3 Commits

Author	SHA1	Message	Date
Kevin Veen-Birkenbach	7d0502ebc5	feat(keycloak): implement SPOT with Realm ... Replace 01_import.yml with 01_initialize.yml (KEYCLOAK_HOST_IMPORT_DIR) Add generic 02_update.yml (kcadm updater for clients/components) - Resolve ID → read current → merge (kc_merge_path optional) - Preserve immutable fields; support kc_force_attrs Update tasks/main.yml: - Readiness via KEYCLOAK_MASTER_REALM_URL; kcadm login - Merge LDAP component config from Realm when KEYCLOAK_LDAP_ENABLED - Update client settings incl. frontchannel.logout.url realm.json.j2: include ldap.json in UserStorageProvider ldap.json.j2: use KEYCLOAK_LDAP_* vars for bindDn/credential/connectionUrl vars/main.yml: add KEYCLOAK_* URLs/dirs and KEYCLOAK_DICTIONARY_REALM(_RAW) docker-compose.yml.j2: mount KEYCLOAK_HOST_IMPORT_DIR Cleanup: remove 02_update_client_redirects.yml, 03_update-ldap-bind.yml, 04_ssh_public_key.yml; drop obsolete config flag; formatting Note: redirectUris/webOrigins ordering may still cause changed=true; consider sorting for stability in a follow-up.	2025-08-17 14:27:33 +02:00
Kevin Veen-Birkenbach	4fa1c6cfbd	ansible: quote file modes; keycloak: robust LDAP bind update + config cleanup ... Highlights - Quote all file modes as strings ("0755"/"0770") across multiple roles to avoid YAML octal quirks and improve portability. - Keycloak: introduce actions.{import_realm,update_ldap_bind} feature flags and wire them via vars/config. - Implement idempotent LDAP bind updater (tasks/03_update-ldap-bind.yml): * kcadm login with no_log protection, * fetch LDAP UserStorage component by name, * compare current bindDn/bindCredential and update only when changed. - Keycloak realm import template: keep providerId="ldap" and set name from keycloak_ldap_component_name. - Centralize Keycloak readiness check in tasks/main.yml; remove duplicate waits from 02_update_client_redirects.yml and 04_ssh_public_key.yml. - 01_import.yml: fix typo (keycloak), quote modes, tidy spacing, and replace Jinja-in-Jinja fileglob with concatenation. - 02_update_client_redirects.yml: correct assert fail_msg filename; keep login-first flow. - Minor template/vars tidy-ups (spacing, comments, consistent variable usage). Files touched (excerpt) - roles/*/*: replace 0755/0770 → "0755"/"0770" - roles/web-app-keycloak/config/main.yml: add actions map - roles/web-app-keycloak/vars/main.yml: unify Keycloak vars and feature flags - roles/web-app-keycloak/tasks/{01_import,02_update_client_redirects,03_update-ldap-bind,04_ssh_public_key,main}.yml - roles/web-app-keycloak/templates/{docker-compose.yml.j2,import/realm.json.j2} https://chatgpt.com/share/689bda16-b138-800f-8258-e13f6d7d8239	2025-08-13 02:20:38 +02:00
Kevin Veen-Birkenbach	aae69ea15b	Ensure that keycloak is up	2025-08-08 17:25:31 +02:00