obj: >-
-      {{
-        desired_obj
-        | combine({
-            'id': cur_obj.id,
-            'realm': cur_obj.realm
-          }, recursive=True)
-      }}
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-# Optional forced attributes (e.g., frontchannelLogout)
-- name: Apply forced attributes (optional)
-  when: kc_force_attrs is defined
-  set_fact:
-    desired_obj: "{{ desired_obj | combine(kc_force_attrs, recursive=True) }}"
-
-- name: Update object via stdin
-  shell: |
-    {% if kc_object_kind == 'realm' -%}
-    cat <<'JSON' | {{ KEYCLOAK_EXEC_KCADM }} update {{ kc_api }}/{{ kc_obj_id }} -f -
-    {{ desired_obj | to_json }}
-    JSON
-    {%- else -%}
-    cat <<'JSON' | {{ KEYCLOAK_EXEC_KCADM }} update {{ kc_api }}/{{ kc_obj_id }} -r {{ KEYCLOAK_REALM }} -f -
-    {{ desired_obj | to_json }}
-    JSON
-    {%- endif %}
-  #async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
-  #poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"