---
argument_specs:
  main:
    short_description: Configure Keycloak OIDC login for Automation Orchestrator
    description:
      - Creates a confidential OIDC client (with a "groups" claim mapper) and the mapped groups
        in Keycloak, then registers Keycloak as an identity provider in Automation Orchestrator
        via its REST API, mapping Keycloak groups to AO built-in groups.
      - The client secret is read back from Keycloak on each run, so it is not stored elsewhere.
      - >-
        Sets APP_OIDC_ALLOW_PRIVATE_NETWORKS on the backend Deployment, since the
        AutomationOrchestrator CR has no field for it and the backend otherwise rejects
        issuers resolving to private IPs.
    options:
      automation_orchestrator_oidc_namespace:
        description: Namespace of the AutomationOrchestrator instance.
        type: str
        default: automation-orchestrator
      automation_orchestrator_oidc_instance_name:
        description: Name of the AutomationOrchestrator CR (prefix of its Route, Deployments and Secrets).
        type: str
        default: automation-orchestrator
      automation_orchestrator_oidc_url:
        description: Public base URL of Automation Orchestrator. Empty derives it from the instance Route.
        type: str
        default: ""
      automation_orchestrator_oidc_admin_user:
        description: Local AO admin used to call the API (password read from the initial-admin-password Secret).
        type: str
        default: admin
      automation_orchestrator_oidc_validate_certs:
        description: Verify TLS when calling the AO API.
        type: bool
        default: true
      automation_orchestrator_oidc_keycloak_url:
        description: Keycloak base URL (e.g. https://auth.example.com).
        type: str
        required: true
      automation_orchestrator_oidc_keycloak_realm:
        description: Keycloak realm holding the client and groups.
        type: str
        required: true
      automation_orchestrator_oidc_keycloak_admin_user:
        description: Keycloak master-realm admin username.
        type: str
        required: true
      automation_orchestrator_oidc_keycloak_admin_password:
        description: Keycloak master-realm admin password.
        type: str
        required: true
        no_log: true
      automation_orchestrator_oidc_keycloak_validate_certs:
        description: Verify TLS when calling the Keycloak admin API.
        type: bool
        default: true
      automation_orchestrator_oidc_client_id:
        description: Keycloak client ID for Automation Orchestrator.
        type: str
        default: automation-orchestrator
      automation_orchestrator_oidc_create_keycloak_groups:
        description: Create the Keycloak groups named in group_mappings. Group membership is managed in Keycloak.
        type: bool
        default: true
      automation_orchestrator_oidc_provider_name:
        description: Name of the identity provider in Automation Orchestrator (shown on the login page).
        type: str
        default: Keycloak
      automation_orchestrator_oidc_group_mappings:
        description: >-
          Keycloak group to AO built-in group mappings. Users in no mapped group are refused login.
        type: list
        elements: dict
        required: true
        options:
          idp_group:
            description: Keycloak group name, as emitted in the "groups" claim.
            type: str
            required: true
          group:
            description: AO built-in group.
            type: str
            required: true
            choices: [admins, auditors, users]
      automation_orchestrator_oidc_rp_initiated_logout:
        description: Log users out of Keycloak when they log out of Automation Orchestrator.
        type: bool
        default: true
      automation_orchestrator_oidc_force_update:
        description: PATCH the identity provider even when unchanged (e.g. to push a rotated client secret).
        type: bool
        default: false
      automation_orchestrator_oidc_allow_private_networks:
        description: Set APP_OIDC_ALLOW_PRIVATE_NETWORKS=true on the backend Deployment.
        type: bool
        default: true
      automation_orchestrator_oidc_no_log:
        description: Set to false to expose secret values in task output. Never set false in shared environments.
        type: bool
        default: true