| Hung-Wei Chiu | 6a075af | 2021-09-09 22:33:06 +0000 | [diff] [blame] | 1 | --- |
| 2 | # keycloak molecule/default/verify.yml |
| 3 | # |
| 4 | # SPDX-FileCopyrightText: © 2021 Open Networking Foundation <support@opennetworking.org> |
| 5 | # SPDX-License-Identifier: Apache-2.0 |
| 6 | |
| 7 | - name: Verify |
| 8 | hosts: all |
| 9 | tasks: |
| Hung-Wei Chiu | 718cd26 | 2021-09-13 18:20:21 +0000 | [diff] [blame] | 10 | - name: "Create Token for service Keycloak" |
| 11 | uri: |
| Hung-Wei Chiu | 7260e78 | 2021-09-14 18:33:46 +0000 | [diff] [blame] | 12 | url: "{{ keycloak_server }}/auth/realms/master/protocol/openid-connect/token" |
| Hung-Wei Chiu | 718cd26 | 2021-09-13 18:20:21 +0000 | [diff] [blame] | 13 | method: POST |
| 14 | body_format: form-urlencoded |
| 15 | body: |
| 16 | username: "{{ keycloak_admin_username }}" |
| 17 | password: "{{ keycloak_admin_password }}" |
| 18 | grant_type: "password" |
| 19 | client_id: "admin-cli" |
| 20 | register: keycloak_token |
| 21 | |
| 22 | - name: "Get Client List" |
| 23 | uri: |
| Hung-Wei Chiu | 7260e78 | 2021-09-14 18:33:46 +0000 | [diff] [blame] | 24 | url: "{{ keycloak_admin_api }}/clients" |
| Hung-Wei Chiu | 718cd26 | 2021-09-13 18:20:21 +0000 | [diff] [blame] | 25 | method: GET |
| 26 | headers: |
| 27 | Accept: "application/json" |
| 28 | Authorization: "Bearer {{ keycloak_token.json.access_token }}" |
| 29 | register: keycloak_userlist |
| 30 | |
| 31 | - name: Check if the Keycloak client json output contains our client |
| 32 | set_fact: |
| 33 | find: true |
| 34 | with_items: "{{ keycloak_userlist.json }}" |
| 35 | when: item.name == keycloak_client_settings[0].name |
| 36 | |
| 37 | - name: Fail if our client isn't installed correctly |
| 38 | assert: |
| 39 | that: |
| 40 | - find is defined |
| Hung-Wei Chiu | 7260e78 | 2021-09-14 18:33:46 +0000 | [diff] [blame] | 41 | |
| 42 | - name: "Get existing LDAP configuration" |
| 43 | uri: |
| 44 | url: "{{ keycloak_admin_api }}/components?type=org.keycloak.storage.UserStorageProvider" |
| 45 | method: GET |
| 46 | headers: |
| 47 | Accept: "application/json" |
| 48 | Authorization: "Bearer {{ keycloak_token.json.access_token }}" |
| 49 | register: keycloak_components_list |
| 50 | |
| 51 | - name: Check if the Keycloak already has the LDAP configuration |
| 52 | set_fact: |
| 53 | ldap_id: "{{ item.id }}" |
| 54 | with_items: "{{ keycloak_components_list.json }}" |
| 55 | when: item.name == "ldap" |
| 56 | |
| 57 | - name: Generate a local json file for LDAP configuration |
| 58 | become: false |
| 59 | delegate_to: localhost |
| 60 | template: |
| 61 | src: "{{ item }}.j2" |
| 62 | dest: "/tmp/{{ item }}" |
| 63 | mode: "0600" |
| 64 | with_items: |
| 65 | - ldap.testconnection |
| 66 | - ldap.testuser |
| 67 | |
| 68 | - name: Test LDAP Authentication |
| 69 | uri: |
| 70 | url: "{{ keycloak_admin_api }}/testLDAPConnection" |
| 71 | method: POST |
| 72 | src: /tmp/ldap.testconnection |
| 73 | status_code: [204] |
| 74 | headers: |
| 75 | Content-Type: application/json |
| 76 | Authorization: "Bearer {{ keycloak_token.json.access_token }}" |
| 77 | |
| 78 | - name: Create user via Keycloak |
| 79 | uri: |
| 80 | url: "{{ keycloak_admin_api }}/users" |
| 81 | method: POST |
| 82 | src: /tmp/ldap.testuser |
| 83 | status_code: [201] |
| 84 | headers: |
| 85 | Content-Type: application/json |
| 86 | Authorization: "Bearer {{ keycloak_token.json.access_token }}" |
| 87 | register: keycloak_create_user_response |
| 88 | |
| 89 | - name: Get User ID from previous response |
| 90 | set_fact: |
| 91 | user_id: "{{ keycloak_create_user_response.location | basename }}" |
| 92 | |
| 93 | - name: Verify created user via LDAP |
| 94 | community.general.ldap_entry: |
| 95 | dn: "uid={{ keycloak_ldap_testing_user }},{{ keycloak_ldap_userdn }}" |
| 96 | objectClass: "{{ keyclaok_ldap_user_object }}" |
| 97 | server_uri: "{{ keycloak_ldap_server }}" |
| 98 | bind_dn: "{{ keycloak_ldap_admin_dn }}" |
| 99 | bind_pw: "{{ keycloak_ldap_admin_password }}" |
| 100 | register: result |
| 101 | |
| 102 | - name: Delete user via Keycloak |
| 103 | uri: |
| 104 | url: "{{ keycloak_admin_api }}/users/{{ user_id }}" |
| 105 | method: DELETE |
| 106 | status_code: [204] |
| 107 | headers: |
| 108 | Content-Type: application/json |
| 109 | Authorization: "Bearer {{ keycloak_token.json.access_token }}" |
| 110 | |
| 111 | - name: Verify removed user via LDAP |
| 112 | community.general.ldap_entry: |
| 113 | dn: "uid={{ keycloak_ldap_testing_user }},{{ keycloak_ldap_userdn }}" |
| 114 | objectClass: "{{ keyclaok_ldap_user_object }}" |
| 115 | server_uri: "{{ keycloak_ldap_server }}" |
| 116 | bind_dn: "{{ keycloak_ldap_admin_dn }}" |
| 117 | bind_pw: "{{ keycloak_ldap_admin_password }}" |
| 118 | register: result |
| 119 | failed_when: |
| 120 | - '"missing attribute" not in result.details' |
| 121 | |
| 122 | - name: Remove local LDAP json file |
| 123 | delegate_to: localhost |
| 124 | file: |
| 125 | path: "/tmp/{{ item }}" |
| 126 | state: absent |
| 127 | with_items: |
| 128 | - ldap.testconnection |
| 129 | - ldap.testuser |