diff --git a/manifests/config.pp b/manifests/config.pp index 5224b5f..d81308b 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -1,94 +1,101 @@ # Private class. class keycloak::config { assert_private() file { '/opt/keycloak': ensure => 'link', target => $keycloak::install_base, } # Template uses: # - $keycloak::install_base # - $keycloak::admin_user # - $keycloak::admin_user_password file { 'kcadm-wrapper.sh': ensure => 'file', path => "${keycloak::install_base}/bin/kcadm-wrapper.sh", owner => $keycloak::user, group => $keycloak::group, mode => '0750', content => template('keycloak/kcadm-wrapper.sh.erb'), show_diff => false, } $_add_user_keycloak_cmd = "${keycloak::install_base}/bin/add-user-keycloak.sh" $_add_user_keycloak_args = "--user ${keycloak::admin_user} --password ${keycloak::admin_user_password} --realm master" $_add_user_keycloak_state = "${keycloak::install_base}/.create-keycloak-admin-${keycloak::datasource_driver}" exec { 'create-keycloak-admin': command => "${_add_user_keycloak_cmd} ${_add_user_keycloak_args} && touch ${_add_user_keycloak_state}", creates => $_add_user_keycloak_state, notify => Class['keycloak::service'], } + file { "${keycloak::install_base}/tmp": + ensure => 'directory', + owner => $keycloak::user, + group => $keycloak::group, + mode => '0755', + } + file { "${keycloak::install_base}/standalone/configuration": ensure => 'directory', owner => $keycloak::user, group => $keycloak::group, mode => '0750', } file { "${keycloak::install_base}/standalone/configuration/profile.properties": ensure => 'file', owner => $keycloak::user, group => $keycloak::group, content => template('keycloak/profile.properties.erb'), mode => '0644', notify => Class['keycloak::service'], } file { "${keycloak::install_base}/config.cli": ensure => 'file', owner => $keycloak::user, group => $keycloak::group, mode => '0600', content => template('keycloak/config.cli.erb'), notify => Exec['jboss-cli.sh --file=config.cli'], show_diff => false, } exec { 'jboss-cli.sh --file=config.cli': command => "${keycloak::install_base}/bin/jboss-cli.sh --file=config.cli", cwd => $keycloak::install_base, user => $keycloak::user, group => $keycloak::group, refreshonly => true, logoutput => true, notify => Class['keycloak::service'], } create_resources('keycloak::truststore::host', $keycloak::truststore_hosts) if $keycloak::java_opts { $java_opts_ensure = 'present' } else { $java_opts_ensure = 'absent' } if $keycloak::java_opts =~ Array { $java_opts = join($keycloak::java_opts, ' ') } else { $java_opts = $keycloak::java_opts } if $keycloak::java_opts_append { $_java_opts = "\$JAVA_OPTS ${java_opts}" } else { $_java_opts = $java_opts } file_line { 'standalone.conf-JAVA_OPTS': ensure => $java_opts_ensure, path => "${keycloak::install_base}/bin/standalone.conf", line => "JAVA_OPTS=\"${_java_opts}\"", match => '^JAVA_OPTS=', notify => Class['keycloak::service'], } } diff --git a/manifests/init.pp b/manifests/init.pp index a7f2b70..a560fef 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,350 +1,359 @@ # @summary Manage Keycloak # # @example # include ::keycloak # # @param manage_install # Install Keycloak from upstream Keycloak tarball. # Set to false to manage installation of Keycloak outside # this module and set $install_dir to match. # Defaults to true. # @param version # Version of Keycloak to install and manage. # @param package_url # URL of the Keycloak download. # Default is based on version. # @param install_dir # The directory of where to install Keycloak. # Default is `/opt/keycloak-${version}`. # @param service_name # Keycloak service name. # Default is `keycloak`. # @param service_ensure # Keycloak service ensure property. # Default is `running`. # @param service_enable # Keycloak service enable property. # Default is `true`. # @param service_hasstatus # Keycloak service hasstatus parameter. # Default is `true`. # @param service_hasrestart # Keycloak service hasrestart parameter. # Default is `true`. # @param service_bind_address # Bind address for Keycloak service. # Default is '0.0.0.0'. # @param java_opts # Sets additional options to Java virtual machine environment variable. # @param java_opts_append # Determine if $JAVA_OPTS should be appended to when setting `java_opts` parameter # @param service_extra_opts # Additional options added to the end of the service command-line. # @param manage_user # Defines if the module should manage the Linux user for Keycloak installation # @param user # Keycloak user name. # Default is `keycloak`. # @param user_shell # Keycloak user shell. # @param group # Keycloak user group name. # Default is `keycloak`. # @param user_uid # Keycloak user UID. # Default is `undef`. # @param group_gid # Keycloak user group GID. # Default is `undef`. # @param admin_user # Keycloak administrative username. # Default is `admin`. # @param admin_user_password # Keycloak administrative user password. # Default is `changeme`. # @param manage_datasource # Boolean that determines if configured datasource will be managed. # Only applies when `datasource_driver` is `mysql`. # Default is `true`. # @param datasource_driver # Datasource driver to use for Keycloak. # Valid values are `h2`, `mysql`, 'oracle' and 'postgresql' # Default is `h2`. # @param datasource_host # Datasource host. # Only used when datasource_driver is `mysql`, 'oracle' or 'postgresql' # Default is `localhost` for MySQL. # @param datasource_port # Datasource port. # Only used when datasource_driver is `mysql`, 'oracle' or 'postgresql' # Default is `3306` for MySQL. # @param datasource_url # Datasource url. # Default datasource URLs are defined in init class. # @param datasource_dbname # Datasource database name. # Default is `keycloak`. # @param datasource_username # Datasource user name. # Default is `sa`. # @param datasource_password # Datasource user password. # Default is `sa`. # @param datasource_package # Package to add specified datasource support # @param datasource_jar_source # Source for datasource JDBC driver - could be puppet link or local file on the node. # Default is dependent on value for `datasource_driver`. # This parameter is required if `datasource_driver` is `oracle`. # @param datasource_module_source # Source for datasource module.xml. Default depends on `datasource_driver`. # @param datasource_xa_class # MySQL Connector/J JDBC driver xa-datasource class name # @param proxy_https # Boolean that sets if HTTPS proxy should be enabled. # Set to `true` if proxying traffic through Apache. # Default is `false`. # @param truststore # Boolean that sets if truststore should be used. # Default is `false`. # @param truststore_hosts # Hash that is used to define `keycloak::turststore::host` resources. # Default is `{}`. # @param truststore_password # Truststore password. # Default is `keycloak`. # @param truststore_hostname_verification_policy # Valid values are `WILDCARD`, `STRICT`, and `ANY`. # Default is `WILDCARD`. # @param http_port # HTTP port used by Keycloak. # Default is `8080`. # @param theme_static_max_age # Max cache age in seconds of static content. # Default is `2592000`. # @param theme_cache_themes # Boolean that sets if themes should be cached. # Default is `true`. # @param theme_cache_templates # Boolean that sets if templates should be cached. # Default is `true`. # @param realms # Hash that is used to define keycloak_realm resources. # Default is `{}`. # @param realms_merge # Boolean that sets if `realms` should be merged from Hiera. # @param oidc_client_scopes # Hash that is used to define keycloak::client_scope::oidc resources. # Default is `{}`. # @param oidc_client_scopes_merge # Boolean that sets if `oidc_client_scopes` should be merged from Hiera. # @param saml_client_scopes # Hash that is used to define keycloak::client_scope::saml resources. # Default is `{}`. # @param saml_client_scopes_merge # Boolean that sets if `saml_client_scopes` should be merged from Hiera. # @param identity_providers # Hash that is used to define keycloak_identity_provider resources. # @param identity_providers_merge # Boolean that sets if `identity_providers` should be merged from Hiera. # @param client_scopes # Hash that is used to define keycloak_client_scope resources. # @param client_scopes_merge # Boolean that sets if `client_scopes` should be merged from Hiera. # @param protocol_mappers # Hash that is used to define keycloak_protocol_mapper resources. # @param protocol_mappers_merge # Boolean that sets if `protocol_mappers` should be merged from Hiera. # @param clients # Hash that is used to define keycloak_client resources. # @param clients_merge # Boolean that sets if `clients` should be merged from Hiera. # @param with_sssd_support # Boolean that determines if SSSD user provider support should be available # @param libunix_dbus_java_source # Source URL of libunix-dbus-java # @param install_libunix_dbus_java_build_dependencies # Boolean that determines of libunix-dbus-java build dependencies are managed by this module # @param libunix_dbus_java_build_dependencies # Packages needed to build libunix-dbus-java # @param libunix_dbus_java_libdir # Path to directory to install libunix-dbus-java libraries # @param jna_package_name # Package name for jna # @param manage_sssd_config # Boolean that determines if SSSD ifp config for Keycloak is managed # @param sssd_ifp_user_attributes # user_attributes to define for SSSD ifp service # @param restart_sssd # Boolean that determines if SSSD should be restarted # @param service_environment_file # Path to the file with environment variables for the systemd service # @param operating_mode # Keycloak operating mode deployment # @param tech_preview_features # List of technology Preview features to enable +# @param auto_deploy_exploded +# Set if exploded deployements will be auto deployed +# @param auto_deploy_zipped +# Set if zipped deployments will be auto deployed +# @param spi_deployments +# Hash used to define keycloak::spi_deployment resources # class keycloak ( Boolean $manage_install = true, String $version = '8.0.1', Optional[Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl]] $package_url = undef, Optional[Stdlib::Absolutepath] $install_dir = undef, String $service_name = 'keycloak', String $service_ensure = 'running', Boolean $service_enable = true, Boolean $service_hasstatus = true, Boolean $service_hasrestart = true, Stdlib::IP::Address $service_bind_address = '0.0.0.0', Optional[Variant[String, Array]] $java_opts = undef, Boolean $java_opts_append = true, Optional[String] $service_extra_opts = undef, Boolean $manage_user = true, String $user = 'keycloak', Stdlib::Absolutepath $user_shell = '/sbin/nologin', String $group = 'keycloak', Optional[Integer] $user_uid = undef, Optional[Integer] $group_gid = undef, String $admin_user = 'admin', String $admin_user_password = 'changeme', Boolean $manage_datasource = true, Enum['h2', 'mysql', 'oracle', 'postgresql'] $datasource_driver = 'h2', Optional[String] $datasource_host = undef, Optional[Integer] $datasource_port = undef, Optional[String] $datasource_url = undef, Optional[String] $datasource_xa_class = undef, String $datasource_dbname = 'keycloak', String $datasource_username = 'sa', String $datasource_password = 'sa', Optional[String] $datasource_package = undef, Optional[String] $datasource_jar_source = undef, Optional[String] $datasource_module_source = undef, Boolean $proxy_https = false, Boolean $truststore = false, Hash $truststore_hosts = {}, String $truststore_password = 'keycloak', Enum['WILDCARD', 'STRICT', 'ANY'] $truststore_hostname_verification_policy = 'WILDCARD', Integer $http_port = 8080, Integer $theme_static_max_age = 2592000, Boolean $theme_cache_themes = true, Boolean $theme_cache_templates = true, Hash $realms = {}, Boolean $realms_merge = false, Hash $oidc_client_scopes = {}, Boolean $oidc_client_scopes_merge = false, Hash $saml_client_scopes = {}, Boolean $saml_client_scopes_merge = false, Hash $client_scopes = {}, Boolean $client_scopes_merge = false, Hash $protocol_mappers = {}, Boolean $protocol_mappers_merge = false, Hash $identity_providers = {}, Boolean $identity_providers_merge = false, Hash $clients = {}, Boolean $clients_merge = false, Boolean $with_sssd_support = false, Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl] $libunix_dbus_java_source = 'https://github.com/keycloak/libunix-dbus-java/archive/libunix-dbus-java-0.8.0.tar.gz', Boolean $install_libunix_dbus_java_build_dependencies = true, Array $libunix_dbus_java_build_dependencies = [], Stdlib::Absolutepath $libunix_dbus_java_libdir = '/usr/lib64', String $jna_package_name = 'jna', Boolean $manage_sssd_config = true, Array $sssd_ifp_user_attributes = [], Boolean $restart_sssd = true, Optional[Stdlib::Absolutepath] $service_environment_file = undef, Enum['standalone', 'clustered'] $operating_mode = 'standalone', Array $tech_preview_features = [], + Boolean $auto_deploy_exploded = false, + Boolean $auto_deploy_zipped = true, + Hash $spi_deployments = {}, ) { if ! ($facts['os']['family'] in ['RedHat','Debian']) { fail("Unsupported osfamily: ${facts['os']['family']}, module ${module_name} only support osfamilies Debian and Redhat") } $download_url = pick($package_url, "https://downloads.jboss.org/keycloak/${version}/keycloak-${version}.tar.gz") case $datasource_driver { 'h2': { $datasource_connection_url = pick($datasource_url, "jdbc:h2:\${jboss.server.data.dir}/${datasource_dbname};AUTO_SERVER=TRUE") } 'mysql': { $db_host = pick($datasource_host, 'localhost') $db_port = pick($datasource_port, 3306) $datasource_connection_url = pick($datasource_url, "jdbc:mysql://${db_host}:${db_port}/${datasource_dbname}") } 'oracle': { $db_host = pick($datasource_host, 'localhost') $db_port = pick($datasource_port, 1521) $datasource_connection_url = pick($datasource_url, "jdbc:oracle:thin:@${db_host}:${db_port}:${datasource_dbname}") } 'postgresql': { $db_host = pick($datasource_host, 'localhost') $db_port = pick($datasource_port, 5432) $datasource_connection_url = pick($datasource_url, "jdbc:postgresql://${db_host}:${db_port}/${datasource_dbname}") } default: {} } if ($datasource_driver == 'oracle') and ($datasource_jar_source == undef) { fail('Using Oracle RDBMS requires definition datasource_jar_source for Oracle JDBC driver. Refer to module documentation') } case $facts['os']['family'] { 'RedHat': { if versioncmp($facts['os']['release']['major'], '8') >= 0 { $mysql_datasource_class = pick($datasource_xa_class, 'org.mariadb.jdbc.MariaDbDataSource') $mysql_jar_source = '/usr/lib/java/mariadb-java-client.jar' $postgresql_jar_source = '/usr/share/java/postgresql-jdbc/postgresql.jar' } else { $mysql_datasource_class = pick($datasource_xa_class, 'com.mysql.jdbc.jdbc2.optional.MysqlXADataSource') $mysql_jar_source = '/usr/share/java/mysql-connector-java.jar' $postgresql_jar_source = '/usr/share/java/postgresql-jdbc.jar' } } 'Debian': { if $facts['os']['name'] == 'Debian' and versioncmp($facts['os']['release']['major'], '10') >= 0 { $mysql_datasource_class = pick($datasource_xa_class, 'org.mariadb.jdbc.MariaDbDataSource') $mysql_jar_source = '/usr/share/java/mariadb-java-client.jar' } else { $mysql_datasource_class = pick($datasource_xa_class, 'com.mysql.jdbc.jdbc2.optional.MysqlXADataSource') $mysql_jar_source = '/usr/share/java/mysql-connector-java.jar' } $postgresql_jar_source = '/usr/share/java/postgresql.jar' } default: { # do nothing } } $install_base = pick($install_dir, "/opt/keycloak-${keycloak::version}") include ::java contain 'keycloak::install' contain "keycloak::datasource::${datasource_driver}" contain 'keycloak::config' contain 'keycloak::service' Class['::java'] -> Class['keycloak::install'] -> Class["keycloak::datasource::${datasource_driver}"] -> Class['keycloak::config'] -> Class['keycloak::service'] Class["keycloak::datasource::${datasource_driver}"]~>Class['keycloak::service'] if $with_sssd_support { contain 'keycloak::sssd' Class['keycloak::sssd'] ~> Class['keycloak::service'] } keycloak_conn_validator { 'keycloak': keycloak_server => 'localhost', keycloak_port => $http_port, use_ssl => false, timeout => 60, test_url => '/auth/realms/master/.well-known/openid-configuration', require => Class['keycloak::service'], } include keycloak::resources } diff --git a/manifests/resources.pp b/manifests/resources.pp index 070656b..5d8e4aa 100644 --- a/manifests/resources.pp +++ b/manifests/resources.pp @@ -1,63 +1,66 @@ # @summary Define Keycloak resources # @api private class keycloak::resources { assert_private() if $keycloak::realms_merge { $realms = lookup('keycloak::realms', Hash, 'deep', {}) } else { $realms = $keycloak::realms } if $keycloak::oidc_client_scopes_merge { $oidc_client_scopes = lookup('keycloak::oidc_client_scopes', Hash, 'deep', {}) } else { $oidc_client_scopes = $keycloak::oidc_client_scopes } if $keycloak::saml_client_scopes_merge { $saml_client_scopes = lookup('keycloak::saml_client_scopes', Hash, 'deep', {}) } else { $saml_client_scopes = $keycloak::saml_client_scopes } if $keycloak::client_scopes_merge { $client_scopes = lookup('keycloak::client_scopes', Hash, 'deep', {}) } else { $client_scopes = $keycloak::client_scopes } if $keycloak::protocol_mappers_merge { $protocol_mappers = lookup('keycloak::protocol_mappers', Hash, 'deep', {}) } else { $protocol_mappers = $keycloak::protocol_mappers } if $keycloak::identity_providers_merge { $identity_providers = lookup('keycloak::identity_providers', Hash, 'deep', {}) } else { $identity_providers = $keycloak::identity_providers } if $keycloak::clients_merge { $clients = lookup('keycloak::clients', Hash, 'deep', {}) } else { $clients = $keycloak::clients } $realms.each |$name, $realm| { keycloak_realm { $name: * => $realm } } $oidc_client_scopes.each |$name, $scope| { keycloak::client_scope::oidc { $name: * => $scope } } $saml_client_scopes.each |$name, $scope| { keycloak::client_scope::saml { $name: * => $scope } } $client_scopes.each |$name, $client_scope| { keycloak_client_scope { $name: * => $client_scope } } $protocol_mappers.each |$name, $protocol_mapper| { keycloak_protocol_mapper { $name: * => $protocol_mapper } } $identity_providers.each |$name, $data| { keycloak_identity_provider { $name: * => $data } } $clients.each |$name, $data| { keycloak_client { $name: * => $data } } + $keycloak::spi_deployments.each |$name, $deployment| { + keycloak::spi_deployment { $name: * => $deployment } + } } \ No newline at end of file diff --git a/manifests/spi_deployment.pp b/manifests/spi_deployment.pp new file mode 100644 index 0000000..740ce51 --- /dev/null +++ b/manifests/spi_deployment.pp @@ -0,0 +1,73 @@ +# @summary Manage Keycloak SPI deployment +# +# @example +# keycloak::spi_deployment { 'duo-spi': +# ensure => 'present', +# deployed_name => 'keycloak-duo-spi-jar-with-dependencies.jar', +# source => 'file:///path/to/source/keycloak-duo-spi-jar-with-dependencies.jar', +# } +# +# @param ensure +# State of the deployment +# @param deployed_name +# Name of the file to be deployed. Defaults to `$name`. +# @param source +# Source of the deployment, supports 'file://', 'puppet://', 'https://' or 'http://' +# +define keycloak::spi_deployment ( + Variant[Stdlib::Filesource, Stdlib::HTTPSUrl] $source, + Enum['present', 'absent'] $ensure = 'present', + String[1] $deployed_name = $name, +) { + include keycloak + + $dir = "${keycloak::install_base}/standalone/deployments" + $basename = basename($source) + $dest = "${dir}/${deployed_name}" + $tmp = "${keycloak::install_base}/tmp/${basename}" + $dodeploy = "${dest}.dodeploy" + $deployed = "${dest}.deployed" + + if $ensure == 'present' { + if $source =~ Stdlib::HTTPUrl or $source =~ Stdlib::HTTPSUrl { + $_source = $tmp + archive { $name: + ensure => 'present', + extract => false, + path => $tmp, + source => $source, + creates => $tmp, + cleanup => false, + user => $keycloak::user, + group => $keycloak::group, + require => File["${keycloak::install_base}/tmp"], + before => File[$dest], + } + } else { + $_source = $source + } + file { $dest: + ensure => 'file', + source => $_source, + owner => $keycloak::user, + group => $keycloak::group, + mode => '0644', + require => Class['keycloak::install'], + notify => Exec["${name}-dodeploy"], + } + exec { "${name}-dodeploy": + path => '/usr/bin:/bin:/usr/sbin:/sbin', + command => "touch ${dodeploy}", + refreshonly => true, + user => $keycloak::user, + group => $keycloak::group, + } + } + + if $ensure == 'absent' { + file { $deployed: + ensure => 'absent', + } + } + +} diff --git a/spec/defines/spi_deployment_spec.rb b/spec/defines/spi_deployment_spec.rb new file mode 100644 index 0000000..57e02e4 --- /dev/null +++ b/spec/defines/spi_deployment_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +describe 'keycloak::spi_deployment' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge(concat_basedir: '/dne') + end + let(:version) { '8.0.1' } + let(:title) { 'duo-spi' } + let(:params) { { deployed_name: 'keycloak-duo-spi-jar-with-dependencies.jar', source: 'https://example.com/files/keycloak-duo-spi-jar-with-dependencies.jar' } } + + it do + is_expected.to contain_archive('duo-spi').with( + ensure: 'present', + extract: 'false', + path: "/opt/keycloak-#{version}/tmp/keycloak-duo-spi-jar-with-dependencies.jar", + source: 'https://example.com/files/keycloak-duo-spi-jar-with-dependencies.jar', + creates: "/opt/keycloak-#{version}/tmp/keycloak-duo-spi-jar-with-dependencies.jar", + user: 'keycloak', + group: 'keycloak', + require: "File[/opt/keycloak-#{version}/tmp]", + before: "File[/opt/keycloak-#{version}/standalone/deployments/keycloak-duo-spi-jar-with-dependencies.jar]", + ) + end + + it do + is_expected.to contain_file("/opt/keycloak-#{version}/standalone/deployments/keycloak-duo-spi-jar-with-dependencies.jar").with( + ensure: 'file', + source: "/opt/keycloak-#{version}/tmp/keycloak-duo-spi-jar-with-dependencies.jar", + owner: 'keycloak', + group: 'keycloak', + mode: '0644', + require: 'Class[Keycloak::Install]', + notify: 'Exec[duo-spi-dodeploy]', + ) + end + + it do + is_expected.to contain_exec('duo-spi-dodeploy').with( + path: '/usr/bin:/bin:/usr/sbin:/sbin', + command: "touch /opt/keycloak-#{version}/standalone/deployments/keycloak-duo-spi-jar-with-dependencies.jar.dodeploy", + refreshonly: 'true', + user: 'keycloak', + group: 'keycloak', + ) + end + end + end +end diff --git a/templates/config.cli.erb b/templates/config.cli.erb index f9beb95..2335618 100644 --- a/templates/config.cli.erb +++ b/templates/config.cli.erb @@ -1,77 +1,79 @@ <% if scope['keycloak::operating_mode'] == 'standalone'-%> embed-server <% elsif scope['keycloak::operating_mode'] == 'clustered'-%> embed-server --server-config=standalone-ha.xml <% end -%> <%- if scope['keycloak::proxy_https'] -%> if (result.proxy-address-forwarding != true) of /subsystem=undertow/server=default-server/http-listener=default:read-resource /subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding,value=true) end-if if (outcome != success) of /socket-binding-group=standard-sockets/socket-binding=proxy-https:read-resource /socket-binding-group=standard-sockets/socket-binding=proxy-https:add(port=443) end-if if (result.redirect-socket != proxy-https) of /subsystem=undertow/server=default-server/http-listener=default:read-resource /subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket,value=proxy-https) end-if <%- end -%> /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=driver-name, value=<%= scope['keycloak::datasource_driver'] %>) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=connection-url, value="<%= scope['keycloak::datasource_connection_url'] %>") /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=jndi-name, value=java:jboss/datasources/KeycloakDS) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=user-name, value=<%= scope['keycloak::datasource_username'] %>) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=password, value=<%= scope['keycloak::datasource_password'] %>) <%- if scope['keycloak::datasource_driver'] == 'mysql' -%> /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation, value=true) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=check-valid-connection-sql, value="SELECT 