mirror of
https://github.com/ansible-collections/community.general.git
synced 2026-03-21 20:59:10 +00:00
80d21f2a0d
* feat(keycloak_realm_key): add support for auto-generated key providers Add support for Keycloak's auto-generated key providers where Keycloak manages the key material automatically: - rsa-generated: Auto-generates RSA signing keys - hmac-generated: Auto-generates HMAC signing keys - aes-generated: Auto-generates AES encryption keys - ecdsa-generated: Auto-generates ECDSA signing keys New algorithms: - HMAC: HS256, HS384, HS512 - ECDSA: ES256, ES384, ES512 - AES: AES (no algorithm parameter needed) New config options: - secret_size: For HMAC/AES providers (key size in bytes) - key_size: For RSA-generated provider (key size in bits) - elliptic_curve: For ECDSA-generated provider (P-256, P-384, P-521) Changes: - Make private_key/certificate optional (only required for rsa/rsa-enc) - Add provider-algorithm validation with clear error messages - Fix KeyError when managing default realm keys (issue #11459) - Maintain backward compatibility: RS256 default works for rsa/rsa-generated Fixes: #11459 * fix: address sanity test failures - Add 'default: RS256' to algorithm documentation to match spec - Add no_log=True to secret_size parameter per sanity check * feat(keycloak_realm_key): extend support for all Keycloak key providers Add support for remaining auto-generated key providers: - rsa-enc-generated (RSA encryption keys with RSA1_5, RSA-OAEP, RSA-OAEP-256) - ecdh-generated (ECDH key exchange with ECDH_ES, ECDH_ES_A128KW/A192KW/A256KW) - eddsa-generated (EdDSA signing with Ed25519, Ed448 curves) Changes: - Add provider-specific elliptic curve config key mapping (ecdsaEllipticCurveKey, ecdhEllipticCurveKey, eddsaEllipticCurveKey) - Add PROVIDERS_WITHOUT_ALGORITHM constant for providers that don't need algorithm - Add elliptic curve validation per provider type - Update documentation with all supported algorithms and examples - Add comprehensive integration tests for all new providers This completes full coverage of all Keycloak key provider types. * style: apply ruff formatting * feat(keycloak_realm_key): add java-keystore provider and update_password Add support for java-keystore provider to import keys from Java Keystore (JKS or PKCS12) files on the Keycloak server filesystem. Add update_password parameter to control password handling for java-keystore provider: - always (default): Always send passwords to Keycloak - on_create: Only send passwords when creating, preserve existing passwords when updating (enables idempotent playbooks) The on_create mode sends the masked value ("**********") that Keycloak recognizes as "preserve existing password", matching the behavior when re-importing an exported realm. Replace password_checksum with update_password - the checksum approach was complex and error-prone. The update_password parameter is simpler and follows the pattern used by ansible.builtin.user module. Also adds key_info return value containing kid, certificate fingerprint, status, and expiration for java-keystore keys. * address PR review feedback - Remove no_log=True from secret_size (just an int, not sensitive) - Add version_added: 12.4.0 to new parameters and return values - Remove "Added in community.general 12.4.0" from description text - Consolidate changelog entries into 4 focused entries - Remove bugfix from changelog (now in separate PR #11470) * address review feedback from russoz and felixfontein - remove docstrings from module-local helpers - remove line-by-line comments and unnecessary null guard - use specific exceptions instead of bare except Exception - use module.params["key"] instead of .get("key") - consolidate changelog into single entry - avoid "complete set" claim, reference Keycloak 26 instead * address round 2 review feedback - Extract remove_sensitive_config_keys() helper (DRY refactor) - Simplify RS256 validation to single code path - Add TypeError to inner except in compute_certificate_fingerprint() - Remove redundant comments (L812, L1031) - Switch .get() to direct dict access for module.params |
||
|---|---|---|
