Daniel Allaire
5e3e4e0a46
set -euo pipefail + executable /bin/bash sur la tâche kcadm. Sûr ici (les grep vides n'alimentent que des assignations, tolérées par set -e). Vérifié : lint production 0 échec, redéploiement idempotent (changed=0), testmail token HTTP 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.9 KiB
YAML
59 lines
2.9 KiB
YAML
---
|
|
# Fédération LDAP via kcadm — idempotent. Crée le realm applicatif + le provider de
|
|
# stockage LDAP (OpenLDAP, READ_ONLY). Éprouvé avant codification (testmail se connecte).
|
|
- name: Attendre que Keycloak réponde
|
|
ansible.builtin.wait_for:
|
|
host: 127.0.0.1
|
|
port: 8080
|
|
timeout: 120
|
|
when: not ansible_check_mode
|
|
|
|
- name: Configurer le realm et la fédération LDAP (kcadm, idempotent)
|
|
ansible.builtin.shell:
|
|
executable: /bin/bash
|
|
cmd: |
|
|
set -euo pipefail
|
|
KC={{ serveur_keycloak_home }}/bin/kcadm.sh
|
|
CHANGED=0
|
|
"$KC" config credentials --server http://localhost:8080 --realm master \
|
|
--user {{ serveur_keycloak_admin_user }} --password "$KC_ADMIN_PW" >/dev/null
|
|
if ! "$KC" get realms/{{ serveur_keycloak_realm }} >/dev/null 2>&1; then
|
|
"$KC" create realms -s realm={{ serveur_keycloak_realm }} -s enabled=true >/dev/null
|
|
CHANGED=1
|
|
fi
|
|
RID=$("$KC" get realms/{{ serveur_keycloak_realm }} --fields id 2>/dev/null \
|
|
| grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)
|
|
if ! "$KC" get components -r {{ serveur_keycloak_realm }} -q name={{ serveur_keycloak_ldap_nom }} 2>/dev/null \
|
|
| grep -q '"{{ serveur_keycloak_ldap_nom }}"'; then
|
|
"$KC" create components -r {{ serveur_keycloak_realm }} \
|
|
-s name={{ serveur_keycloak_ldap_nom }} -s providerId=ldap \
|
|
-s providerType=org.keycloak.storage.UserStorageProvider -s parentId="$RID" \
|
|
-s 'config.enabled=["true"]' \
|
|
-s 'config.vendor=["other"]' \
|
|
-s 'config.editMode=["READ_ONLY"]' \
|
|
-s 'config.importEnabled=["true"]' \
|
|
-s 'config.connectionUrl=["{{ serveur_keycloak_ldap_url }}"]' \
|
|
-s 'config.usersDn=["{{ serveur_keycloak_ldap_users_dn }}"]' \
|
|
-s 'config.bindDn=["{{ serveur_keycloak_ldap_bind_dn }}"]' \
|
|
-s "config.bindCredential=[\"$LDAP_BIND_PW\"]" \
|
|
-s 'config.authType=["simple"]' \
|
|
-s 'config.searchScope=["2"]' \
|
|
-s 'config.usernameLDAPAttribute=["{{ serveur_keycloak_ldap_username_attr }}"]' \
|
|
-s 'config.rdnLDAPAttribute=["{{ serveur_keycloak_ldap_username_attr }}"]' \
|
|
-s 'config.uuidLDAPAttribute=["{{ serveur_keycloak_ldap_uuid_attr }}"]' \
|
|
-s 'config.userObjectClasses=["{{ serveur_keycloak_ldap_object_classes }}"]' \
|
|
-s 'config.useTruststoreSpi=["always"]' \
|
|
-s 'config.connectionPooling=["true"]' >/dev/null
|
|
CHANGED=1
|
|
fi
|
|
[ "$CHANGED" = 1 ] && echo SETOPS_CHANGED || echo SETOPS_OK
|
|
environment:
|
|
KC_ADMIN_PW: "{{ serveur_keycloak_admin_password }}"
|
|
LDAP_BIND_PW: "{{ serveur_keycloak_ldap_bind_password }}"
|
|
register: serveur_keycloak_fed
|
|
changed_when: "'SETOPS_CHANGED' in serveur_keycloak_fed.stdout"
|
|
no_log: true
|
|
retries: 5
|
|
delay: 6
|
|
until: serveur_keycloak_fed.rc == 0
|
|
when: not ansible_check_mode
|