commit	7d0ba59a11ddb4adcc817db208521c730078fd94	[log] [tgz]
author	Zack Williams <zdw@opennetworking.org>	Sat Sep 03 21:43:15 2022 -0700
committer	Zack Williams <zdw@opennetworking.org>	Sat Sep 03 21:43:15 2022 -0700
tree	e89d699bd84d1b9269f8f5911697ab7bdbd0452c
parent	817f8b408cdf7c8bc48be9d5ee13eb6d17d497f0 [diff]

tree: e89d699bd84d1b9269f8f5911697ab7bdbd0452c

README.md

keycloak

Keycloak Server

Requirements

Minimum ansible version: 2.9.5

Defaults

List of default values for variables:

Example Playbook

- hosts: all
  vars:
    keycloak_ldap_userdn: "ou=people,dc=testing,dc=org"
    keycloak_ldap_admin_dn: "cn=Your Admin DN"
    keycloak_ldap_admin_password: "changeme"
    keycloak_admin_password: changeme
    keycloak_client_settings:
      - name: ...
  roles:
    - keycloak

The keycloak_client_settings is used to define client setting on the keycloak server. This is a list of all required options:

Reference:

keycloak_client_settings:
  - name: rancher_staging #name of the server
    client_id: https://staging.aether.onlab.us/v1-saml/keycloak/saml/metadata #URL of Rancher server
    auth_realm: master #relam of keycloak, default is master
    protocol: saml #SAML protocol for Rancher (<v2.6)
    description: "Staging Rancher server"
    attributes:
      saml.client.signature: false
      saml.assertion.signature: true
      saml_idp_initiated_sso_url_name: "IdPSSOName"
      saml.server.signature: true
      saml_name_id_format: "username"
    redirect_uris: #List of redirect URIs, is related to Rancher server
      - https://staging.aether.onlab.us/v1-saml/keycloak/saml/acs
    protocol_mappers: #User and Group mappers, indicate how to map user/group field from Keycloak to client
      - config:
          attribute.name: "uid"
          attribute.nameformat: "Basic"
          user.attribute: "username"
        name: "x509 username"
        protocol: "saml"
        protocolMapper: "saml-user-property-mapper"
      - config:
          attribute.name: "member"
          attribute.nameformat: "Basic"
          full.path: "false"
          single: "true"
        name: "groups"
        protocol: "saml"
        protocolMapper: "saml-group-membership-mapper"

License and Author

License: Apache-2.0