| .. | ||
| .keep | ||
| 5117-maven-artifact-snapshot-resolution.yml | ||
| 11029-extra-whitespace.yml | ||
| 11030-wsl-typing.yml | ||
| 11031-tss-lookup-delinea-rebranding.yml | ||
| 11043-ruff-check.yml | ||
| 11045-check-cobbler-version.yml | ||
| 11046-locale-gen-usrlocal.yml | ||
| 11048-py3-cond.yml | ||
| 11049-ruff-check.yml | ||
| 11052-dnsimple-info-improves.yml | ||
| 11054-zfs-facts-checkrc.yml | ||
| 11069-deprecate-spotinst.yml | ||
| 11070-deprecate-layman.yml | ||
| 11072-opendj-checkrc.yml | ||
| 11076-irc-true.yml | ||
| 11078-py2-ssl.yml | ||
| 11087-deprecate-swupd.yml | ||
| 11088-deprecate-dconf-fallback.yml | ||
| 11093-yum-versionlock-to-native.yml | ||
| 11095-raise-from.yml | ||
| 11097-raise-from.yml | ||
| 11098-tonative-1.yml | ||
| 11102-tonative-2.yml | ||
| 11104-tonative-3.yml | ||
| 11105-tonative-4.yml | ||
| 11106-tonative-5.yml | ||
| 11107-extend-merge-variables-failure-message.yml | ||
| 11110-tonative-6.yml | ||
| 11112-tonative-7.yml | ||
| 11114-nmcli-idempotency.yml | ||
| 11115-ruff-cases-1.yml | ||
| 11119-ruff-cases-2.yml | ||
| 11121-ruff-cases-3.yml | ||
| 11122-yield-from-ignore.yml | ||
| 11143-tonative-8.yml | ||
| 11144-xcc-redfish-command-listkeys.yml | ||
| 11145-ruff-cases-4.yml | ||
| 11148-snmp-facts-improve.yml | ||
| 11149-rv-exception.yml | ||
| 11167-typing.yml | ||
| 11168-homebrew_service.yml | ||
| 11172-zfs-changed-extra-props.yml | ||
| 11174-gitlab-runner-timeout.yml | ||
| 11179-mas-list-parsing.yml | ||
| 11182-vxlan-parent-bridging.yml | ||
| 11189-ruff-cases-6.yml | ||
| 11190-ruff-cases-7.yml | ||
| 11192-solaris-zone-os-system.yml | ||
| 11193-onepassword-info-popen.yml | ||
| 11197-keycloak-realm-webauthnpolicypasswordlesspasskeysenabled.yml | ||
| 11199-incus-windows.yml | ||
| 11204-lxc-container-popen.yml | ||
| 11205-module_utils.yml | ||
| 11206-datetime.yml | ||
| 11215-ruff-cases-8.yml | ||
| 11222-typing.yml | ||
| 11223-ruff-cases-9.yml | ||
| 11224-deprecate-pushbullet.yml | ||
| 11229-fstr-mishaps.yml | ||
| 11231-perc-format.yml | ||
| 11232-mount.yml | ||
| 11240-btrfs-run-command.yml | ||
| 11242-deps-enum.yml | ||
| 11245-monit-enum.yml | ||
| 11255-monit-integrationtests.yml | ||
| 11256-fix-keycloak-roles-mapping.yml | ||
| 11258-iptables_state.yml | ||
| 11260-keycloak-realm-crash-when-no-realms.yml | ||
| 11265-fix-apk-3.yml | ||
| 11285-extended-keycloak-user-profile-validations.yml | ||
| 11301-idrac-info-multi-manager.yml | ||
| 11308-wsl-shell-type.yml | ||
| 11309-keycloak-userprofile-selector-option.yml | ||
| 11311-scaleway-scw-profile-var.yml | ||
| 11314-scaleway-scw-profile-var-modules.yml | ||
| 11322-handle-redfish-settings-in-setbootoverride.yml | ||
| 11323-lxc-container-tempdir.yml | ||
| 11340-cronvar-simplify-exc.yml | ||
| 11341-pyupgrade-1.yml | ||
| 11343-pyupgrade-3.yml | ||
| 11344-pyupgrade-4.yml | ||
| 11346-incus-readability.yml | ||
| 11347-incus-regex.yml | ||
| 11366-scaleway-sg-project-param.yml | ||
| 11368-scaleway-ip-project-param.yml | ||
| 11376-netcup-dns-diff-mode.yml | ||
| 11377-cloudflare_dns-caa.yml | ||
| 11388-pmem-redundant-regexps.yml | ||
| 11390-slackpkg-query.yml | ||
| 11391-ruff-cases-11.yml | ||
| 11396-in-def-imports.yml | ||
| 11413-nmcli-routing-rules6.yml | ||
| 11425-nsupdate-gss-tsig.yml | ||
| 11430-fix-keycloak-client-diff-for-flow-overrides.yml | ||
| 11440-logstash-plugin-fix-version-argument-order.yml | ||
| 11442-gem-module-ruby-4.yml | ||
| 11443-fix-keycloak-client-diff-for-null-attributes.yml | ||
| 11453-keycloak-client-protocol-mapper-ids.yml | ||
| 11486-seport-dccp-sctp.yaml | ||
| 11488-mh-ensure-compatibiliy-with-module-tests.yml | ||
| 11492-python_requires_info.yml | ||
| 11503-keycloak-group-search-optimization.yml | ||
| 11504-redfish-info-add-results-to-return.yml | ||
| filesystem-xfs-resize-slack.yml | ||
| fix-nsupdate-keyring.yml | ||
| keycloak-client-add-missing-fields.yml | ||
| keycloak-realm-key-generated-providers.yml | ||
| keycloak-realm-key-keyerror-bugfix.yml | ||
| keycloak-url-encode-query-params.yml | ||
| listen-ports-facts-return-no-facts.yml | ||
| private.yml | ||