---
# Fédération LDAP via kcadm — idempotent. Crée le realm applicatif + le provider de
# stockage LDAP (OpenLDAP, READ_ONLY). Éprouvé avant codification (testmail se connecte).
- name: Attendre que Keycloak réponde
  ansible.builtin.wait_for:
    host: 127.0.0.1
    port: 8080
    timeout: 120
  when: not ansible_check_mode

- name: Configurer le realm et la fédération LDAP (kcadm, idempotent)
  ansible.builtin.shell:
    executable: /bin/bash
    cmd: |
      set -euo pipefail
      KC={{ serveur_keycloak_home }}/bin/kcadm.sh
      CHANGED=0
      "$KC" config credentials --server http://localhost:8080 --realm master \
        --user {{ serveur_keycloak_admin_user }} --password "$KC_ADMIN_PW" >/dev/null
      if ! "$KC" get realms/{{ serveur_keycloak_realm }} >/dev/null 2>&1; then
        "$KC" create realms -s realm={{ serveur_keycloak_realm }} -s enabled=true >/dev/null
        CHANGED=1
      fi
      RID=$("$KC" get realms/{{ serveur_keycloak_realm }} --fields id 2>/dev/null \
        | grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)
      if ! "$KC" get components -r {{ serveur_keycloak_realm }} -q name={{ serveur_keycloak_ldap_nom }} 2>/dev/null \
          | grep -q '"{{ serveur_keycloak_ldap_nom }}"'; then
        "$KC" create components -r {{ serveur_keycloak_realm }} \
          -s name={{ serveur_keycloak_ldap_nom }} -s providerId=ldap \
          -s providerType=org.keycloak.storage.UserStorageProvider -s parentId="$RID" \
          -s 'config.enabled=["true"]' \
          -s 'config.vendor=["other"]' \
          -s 'config.editMode=["READ_ONLY"]' \
          -s 'config.importEnabled=["true"]' \
          -s 'config.connectionUrl=["{{ serveur_keycloak_ldap_url }}"]' \
          -s 'config.usersDn=["{{ serveur_keycloak_ldap_users_dn }}"]' \
          -s 'config.bindDn=["{{ serveur_keycloak_ldap_bind_dn }}"]' \
          -s "config.bindCredential=[\"$LDAP_BIND_PW\"]" \
          -s 'config.authType=["simple"]' \
          -s 'config.searchScope=["2"]' \
          -s 'config.usernameLDAPAttribute=["{{ serveur_keycloak_ldap_username_attr }}"]' \
          -s 'config.rdnLDAPAttribute=["{{ serveur_keycloak_ldap_username_attr }}"]' \
          -s 'config.uuidLDAPAttribute=["{{ serveur_keycloak_ldap_uuid_attr }}"]' \
          -s 'config.userObjectClasses=["{{ serveur_keycloak_ldap_object_classes }}"]' \
          -s 'config.useTruststoreSpi=["always"]' \
          -s 'config.connectionPooling=["true"]' >/dev/null
        CHANGED=1
      fi
      [ "$CHANGED" = 1 ] && echo SETOPS_CHANGED || echo SETOPS_OK
  environment:
    KC_ADMIN_PW: "{{ serveur_keycloak_admin_password }}"
    LDAP_BIND_PW: "{{ serveur_keycloak_ldap_bind_password }}"
  register: serveur_keycloak_fed
  changed_when: "'SETOPS_CHANGED' in serveur_keycloak_fed.stdout"
  no_log: true
  retries: 5
  delay: 6
  until: serveur_keycloak_fed.rc == 0
  when: not ansible_check_mode