Fix Keycloak authentication flow configuration issues #9987

desand01 · 2025-04-11T13:45:24Z

SUMMARY

Fix authentification flow configuration duplication

ISSUE TYPE

Bugfix Pull Request

COMPONENT NAME

keycloak_authentication.py
keycloak.py

ADDITIONAL INFORMATION

Modification to authentification flow configuration cause the creation of a duplicate record in AUTHENTICATOR_CONFIG and AUTHENTICATOR_CONFIG_ENTRY

KC26 exported realm:

    {
      "id": "f76d998c-6eb4-42fa-b3b1-df8ae2be926c",
      "alias": "my-conditional-reset-otp-config",
      "config": {
        "defaultOtpOutcome": "force",
        "noOtpRequiredForHeaderPattern": "X-Forwarded-For: 10\\.[0-9\\.:]+"
      }
    },
    {
      "id": "e195fad8-4470-47be-ada2-ecf44146a0eb",
      "alias": "my-conditional-reset-otp-config",
      "config": {
        "defaultOtpOutcome": "force",
        "noOtpRequiredForHeaderPattern": "X-Original-Forwarded-For: 10.[0-9\\.:]+"
      }
    }

…or_update_executions

ansibullbot · 2025-04-11T13:48:50Z

cc @Gaetan2907 @eikef @elfelip @mattock @ndclt @thomasbach-dev
click here for bot help

… tasks, and variables

felixfontein · 2025-04-12T15:43:28Z

Thanks for your contribution! From an Ansible point of view it looks good to me; I can't say anything about the change itself :)

If nobody objects, I'll merge this at the end of the upcoming week.

desand01 · 2025-04-13T10:30:14Z

During testing, I realized that the issue seems to be fixed in KC 26.2.0+

felixfontein · 2025-04-13T13:51:24Z

Does the fix break anything with 26.2.0+? If not, it's probably best to adjust the changelog fragment to mention that the fix is only needed for < 26.2.0.

russoz

Couple of comments there.

russoz · 2025-04-13T21:28:06Z

tests/integration/targets/keycloak_authentication/tasks/main.yml

+#  environment: 
+#    https_proxy: http://10.249.120.90:8080
+#    http_proxy: http://10.249.120.90:8080


This shouldn't be here, I suppose ;-)

russoz · 2025-04-13T21:29:24Z

tests/integration/targets/keycloak_authentication/tasks/access_token.yml

+    return_content: true
+    status_code: 200
+    headers:
+      X-Requested-By: "Jenkins"


Just curiosity, is this required?

Look like it's useless

russoz · 2025-04-13T21:31:02Z

tests/integration/targets/keycloak_authentication/README.md

The test container start (and implicit stop) could be added directly into the test itself. See:

https://github.com/russoz-ansible/community.general/blob/main/tests/integration/targets/mssql_script/tasks/main.yml

as an example

Sorry I wasn't very thorough in my directions. Please check the meta stuff in the mssql_script integration test as well, with the dependency to the setup_docker role, to ensure that docker is installed (and uninstalled after the test).

To ensure everything is working as it should, it is suggested to run the test on a clean VM (using vagrant could make that easier).

I don't think we want to run these tests in CI. That's something that should happen once all Keycloak stuff is moved to its own collection, and then it's time to figure out there how integration tests should run. Investing too much time into that now is potentially wasting resources that could be spent better after a move. (Of course, assuming that a move will happen.)

… token task, and enhance variable management

felixfontein · 2025-04-15T17:57:12Z

BTW, @desand01 you might be interested in https://forum.ansible.com/t/keycloak-modules-in-community-general/41746

desand01 · 2025-04-15T19:02:23Z

@felixfontein thanks, I'm going to register and follow the discussion

russoz · 2025-04-16T21:54:39Z

It seems that changes introduced by KC 26 might be turning into a common theme - see #9983 - maybe we should define a common strategy for these (and future) changes related to that versioning.

Cc: @fgruenbauer

felixfontein · 2025-04-18T09:52:32Z

That's another reason why a common collection for all Keycloak modules and plugins would be a great thing, so that there's a good place where such discussions can take place :)

patchback · 2025-04-19T07:00:48Z

Backport to stable-9: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-9/a8b977320c04a75069f4208cf723743b53ed0d20/pr-9987

Backported as #10017

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

* Add delete_authentication_config method and integrate it into create_or_update_executions * typo * Sanity * Add integration tests for keycloak_authentication module with README, tasks, and variables * Add copyright and license information to access_token.yml * Sanity * Refactor Keycloak integration tests: streamline README, update access token task, and enhance variable management * Maj changelogs fragments --------- Co-authored-by: Andre Desrosiers <[email protected]> (cherry picked from commit a8b9773)

patchback · 2025-04-19T07:00:57Z

Backport to stable-10: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-10/a8b977320c04a75069f4208cf723743b53ed0d20/pr-9987

Backported as #10018

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

felixfontein · 2025-04-19T07:01:02Z

@desand01 thanks for your contribution!
@russoz thanks for reviewing!

