mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
b0ca8784e2
The OIDC admin wiring is gated on SSO alone, and SSO is 'web-app-keycloak' in group_names. Round 1 takes keycloak variant 1, which pins ldap off, so svc-db-openldap is not in the closure; the block still resolved its swarm service and the waiter spent 600 attempts on a service that does not exist (run 33698844864, Mattermost#1, 25 minutes). In compose the same block would have died on a missing container, so the defect is mode-independent.
The number it fetched is already in the registry: svc-db-openldap/tasks/04_users.yml:118 writes uidNumber from the same lookup('users'), and an earlier run shows inventory uid 1001 against ldapsearch 1001. Reading it directly removes the cross-stack exec entirely.
Keycloak's mattermost-id mapper reads the uidNumber attribute, which until now only the LDAP federation wrote, so the same round would have produced no id claim to match. ensure_realm_user.sh now mirrors the uid into that attribute whenever it is passed one, leaving callers without a uid unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
24 lines
995 B
YAML
24 lines
995 B
YAML
---
|
|
# include-gated: when: MATTERMOST_OIDC_ENABLED
|
|
- name: "🔎 Mattermost | Check administrator auth service"
|
|
database_query:
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/select/user/authservice.sql"
|
|
named_args:
|
|
email: "{{ lookup('users', 'administrator').email }}"
|
|
expect_rows: true
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
register: mm_admin_authservice
|
|
changed_when: false
|
|
|
|
- when: (mm_admin_authservice.rows[0][0] | default('') | trim) != 'gitlab'
|
|
block:
|
|
- name: "🔄 Mattermost | Convert administrator to gitlab SSO auth"
|
|
database_query:
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/update/user-to-gitlab-auth.sql"
|
|
named_args:
|
|
authdata: "{{ lookup('users', 'administrator').uid }}"
|
|
email: "{{ lookup('users', 'administrator').email }}"
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|