community / community.general / 6.6.8 / module / keycloak_clientsecret_regenerate Regenerate Keycloak client secret via Keycloak API | "added in version" 6.1.0 of community.general" Authors: Fynn Chen (@fynncfchen), John Cant (@johncant)community.general.keycloak_clientsecret_regenerate (6.6.8) — module
Install with ansible-galaxy collection install community.general:==6.6.8
collections: - name: community.general version: 6.6.8
This module allows you to regenerate a Keycloak client secret via the Keycloak REST API. It requires access to the REST API via OpenID Connect; the user connecting and the client being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate client definition with the scope tailored to your needs and a user having the expected roles.
When regenerating a client secret, where possible provide the client's id (not client_id) to the module. This removes a lookup to the API to translate the client_id into the client ID.
Note that this module returns the client secret. To avoid this showing up in the logs, please add C(no_log: true) to the task.
- name: Regenerate a Keycloak client secret, authentication with credentials community.general.keycloak_clientsecret_regenerate: id: '9d59aa76-2755-48c6-b1af-beb70a82c3cd' realm: MyCustomRealm auth_client_id: admin-cli auth_keycloak_url: https://auth.example.com/auth auth_realm: master auth_username: USERNAME auth_password: PASSWORD delegate_to: localhost no_log: true
- name: Regenerate a Keycloak client secret, authentication with token community.general.keycloak_clientsecret_regenerate: id: '9d59aa76-2755-48c6-b1af-beb70a82c3cd' realm: MyCustomRealm auth_client_id: admin-cli auth_keycloak_url: https://auth.example.com/auth token: TOKEN delegate_to: localhost no_log: true
- name: Regenerate a Keycloak client secret, passing client_id instead of id community.general.keycloak_clientsecret_info: client_id: 'myClientId' realm: MyCustomRealm auth_client_id: admin-cli auth_keycloak_url: https://auth.example.com/auth token: TOKEN delegate_to: localhost no_log: true
id: description: - The unique identifier for this client. - This parameter is not required for getting or generating a client secret but providing it will reduce the number of API calls required. type: str realm: default: master description: - They Keycloak realm under which this client resides. type: str token: description: - Authentication token for Keycloak API. type: str version_added: 3.0.0 version_added_collection: community.general client_id: aliases: - clientId description: - The client_id of the client. Passing this instead of id results in an extra API call. type: str auth_realm: description: - Keycloak realm name to authenticate to for API access. type: str http_agent: default: Ansible description: - Configures the HTTP User-Agent header. type: str version_added: 5.4.0 version_added_collection: community.general auth_password: aliases: - password description: - Password to authenticate for API access with. type: str auth_username: aliases: - username description: - Username to authenticate for API access with. type: str auth_client_id: default: admin-cli description: - OpenID Connect I(client_id) to authenticate to the API with. type: str validate_certs: default: true description: - Verify TLS certificates (do not disable this in production). type: bool auth_keycloak_url: aliases: - url description: - URL to the Keycloak instance. required: true type: str auth_client_secret: description: - Client Secret to use in conjunction with I(auth_client_id) (if required). type: str connection_timeout: default: 10 description: - Controls the HTTP connections timeout period (in seconds) to Keycloak API. type: int version_added: 4.5.0 version_added_collection: community.general
end_state: contains: type: description: Credential type. returned: always sample: secret type: str value: description: Client secret. returned: always sample: cUGnX1EIeTtPPAkcyGMv0ncyqDPu68P1 type: str description: Representation of the client credential after module execution returned: on success type: complex msg: description: Message as to what action was taken. returned: always type: str