mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
e6fbb4b3f4
That commit added test_bcrypt_hash.py with an Exception comment and left a
trailing blank line in group_vars/all/11_oidc.yml. Both go.
What the comment said still holds: the test hashes with the raw bcrypt package
because Ansible's password_hash('bcrypt') routes through passlib, whose bcrypt
self-test can misreport a password well under 72 bytes as too long when
passlib and the installed bcrypt disagree on the version.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
57 lines
3.5 KiB
YAML
57 lines
3.5 KiB
YAML
---
|
|
# ############################################
|
|
# ## Identity and Access Management (IAM) ###
|
|
# ############################################
|
|
# Developer guide for the OIDC variable tree, claim rules, and the per-app
|
|
# vs. shared client-template policy:
|
|
# @see docs/contributing/design/iam/oidc.md
|
|
|
|
# ############################################
|
|
# ## OIDC ###
|
|
# ############################################
|
|
# @see https://en.wikipedia.org/wiki/OpenID_Connect
|
|
|
|
# Helper Variables:
|
|
_oidc_client_realm: "{{ OIDC_OVERRIDE.CLIENT.REALM if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.REALM is defined else
|
|
SOFTWARE_DOMAIN }}"
|
|
_oidc_url: "{{ ( OIDC_OVERRIDE.URL if (OIDC_OVERRIDE is defined and OIDC_OVERRIDE.URL is defined) else (lookup('tls', 'web-app-keycloak', 'url.base')) ).rstrip('/')
|
|
}}"
|
|
_oidc_client_issuer_url: "{{ _oidc_url ~ '/realms/' ~ _oidc_client_realm }}"
|
|
_oidc_client_id: "{{ OIDC_OVERRIDE.CLIENT.ID if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.ID is defined else SOFTWARE_DOMAIN
|
|
}}"
|
|
_oidc_account_url: "{{ _oidc_client_issuer_url ~ '/account' }}"
|
|
_oidc_protocol_oidc: "{{ _oidc_client_issuer_url ~ '/protocol/openid-connect' }}"
|
|
|
|
defaults_oidc:
|
|
URL: "{{ _oidc_url }}"
|
|
CLIENT:
|
|
ID: "{{ _oidc_client_id }}" # Client identifier, typically matching your primary domain
|
|
SECRET: "{{ lookup('config', 'web-app-keycloak', 'secrets.credentials.oidc_client_secret', '') }}" # Defaults to the generated Keycloak credential; set OIDC.CLIENT.SECRET in the inventory to override
|
|
REALM: "{{ _oidc_client_realm }}" # The realm to which the client belongs in the OIDC provider
|
|
ISSUER_URL: "{{ _oidc_client_issuer_url }}" # Issuer URL (must match discovery issuer)
|
|
DISCOVERY_DOCUMENT: "{{ _oidc_client_issuer_url ~ '/.well-known/openid-configuration' }}" # URL for fetching the provider's configuration details
|
|
AUTHORIZE_URL: "{{ _oidc_protocol_oidc ~ '/auth' }}" # Endpoint to start the authorization process
|
|
TOKEN_URL: "{{ _oidc_protocol_oidc ~ '/token' }}" # Endpoint to exchange authorization codes for tokens (note: 'token_url' may be a typo for 'token_url')
|
|
USER_INFO_URL: "{{ _oidc_protocol_oidc ~ '/userinfo' }}" # Endpoint to retrieve user information
|
|
LOGOUT_URL: "{{ _oidc_protocol_oidc ~ '/logout' }}" # Endpoint to log out the user
|
|
CERTS: "{{ _oidc_protocol_oidc ~ '/certs' }}" # JSON Web Key Set endpoint (matches discovery jwks_uri)
|
|
ACCOUNT:
|
|
URL: "{{ _oidc_account_url }}" # Entry point for the user settings console
|
|
PROFILE_URL: "{{ _oidc_account_url ~ '/#/personal-info' }}" # Section for managing personal information
|
|
SECURITY_URL: "{{ _oidc_account_url ~ '/#/security/signingin' }}" # Section for managing login and security settings
|
|
CHANGE_CREDENTIALS: "{{ _oidc_account_url ~ '/account-security/signing-in' }}" # URL for managing or changing user credentials
|
|
RESET_CREDENTIALS: "{{ _oidc_client_issuer_url ~ '/login-actions/reset-credentials?client_id=' ~ _oidc_client_id }}" # Password reset url
|
|
BUTTON_TEXT: "SSO Login ({{ DOMAIN_PRIMARY | upper }})" # Default button text
|
|
ATTRIBUTES:
|
|
USERNAME: "preferred_username"
|
|
GIVEN_NAME: "givenName"
|
|
FAMILY_NAME: "surname"
|
|
EMAIL: "email"
|
|
|
|
# Keycloak's own built-in admin realm/client (password-grant Admin REST API automation), distinct from the app's own CLIENT.REALM/CLIENT.ID above.
|
|
ADMIN:
|
|
REALM: "master"
|
|
CLI_CLIENT_ID: "admin-cli"
|
|
|
|
OIDC: "{{ defaults_oidc | combine(OIDC_OVERRIDE | default({}, true), recursive=True) }}"
|