* Add delete_authentication_config method and integrate it into create_or_update_executions * typo * Sanity * Add integration tests for keycloak_authentication module with README, tasks, and variables * Add copyright and license information to access_token.yml * Sanity * Refactor Keycloak integration tests: streamline README, update access token task, and enhance variable management * Maj changelogs fragments --------- Co-authored-by: Andre Desrosiers <[email protected]> (cherry picked from commit a8b9773)

…low configuration issues (#10018) Fix Keycloak authentication flow configuration issues (#9987) * Add delete_authentication_config method and integrate it into create_or_update_executions * typo * Sanity * Add integration tests for keycloak_authentication module with README, tasks, and variables * Add copyright and license information to access_token.yml * Sanity * Refactor Keycloak integration tests: streamline README, update access token task, and enhance variable management * Maj changelogs fragments --------- Co-authored-by: Andre Desrosiers <[email protected]> (cherry picked from commit a8b9773) Co-authored-by: desand01 <[email protected]>

…ow configuration issues (#10017) Fix Keycloak authentication flow configuration issues (#9987) * Add delete_authentication_config method and integrate it into create_or_update_executions * typo * Sanity * Add integration tests for keycloak_authentication module with README, tasks, and variables * Add copyright and license information to access_token.yml * Sanity * Refactor Keycloak integration tests: streamline README, update access token task, and enhance variable management * Maj changelogs fragments --------- Co-authored-by: Andre Desrosiers <[email protected]> (cherry picked from commit a8b9773) Co-authored-by: desand01 <[email protected]>

Andre Desrosiers added 2 commits April 11, 2025 09:00

Add delete_authentication_config method and integrate it into create_…

e67e922

…or_update_executions

typo

e49abf0

ansibullbot added bug This issue/PR relates to a bug identity module module module_utils module_utils plugins plugin (any type) labels Apr 11, 2025

Andre Desrosiers added 3 commits April 11, 2025 09:53

Sanity

ff7cdd5

Add integration tests for keycloak_authentication module with README,…

afd5164

… tasks, and variables

Add copyright and license information to access_token.yml

66094a6

ansibullbot added integration tests/integration tests tests labels Apr 12, 2025

Sanity

ff8e597

felixfontein added check-before-release PR will be looked at again shortly before release and merged if possible. backport-9 Automatically create a backport for the stable-9 branch backport-10 Automatically create a backport for the stable-10 branch labels Apr 12, 2025

russoz reviewed Apr 13, 2025

View reviewed changes

Andre Desrosiers added 2 commits April 14, 2025 08:14

Refactor Keycloak integration tests: streamline README, update access…

43e942f

… token task, and enhance variable management

Maj changelogs fragments

043f471

felixfontein merged commit a8b9773 into ansible-collections:main Apr 19, 2025
141 checks passed

felixfontein removed the check-before-release PR will be looked at again shortly before release and merged if possible. label Apr 19, 2025

patchback bot mentioned this pull request Apr 19, 2025

[PR #9987/a8b97732 backport][stable-9] Fix Keycloak authentication flow configuration issues #10017

Merged

patchback bot mentioned this pull request Apr 19, 2025

[PR #9987/a8b97732 backport][stable-10] Fix Keycloak authentication flow configuration issues #10018

Merged

Fix Keycloak authentication flow configuration issues #9987

Fix Keycloak authentication flow configuration issues #9987

Uh oh!

Conversation

desand01 commented Apr 11, 2025

SUMMARY

ISSUE TYPE

COMPONENT NAME

ADDITIONAL INFORMATION

Uh oh!

ansibullbot commented Apr 11, 2025

Uh oh!

felixfontein commented Apr 12, 2025

Uh oh!

desand01 commented Apr 13, 2025

Uh oh!

felixfontein commented Apr 13, 2025

Uh oh!

russoz left a comment

Choose a reason for hiding this comment

Uh oh!

russoz Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

russoz Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

desand01 Apr 14, 2025

Choose a reason for hiding this comment

Uh oh!

russoz Apr 13, 2025

Choose a reason for hiding this comment

Uh oh!

desand01 Apr 14, 2025

Choose a reason for hiding this comment

Uh oh!

russoz Apr 18, 2025

Choose a reason for hiding this comment

Uh oh!

felixfontein Apr 18, 2025

Choose a reason for hiding this comment

Uh oh!

felixfontein commented Apr 15, 2025

Uh oh!

desand01 commented Apr 15, 2025

Uh oh!

russoz commented Apr 16, 2025

Uh oh!

felixfontein commented Apr 18, 2025

Uh oh!

Uh oh!

patchback bot commented Apr 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to stable-9: 💚 backport PR created

Uh oh!

patchback bot commented Apr 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to stable-10: 💚 backport PR created

Uh oh!

felixfontein commented Apr 19, 2025

Uh oh!

Uh oh!

patchback bot commented Apr 19, 2025 •

edited

Loading

patchback bot commented Apr 19, 2025 •

edited

Loading