ansible-middleware / ansible-middleware/keycloak
keycloak_identity_provider: add support for "Do not store users" from transient-users feature
- Dominant language
- Python
- Stars
- 136
- Forks
- 74
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 21
Description
##### SUMMARY
Since at least KC 23, there has been support for an experimental feature "transient-users" which allows the configuration of an Identity Provider to NOT store a user in the database when logging in with a social provider. This feature is essential in keeping Keycloak clean from unnecessary account creation when using other providers and EU regulations as far as I understand.
The transient-user features adds a "Do not store users" option to any Identity Provider configuration ("doNotStoreUsers" in the json config). It'd be helpful to have that as an optional parameter under the `config` dictionary.
Example:
```
- name: Create OIDC identity provider, with well-known configuration URL
middleware_automation.keycloak.keycloak_identity_provider:
state: present
auth_keycloak_url: https://auth.example.com
auth_realm: master
auth_username: admin
auth_password: admin
realm: myrealm
alias: oidc-idp
display_name: OpenID Connect IdP
enabled: true
provider_id: oidc
config:
fromUrl: https://the-idp.example.com/realms/idprealm/.well-known/openid-configuration
clientAuthMethod: client_secret_post
clientId: my-client
clientSecret: secret
doNotStoreUser: true
```
##### ISSUE TYPE
- Feature Idea
Contributor guide
Assessment
This issue has not been assessed yet.