- Replace KEYCLOAK_KCADM_PATH with KEYCLOAK_EXEC_KCADM consistently
- Externalize client.json to separate Jinja2 template and include it in realm.json
- Simplify LDAP bind update to use explicit KEYCLOAK_LDAP_* vars
- Add async/poll support for long-running kcadm updates
- Restructure vars/main.yml: clearer grouping (General, Docker, Server, Update, LDAP, API)
- Compute redirectUris/webOrigins centrally in vars
- Align post.logout.redirect.uris handling with playbook
Conversation: https://chatgpt.com/share/68a1a11f-f8ac-800f-bada-cdc99a4fa1bf
Switch to command:argv to avoid shell quoting and argument splitting issues.
Pass -s config values as JSON arrays via to_json, fixing previous errors: Cannot parse the JSON / failed at splitting arguments.
Also reconcile config.connectionUrl from ldap.server.uri.
Source desired values strictly from ldap.* (no computed defaults) and assert their presence.
Keep operation idempotent by reading current values and updating only on change.
Minor refactor: build reusable kcadm_argv_base and expand client state extraction.
Touch: roles/web-app-keycloak/tasks/03_update-ldap-bind.yml
https://chatgpt.com/share/689bea84-7188-800f-ba51-830a0735f24c
