community.general.keycloak_authentication module – Configure authentication in Keycloak

Note

This module is part of the community.general collection (version 8.6.7).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.keycloak_authentication.

New in community.general 3.3.0

Synopsis

  • This module actually can only make a copy of an existing authentication flow, add an execution to it and configure it.

  • It can also delete the flow.

Aliases: identity.keycloak.keycloak_authentication

Parameters

Parameter

Comments

alias

string / required

Alias for the authentication flow.

auth_client_id

string

OpenID Connect client_id to authenticate to the API with.

Default: "admin-cli"

auth_client_secret

string

Client Secret to use in conjunction with auth_client_id (if required).

auth_keycloak_url

aliases: url

string / required

URL to the Keycloak instance.

auth_password

aliases: password

string

Password to authenticate for API access with.

auth_realm

string

Keycloak realm name to authenticate to for API access.

auth_username

aliases: username

string

Username to authenticate for API access with.

authenticationExecutions

list / elements=dictionary

Configuration structure for the executions.

authenticationConfig

dictionary

Describe the config of the authentication.

displayName

string

Name of the execution or subflow to create or update.

flowAlias

string

Alias of parent flow.

index

integer

Priority order of the execution.

providerId

string

providerID for the new flow when not copied from an existing flow.

requirement

string

Control status of the subflow or execution.

Choices:

  • "REQUIRED"

  • "ALTERNATIVE"

  • "DISABLED"

  • "CONDITIONAL"

subFlowType

string

added in community.general 6.6.0

For new subflows, optionally specify the type.

Is only used at creation.

Choices:

  • "basic-flow" ← (default)

  • "form-flow"

connection_timeout

integer

added in community.general 4.5.0

Controls the HTTP connections timeout period (in seconds) to Keycloak API.

Default: 10

copyFrom

string

flowAlias of the authentication flow to use for the copy.

description

string

Description of the flow.

force

boolean

If true, allows to remove the authentication flow and recreate it.

Choices:

  • false ← (default)

  • true

http_agent

string

added in community.general 5.4.0

Configures the HTTP User-Agent header.

Default: "Ansible"

providerId

string

providerId for the new flow when not copied from an existing flow.

Choices:

  • "basic-flow"

  • "client-flow"

realm

string / required

The name of the realm in which is the authentication.

state

string

Control if the authentication flow must exists or not.

Choices:

  • "present" ← (default)

  • "absent"

token

string

added in community.general 3.0.0

Authentication token for Keycloak API.

validate_certs

boolean

Verify TLS certificates (do not disable this in production).

Choices:

  • false

  • true ← (default)

Attributes

Attribute

Support

Description

check_mode

Support: full

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: full

Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Create an authentication flow from first broker login and add an execution to it.
  community.general.keycloak_authentication:
    auth_keycloak_url: http://localhost:8080/auth
    auth_realm: master
    auth_username: admin
    auth_password: password
    realm: master
    alias: "Copy of first broker login"
    copyFrom: "first broker login"
    authenticationExecutions:
      - providerId: "test-execution1"
        requirement: "REQUIRED"
        authenticationConfig:
            alias: "test.execution1.property"
            config:
            test1.property: "value"
      - providerId: "test-execution2"
        requirement: "REQUIRED"
        authenticationConfig:
            alias: "test.execution2.property"
            config:
            test2.property: "value"
    state: present

- name: Re-create the authentication flow
  community.general.keycloak_authentication:
    auth_keycloak_url: http://localhost:8080/auth
    auth_realm: master
    auth_username: admin
    auth_password: password
    realm: master
    alias: "Copy of first broker login"
    copyFrom: "first broker login"
    authenticationExecutions:
      - providerId: "test-provisioning"
        requirement: "REQUIRED"
        authenticationConfig:
            alias: "test.provisioning.property"
            config:
            test.provisioning.property: "value"
    state: present
    force: true

- name: Create an authentication flow with subflow containing an execution.
  community.general.keycloak_authentication:
    auth_keycloak_url: http://localhost:8080/auth
    auth_realm: master
    auth_username: admin
    auth_password: password
    realm: master
    alias: "Copy of first broker login"
    copyFrom: "first broker login"
    authenticationExecutions:
      - providerId: "test-execution1"
        requirement: "REQUIRED"
      - displayName: "New Subflow"
        requirement: "REQUIRED"
      - providerId: "auth-cookie"
        requirement: "REQUIRED"
        flowAlias: "New Sublow"
    state: present

- name: Remove authentication.
  community.general.keycloak_authentication:
    auth_keycloak_url: http://localhost:8080/auth
    auth_realm: master
    auth_username: admin
    auth_password: password
    realm: master
    alias: "Copy of first broker login"
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

end_state

dictionary

Representation of the authentication after module execution.

Returned: on success

Sample: {"alias": "Copy of first broker login", "authenticationExecutions": [{"alias": "review profile config", "authenticationConfig": {"alias": "review profile config", "config": {"update.profile.on.first.login": "missing"}, "id": "6f09e4fb-aad4-496a-b873-7fa9779df6d7"}, "configurable": true, "displayName": "Review Profile", "id": "8f77dab8-2008-416f-989e-88b09ccf0b4c", "index": 0, "level": 0, "providerId": "idp-review-profile", "requirement": "REQUIRED", "requirementChoices": ["REQUIRED", "ALTERNATIVE", "DISABLED"]}], "builtIn": false, "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", "id": "bc228863-5887-4297-b898-4d988f8eaa5c", "providerId": "basic-flow", "topLevel": true}

msg

string

Message as to what action was taken.

Returned: always

Authors

  • Philippe Gauthier (@elfelip)

  • Gaëtan Daubresse (@Gaetan2907)