ansible-middleware / ansible-middleware/keycloak

keycloak_identity_provider: add support for "Do not store users" from transient-users feature

Open
#391 0 comments 0 reactions 1 assignee Claimed by @RanabirChakraborty View on GitHub
Dominant language
Python
Stars
136
Forks
74
Avg merge
3d 2h
Merged PRs (30d)
21

Description

##### SUMMARY
Since at least KC 23, there has been support for an experimental feature "transient-users" which allows the configuration of an Identity Provider to NOT store a user in the database when logging in with a social provider. This feature is essential in keeping Keycloak clean from unnecessary account creation when using other providers and EU regulations as far as I understand.

The transient-user features adds a "Do not store users" option to any Identity Provider configuration ("doNotStoreUsers" in the json config). It'd be helpful to have that as an optional parameter under the `config` dictionary.

Example:
```
- name: Create OIDC identity provider, with well-known configuration URL
middleware_automation.keycloak.keycloak_identity_provider:
state: present
auth_keycloak_url: https://auth.example.com
auth_realm: master
auth_username: admin
auth_password: admin
realm: myrealm
alias: oidc-idp
display_name: OpenID Connect IdP
enabled: true
provider_id: oidc
config:
fromUrl: https://the-idp.example.com/realms/idprealm/.well-known/openid-configuration
clientAuthMethod: client_secret_post
clientId: my-client
clientSecret: secret
doNotStoreUser: true
```

##### ISSUE TYPE
- Feature Idea

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.