From 51896a97f4a276f4403d889a64372992862d81f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thorben=20G=C3=BCnther?= Date: Sun, 27 Jun 2021 17:15:50 +0200 Subject: [PATCH] keycloak: Use keycloak as SSO solution --- group_vars/all/vars.yml | 3 + group_vars/all/vault_keycloak.yml | 15 + roles/keycloak/files/keycloak.conf | 17 + roles/keycloak/handlers/main.yml | 5 + roles/keycloak/tasks/main.yml | 50 ++ roles/keycloak/templates/standalone.xml.j2 | 610 +++++++++++++++++++++ 6 files changed, 700 insertions(+) create mode 100644 group_vars/all/vault_keycloak.yml create mode 100644 roles/keycloak/files/keycloak.conf create mode 100644 roles/keycloak/handlers/main.yml create mode 100644 roles/keycloak/tasks/main.yml create mode 100644 roles/keycloak/templates/standalone.xml.j2 diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index cf67bb6..9d16876 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -6,6 +6,9 @@ ejabberd_xenrox_password: "{{ vault_ejabberd_xenrox_password }}" email_noreply_mail: "{{ vault_email_noreply_mail }}" email_noreply_password: "{{ vault_email_noreply_password }}" faceit_bearer: "{{ vault_faceit_bearer }}" +keycloak_admin_password: "{{ vault_keycloak_admin_password }}" +keycloak_admin_username: "{{ vault_keycloak_admin_username }}" +keycloak_psql_password: "{{ vault_keycloak_psql_password }}" minio_access_key: "{{ vault_minio_access_key }}" minio_secret_key: "{{ vault_minio_secret_key }}" nextcloud_instanceid: "{{ vault_nextcloud_instanceid }}" diff --git a/group_vars/all/vault_keycloak.yml b/group_vars/all/vault_keycloak.yml new file mode 100644 index 0000000..96f1019 --- /dev/null +++ b/group_vars/all/vault_keycloak.yml @@ -0,0 +1,15 @@ +$ANSIBLE_VAULT;1.1;AES256 +38313064616364626636393963633236306364396163323934333664326661363830633431353766 +3138613238666232303130363564366333313661623834330a663530633037333035653463343861 +61336431636364653966346439313830633732666436356238366433313034343531303566366531 +3934396432333963320a616539666666326164363634306334323262663533646233646635346133 +36623333363766373562383834366133363634393563343438353735643932653663633837333564 +37366364633766616138393661656433643837626230323332356264343935356139366333623230 +65343264383266343032393163643761306238653135353962633663323239396162623262353366 +66646534333834373166613561633166323163323435663263616565623134306430393931643163 +38303231383966663231306461653965636435326163393732663861623134303734353434623864 +36616333613862636264626337343537643739666231356365616337376162363131383734616233 +38646537663763616339626131353536613061643061636130356565633536313566653061353832 +64373333613536643366633362393335646366653435323761636466306364376364386365656364 +37656232383463393761373764303064646132646463323933323735346135356664626236666135 +3166633466313461326535646230656562343439373337636462 diff --git a/roles/keycloak/files/keycloak.conf b/roles/keycloak/files/keycloak.conf new file mode 100644 index 0000000..86f0b90 --- /dev/null +++ b/roles/keycloak/files/keycloak.conf @@ -0,0 +1,17 @@ +server { + include /etc/nginx/snippets/http.conf; + server_name keycloak.xenrox.net; +} + +server { + include /etc/nginx/snippets/https.conf; + server_name keycloak.xenrox.net; + + location / { + proxy_pass https://127.0.0.1:8444; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/roles/keycloak/handlers/main.yml b/roles/keycloak/handlers/main.yml new file mode 100644 index 0000000..d905536 --- /dev/null +++ b/roles/keycloak/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Restart keycloak + ansible.builtin.systemd: + name: keycloak + state: restarted diff --git a/roles/keycloak/tasks/main.yml b/roles/keycloak/tasks/main.yml new file mode 100644 index 0000000..62ae306 --- /dev/null +++ b/roles/keycloak/tasks/main.yml @@ -0,0 +1,50 @@ +--- +- name: Install + community.general.pacman: + name: keycloak + state: present + +- name: Create db user + community.general.postgresql_user: + name: keycloak + password: "{{ keycloak_psql_password }}" + become: true + become_user: postgres + no_log: true + +- name: Create db + community.general.postgresql_db: + db: keycloak + owner: keycloak + become: true + become_user: postgres + register: keycloak_db + +- name: Configure + ansible.builtin.template: + src: standalone.xml.j2 + dest: /etc/keycloak/standalone.xml + owner: keycloak + group: keycloak + mode: 0600 + notify: Restart keycloak + +- name: Create admin user + ansible.builtin.command: /opt/keycloak/bin/add-user-keycloak.sh -r master -u {{ keycloak_admin_username }} -p {{ keycloak_admin_password }} + no_log: true + when: keycloak_db.changed + +- name: Start and enable + ansible.builtin.systemd: + name: keycloak + enabled: true + state: started + +- name: Copy nginx conf + ansible.builtin.copy: + src: keycloak.conf + dest: /etc/nginx/nginx.d/keycloak.conf + owner: root + group: root + mode: 0644 + notify: restart nginx diff --git a/roles/keycloak/templates/standalone.xml.j2 b/roles/keycloak/templates/standalone.xml.j2 new file mode 100644 index 0000000..f24b029 --- /dev/null +++ b/roles/keycloak/templates/standalone.xml.j2 @@ -0,0 +1,610 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + jdbc:postgresql://localhost:5432/keycloak + postgresql + + keycloak + {{ keycloak_psql_password }} + + + + + org.postgresql.xa.PGXADataSource + + + org.h2.jdbcx.JdbcDataSource + + + + + + + + + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + auth + + + classpath:${jboss.home.dir}/providers/* + + + master + 900 + + 2592000 + true + true + ${jboss.home.dir}/themes + + + + + + + + + + + + + jpa + + + basic + + + + + + + + + + + + + + + + + + + default + + + + + + + + ${keycloak.jta.lookup.provider:jboss} + + + + + + + + + + + ${keycloak.x509cert.lookup.provider:default} + + + + default + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -- 2.44.0