New Module: Keycloak Client ScopeMapping #4017
Conversation
This comment has been minimized.
This comment has been minimized.
Co-authored-by: Felix Fontein <felix@fontein.de>
plugins/modules/identity/keycloak/keycloak_client_scopemapping.py
Outdated
Show resolved
Hide resolved
| id: role_id1 | ||
| - name: role_name2 | ||
| id: role_id2 | ||
| delegate_to: localhost |
There was a problem hiding this comment.
The name of this example implies that it is the same example as the former one, but with different authentication solution. However, I note that the client-id's are different - which may be confusing.
However, I'm not actually sure of the benefit to the reader by showing both authentication variations, particularly as there's no example included of how to get the token itself in ansible.
There was a problem hiding this comment.
The clients' IDs should be different, one is for the client to be granted, another is the client with roles, I know it's confusing but I have no idea for naming them differently, for now.
There was a problem hiding this comment.
Hi @fynncfchen. My concern wasn't with there being different client Id's, but rather than the name of the examples compared to the name of the previous example implied there was only a difference in how the module authenticates.
plugins/modules/identity/keycloak/keycloak_client_scopemapping.py
Outdated
Show resolved
Hide resolved
| "attributes": { | ||
| "request.object.signature.alg": "RS256", | ||
| } | ||
| } |
There was a problem hiding this comment.
Is these sample actually true? The seem cut-n-pasted from a different function. The code you have shows that the content of end_state is the value of assigned_roles_after which this doesn't look like it represents.
There was a problem hiding this comment.
Yes, I actually copy it from another function. I'm not sure this will represent and I should make a double check with it.
| if role['id'] is None: | ||
| role['id'] = kc.get_client_role_id_by_name(cid, role['name'], realm=realm) | ||
| if role['id'] is None: | ||
| module.fail_json(msg='Could not fetch role %s:' % (role['name'])) |
There was a problem hiding this comment.
Just an observation is that get_client_role_id_by_name, even though that function seems to get the full list of client roles and filters for just the name. This would imply that this solution is wasteful - either the web request could include a query parameter for the role's name, or the list could be filtered for each iteration of this for loop.
However, for most use cases, I don't think this is a great concern.
| if role['name'] is None: | ||
| role['name'] = kc.get_client_role_name_by_id(client_role['id'], role['id'], realm=realm) | ||
| if role['name'] is None: | ||
| module.fail_json(msg='Could not fetch role %s:' % (role['id'])) |
There was a problem hiding this comment.
I think the function to get_client_role_name_by_id performs the same request to Keycloak as the one above (i.e. without any query parameters). The wastefulness described above is this potentially double by this solution.
plugins/modules/identity/keycloak/keycloak_client_scopemapping.py
Outdated
Show resolved
Hide resolved
Co-authored-by: Pierre Dumuid <pmdumuid@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
|
@fynncfchen @pmdumuid what's the current state of this PR? @fynncfchen are you planning to do more changes? @pmdumuid do you think there should be more changes? |
| url=self.baseurl, realm=realm, id=cid, client=client) | ||
| try: | ||
| open_url(client_scopemappings_client_url, method="POST", headers=self.restheaders, | ||
| data=json.dumps(rolereps), validate_certs=self.validate_certs) |
There was a problem hiding this comment.
This (and others) need to be adjusted similar to #4178.
|
This New Module PR contains a symbolic link from plugins/modules/ to the actual Python file. Since #4562 this is no longer necessary and will soon be flagged as an error. Instead you need to add an entry to meta/runtime.yml, similar to this one: https://github.com/ansible-collections/community.general/blob/main/meta/runtime.yml#L21-L22 See also our updated instructions on creating new modules: https://github.com/ansible-collections/community.general/blob/main/CONTRIBUTING.md#creating-new-modules-or-plugins |
|
needs_info |
|
@fynncfchen This pullrequest is waiting for your response. Please respond or the pullrequest will be closed. |
|
@fynncfchen You have not responded to information requests in this pullrequest so we will assume it no longer affects you. If you are still interested in this, please create a new pullrequest with the requested information. |
Docs Build 📝This PR is closed and any previously published docsite has been unpublished. |
SUMMARY
Add
keycloak_client_scopemappingmodule to provide manage client scope mappings for other clients or realm (not support yet).Different from
keycloak_client_rolemappingmodule, thekeycloak_client_scopemappingmodule is creating mappings between clients but thekeycloak_client_rolemappingmodule is creating mapping associate with client and group, and can't assign role from different clients (it seems to be a bug and can be fixed later)ISSUE TYPE
COMPONENT NAME
keycloak_client_scopemappingADDITIONAL INFORMATION
Example: