Kevin Veen-Birkenbach eb781dbf8b
fix(keycloak/ldap): make userObjectClasses JSON-safe and exclude posixAccount
- Render userObjectClasses via `tojson` (and trim) to avoid invalid control
  characters and ensure valid realm import parsing.
- Introduce KEYCLOAK_LDAP_USER_OBJECT_CLASSES in vars; exclude `posixAccount`
  for Keycloak’s LDAP config while keeping it for Ansible-managed UNIX users.
- Update UserStorageProvider template to use the new variable.

Rationale:
Keycloak must not require `posixAccount` on every LDAP user. We keep
`posixAccount` structural for Ansible provisioning, but filter it out for
Keycloak to prevent sync/import errors on entries without POSIX attributes.

Touched:
- roles/web-app-keycloak/templates/import/components/org.keycloak.storage.UserStorageProvider.json.j2
- roles/web-app-keycloak/vars/main.yml

Refs: conversation https://chatgpt.com/share/68aa1ef0-3658-800f-bdf4-5b57131d03b4
2025-08-23 22:05:26 +02:00
..
2025-08-15 19:00:03 +02:00
2025-08-22 09:23:40 +02:00
2025-08-18 23:54:23 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 05:49:35 +02:00
2025-08-21 09:49:36 +02:00
2025-08-21 16:27:10 +02:00
2025-08-21 16:27:10 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 05:49:35 +02:00
2025-08-20 01:01:32 +02:00
2025-08-21 16:27:10 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-21 16:27:10 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:01:32 +02:00
2025-08-21 16:27:10 +02:00
2025-08-20 01:01:32 +02:00
2025-08-20 01:02:29 +02:00
2025-08-20 01:02:29 +02:00
2025-07-04 08:03:27 +02:00
2025-03-20 17:00:07 +01:00
2025-07-12 17:52:36 +02:00