mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
23 lines
1.2 KiB
YAML
23 lines
1.2 KiB
YAML
---
|
|
# Param: openbao_group - one entry of the registered group-id loop (item = role name, stdout = group id)
|
|
# Param: alias_mount - auth mount path, e.g. "oidc/" or "ldap/"
|
|
# Param: alias_name - identity-provider group name the claim will carry
|
|
- name: "🔍 Read the existing alias of identity group '{{ openbao_group.item }}'"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao read -format=json identity/group/id/{{ openbao_group.stdout | trim | quote }}
|
|
register: openbao_group_read
|
|
changed_when: false
|
|
|
|
- name: "🔗 Create the group alias '{{ alias_name }}' on mount '{{ alias_mount }}'"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write identity/group-alias
|
|
name={{ alias_name | quote }}
|
|
mount_accessor={{ openbao_auth_mounts[alias_mount].accessor | quote }}
|
|
canonical_id={{ openbao_group.stdout | trim | quote }}
|
|
changed_when: true
|
|
when: >-
|
|
((openbao_group_read.stdout | from_json).data.alias | default({})).name | default('')
|
|
!= alias_name
|