kevinveenbirkenbachandClaude Opus 5.5 754d35c4de fix(web-app-keycloak): bring SAML clients to existing realms too ...

SAML clients were created only by the realm import, and the import runs only
for a missing realm. echoserver keeps its legacy realm cymais.cloud and ran
SuiteCRM behind oauth2-proxy before v16, so the SuiteCRM SAML client
https://<suitecrm>/saml/metadata never existed there: the SAML hop showed
Keycloak's Invalid Request page and Keycloak logged LOGIN_ERROR
error=client_not_found reason=Cannot_match_source_hash.

The existing-realm reconcile now also loops over the clientId of every SAML
client in the rendered realm dictionary, the same source the import uses,
and creates or updates it through kcadm like the application-declared OIDC
clients. The same path already converged the stalwart-webmail and
stalwart-webui clients in echoserver full-10.

Same change as 2b4db90576 on feature/store-i18n, so a later merge of the two
lines resolves without a conflict, plus a unit test that pins the SAML client
selection and its place in the reconcile loop.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-25 12:30:09 +01:00

..

cli

feat(inventory): reject unread keys and a missing Cloudflare token before the deploy

2026-10-23 16:18:12 +02:00

group_vars

…

library

test(library): keep the project-walk marker on the rglob line

2026-10-24 11:06:38 +02:00

plugins

fix(mcp): keep a persistent host's providers through a partial deploy

2026-10-25 09:24:28 +01:00

roles

fix(web-app-keycloak): bring SAML clients to existing realms too

2026-10-25 12:30:09 +01:00

scripts

…

utils

fix(tls): serve a redirect to another host through the redirect role

2026-10-25 11:04:28 +01:00

__init__.py

…