100 lines
4.3 KiB
YAML
100 lines
4.3 KiB
YAML
---
|
|
argument_specs:
|
|
main:
|
|
short_description: Configure Keycloak OIDC login for Automation Orchestrator
|
|
description:
|
|
- Creates a confidential OIDC client (with a "groups" claim mapper) and the mapped groups
|
|
in Keycloak, then registers Keycloak as an identity provider in Automation Orchestrator
|
|
via its REST API, mapping Keycloak groups to AO built-in groups.
|
|
- The client secret is read back from Keycloak on each run, so it is not stored elsewhere.
|
|
- >-
|
|
Sets APP_OIDC_ALLOW_PRIVATE_NETWORKS on the backend Deployment, since the
|
|
AutomationOrchestrator CR has no field for it and the backend otherwise rejects
|
|
issuers resolving to private IPs.
|
|
options:
|
|
automation_orchestrator_oidc_namespace:
|
|
description: Namespace of the AutomationOrchestrator instance.
|
|
type: str
|
|
default: automation-orchestrator
|
|
automation_orchestrator_oidc_instance_name:
|
|
description: Name of the AutomationOrchestrator CR (prefix of its Route, Deployments and Secrets).
|
|
type: str
|
|
default: automation-orchestrator
|
|
automation_orchestrator_oidc_url:
|
|
description: Public base URL of Automation Orchestrator. Empty derives it from the instance Route.
|
|
type: str
|
|
default: ""
|
|
automation_orchestrator_oidc_admin_user:
|
|
description: Local AO admin used to call the API (password read from the initial-admin-password Secret).
|
|
type: str
|
|
default: admin
|
|
automation_orchestrator_oidc_validate_certs:
|
|
description: Verify TLS when calling the AO API.
|
|
type: bool
|
|
default: true
|
|
automation_orchestrator_oidc_keycloak_url:
|
|
description: Keycloak base URL (e.g. https://auth.example.com).
|
|
type: str
|
|
required: true
|
|
automation_orchestrator_oidc_keycloak_realm:
|
|
description: Keycloak realm holding the client and groups.
|
|
type: str
|
|
required: true
|
|
automation_orchestrator_oidc_keycloak_admin_user:
|
|
description: Keycloak master-realm admin username.
|
|
type: str
|
|
required: true
|
|
automation_orchestrator_oidc_keycloak_admin_password:
|
|
description: Keycloak master-realm admin password.
|
|
type: str
|
|
required: true
|
|
no_log: true
|
|
automation_orchestrator_oidc_keycloak_validate_certs:
|
|
description: Verify TLS when calling the Keycloak admin API.
|
|
type: bool
|
|
default: true
|
|
automation_orchestrator_oidc_client_id:
|
|
description: Keycloak client ID for Automation Orchestrator.
|
|
type: str
|
|
default: automation-orchestrator
|
|
automation_orchestrator_oidc_create_keycloak_groups:
|
|
description: Create the Keycloak groups named in group_mappings. Group membership is managed in Keycloak.
|
|
type: bool
|
|
default: true
|
|
automation_orchestrator_oidc_provider_name:
|
|
description: Name of the identity provider in Automation Orchestrator (shown on the login page).
|
|
type: str
|
|
default: Keycloak
|
|
automation_orchestrator_oidc_group_mappings:
|
|
description: >-
|
|
Keycloak group to AO built-in group mappings. Users in no mapped group are refused login.
|
|
type: list
|
|
elements: dict
|
|
required: true
|
|
options:
|
|
idp_group:
|
|
description: Keycloak group name, as emitted in the "groups" claim.
|
|
type: str
|
|
required: true
|
|
group:
|
|
description: AO built-in group.
|
|
type: str
|
|
required: true
|
|
choices: [admins, auditors, users]
|
|
automation_orchestrator_oidc_rp_initiated_logout:
|
|
description: Log users out of Keycloak when they log out of Automation Orchestrator.
|
|
type: bool
|
|
default: true
|
|
automation_orchestrator_oidc_force_update:
|
|
description: PATCH the identity provider even when unchanged (e.g. to push a rotated client secret).
|
|
type: bool
|
|
default: false
|
|
automation_orchestrator_oidc_allow_private_networks:
|
|
description: Set APP_OIDC_ALLOW_PRIVATE_NETWORKS=true on the backend Deployment.
|
|
type: bool
|
|
default: true
|
|
automation_orchestrator_oidc_no_log:
|
|
description: Set to false to expose secret values in task output. Never set false in shared environments.
|
|
type: bool
|
|
default: true
|