Try SpotterAllows administration of Keycloak roles via Keycloak API
| "added in version" 1.0.0 of jugasit.keycloak"
Authors: Laurent Paumier (@laurpaum)
Install with ansible-galaxy collection install jugasit.keycloak:==1.1.0
collections:
- name: jugasit.keycloak
version: 1.1.0This module allows you to add, remove or modify Keycloak roles via the Keycloak REST API. It requires access to the REST API via OpenID Connect; the user connecting and the client being used must have the requisite access rights. In a default Keycloak installation, admin-cli and an admin user would work, as would a separate client definition with the scope tailored to your needs and a user having the expected roles.
The names of module options are snake_cased versions of the camelCase ones found in the Keycloak API and its documentation at U(https://www.keycloak.org/docs-api/8.0/rest-api/index.html).
Attributes are multi-valued in the Keycloak API. All attributes are lists of individual values and will be returned that way by this module. You may pass single values for attributes when calling the module, and this will be translated into a list suitable for the API.
- name: Create a Keycloak realm role, authentication with credentials
jugasit.keycloak.role:
name: my-new-kc-role
realm: MyCustomRealm
state: present
auth_client_id: admin-cli
auth_keycloak_url: https://auth.example.com/auth
auth_realm: master
auth_username: USERNAME
auth_password: PASSWORD
delegate_to: localhost
- name: Create a Keycloak realm role, authentication with token
jugasit.keycloak.role:
name: my-new-kc-role
realm: MyCustomRealm
state: present
auth_client_id: admin-cli
auth_keycloak_url: https://auth.example.com/auth
token: TOKEN
delegate_to: localhost
- name: Create a Keycloak client role
jugasit.keycloak.role:
name: my-new-kc-role
realm: MyCustomRealm
client_id: MyClient
state: present
auth_client_id: admin-cli
auth_keycloak_url: https://auth.example.com/auth
auth_realm: master
auth_username: USERNAME
auth_password: PASSWORD
delegate_to: localhost
- name: Delete a Keycloak role
jugasit.keycloak.role:
name: my-role-for-deletion
state: absent
auth_client_id: admin-cli
auth_keycloak_url: https://auth.example.com/auth
auth_realm: master
auth_username: USERNAME
auth_password: PASSWORD
delegate_to: localhost
- name: Create a keycloak role with some custom attributes
jugasit.keycloak.role:
auth_client_id: admin-cli
auth_keycloak_url: https://auth.example.com/auth
auth_realm: master
auth_username: USERNAME
auth_password: PASSWORD
name: my-new-role
attributes:
attrib1: value1
attrib2: value2
attrib3:
- with
- numerous
- individual
- list
- items
delegate_to: localhost
name:
description:
- Name of the role.
- This parameter is required.
required: true
type: str
realm:
default: master
description:
- The Keycloak realm under which this role resides.
type: str
state:
choices:
- present
- absent
default: present
description:
- State of the role.
- On C(present), the role will be created if it does not yet exist, or updated with
the parameters you provide.
- On C(absent), the role will be removed if it exists.
type: str
token:
description:
- Authentication token for Keycloak API.
type: str
version_added: 1.0.0
version_added_collection: jugasit.keycloak
client_id:
description:
- If the role is a client role, the client id under which it resides.
- If this parameter is absent, the role is considered a realm role.
type: str
attributes:
description:
- A dict of key/value pairs to set as custom attributes for the role.
- Values may be single values (e.g. a string) or a list of strings.
type: dict
auth_realm:
default: master
description:
- Keycloak realm name to authenticate to for API access.
type: str
http_agent:
default: Ansible
description:
- Configures the HTTP User-Agent header.
type: str
version_added: 1.0.0
version_added_collection: jugasit.keycloak
description:
description:
- The role description.
type: str
auth_password:
description:
- Password to authenticate for API access with.
- If the value is not specified in the task, the value of environment variable C(KEYCLOAK_PASSWORD)
or C(SSO_PASSWORD) will be used instead.
type: str
auth_username:
description:
- Username to authenticate for API access with.
- If the value is not specified in the task, the value of environment variable C(KEYCLOAK_USERNAME)
or C(SSO_USERNAME) will be used instead.
type: str
auth_client_id:
default: admin-cli
description:
- OpenID Connect I(client_id) to authenticate to the API with.
type: str
validate_certs:
default: true
description:
- Verify TLS certificates (do not disable this in production).
type: bool
auth_keycloak_url:
aliases:
- url
description:
- URL to the Keycloak instance.
- If the value is not specified in the task, the value of environment variable C(KEYCLOAK_URL)
or C(SSO_URL) will be used instead.
required: false
type: str
auth_client_secret:
description:
- Client Secret to use in conjunction with I(auth_client_id) (if required).
type: str
connection_timeout:
default: 10
description:
- Controls the HTTP connections timeout period (in seconds) to Keycloak API.
type: int
version_added: 1.0.0
version_added_collection: jugasit.keycloak
end_state:
description: Representation of role after module execution (sample is truncated).
returned: on success
sample:
attributes: {}
clientRole: true
composite: false
containerId: 9f03eb61-a826-4771-a9fd-930e06d2d36a
description: My updated client test role
id: 561703dd-0f38-45ff-9a5a-0c978f794547
name: myrole
type: dict
existing:
description: Representation of existing role.
returned: always
sample:
attributes: {}
clientRole: true
composite: false
containerId: 9f03eb61-a826-4771-a9fd-930e06d2d36a
description: My client test role
id: 561703dd-0f38-45ff-9a5a-0c978f794547
name: myrole
type: dict
msg:
description: Message as to what action was taken.
returned: always
sample: Role myrole has been updated
type: str
proposed:
description: Representation of proposed role.
returned: always
sample:
description: My updated test description
type: dict