1") /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation-millis, value=60000) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=flush-strategy, value=IdleConnections) try /subsystem=datasources/jdbc-driver=mysql:add(driver-module-name=com.mysql.jdbc,driver-name=mysql,driver-xa-datasource-class-name=<%= scope['keycloak::mysql_datasource_class'] %>) catch /subsystem=datasources/jdbc-driver=mysql:remove /subsystem=datasources/jdbc-driver=mysql:add(driver-module-name=com.mysql.jdbc,driver-name=mysql,driver-xa-datasource-class-name=<%= scope['keycloak::mysql_datasource_class'] %>) end-try <%- elsif scope['keycloak::datasource_driver'] == 'h2' -%> /subsystem=datasources/data-source=KeycloakDS:undefine-attribute(name=background-validation) /subsystem=datasources/data-source=KeycloakDS:undefine-attribute(name=check-valid-connection-sql) /subsystem=datasources/data-source=KeycloakDS:undefine-attribute(name=background-validation-millis) /subsystem=datasources/data-source=KeycloakDS:undefine-attribute(name=flush-strategy) <%- elsif scope['keycloak::datasource_driver'] == 'oracle' -%> /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation, value=true) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=check-valid-connection-sql, value="SELECT 1 FROM DUAL") /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation-millis, value=60000) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=flush-strategy, value=IdleConnections) try /subsystem=datasources/jdbc-driver=oracle:add(driver-module-name=org.oracle,driver-name=oracle,driver-xa-datasource-class-name=oracle.jdbc.xa.client.OracleXADataSource) catch /subsystem=datasources/jdbc-driver=oracle:remove /subsystem=datasources/jdbc-driver=oracle:add(driver-module-name=org.oracle,driver-name=oracle,driver-xa-datasource-class-name=oracle.jdbc.xa.client.OracleXADataSource) end-try <%- elsif scope['keycloak::datasource_driver'] == 'postgresql' -%> /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation, value=true) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=check-valid-connection-sql, value="SELECT 1") /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=background-validation-millis, value=60000) /subsystem=datasources/data-source=KeycloakDS:write-attribute(name=flush-strategy, value=IdleConnections) try /subsystem=datasources/jdbc-driver=postgresql:add(driver-module-name=org.postgresql,driver-name=postgresql,driver-xa-datasource-class-name=org.postgresql.xa.PGXADataSource) catch /subsystem=datasources/jdbc-driver=postgresql:remove /subsystem=datasources/jdbc-driver=postgresql:add(driver-module-name=org.postgresql,driver-name=postgresql,driver-xa-datasource-class-name=org.postgresql.xa.PGXADataSource) end-try <%- end -%> <%- if scope['keycloak::truststore'] -%> if (outcome != success) of /subsystem=keycloak-server/spi=truststore:read-resource /subsystem=keycloak-server/spi=truststore/:add /subsystem=keycloak-server/spi=truststore/provider=file/:add(enabled=true) end-if /subsystem=keycloak-server/spi=truststore/provider=file/:map-put(name=properties,key=file,value=<%= scope['keycloak::install_base'] %>/standalone/configuration/truststore.jks) /subsystem=keycloak-server/spi=truststore/provider=file/:map-put(name=properties,key=password,value=<%= scope['keycloak::truststore_password'] %>) /subsystem=keycloak-server/spi=truststore/provider=file/:map-put(name=properties,key=hostname-verification-policy,value=<%= scope['keycloak::truststore_hostname_verification_policy'] %>) /subsystem=keycloak-server/spi=truststore/provider=file/:map-put(name=properties,key=disabled,value=false) <%- else -%> if (outcome == success) of /subsystem=keycloak-server/spi=truststore:read-resource /subsystem=keycloak-server/spi=truststore/:remove end-if <%- end -%> /subsystem=keycloak-server/theme=defaults/:write-attribute(name=staticMaxAge, value=<%= scope['keycloak::theme_static_max_age'] %>) /subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheThemes, value=<%= scope['keycloak::theme_cache_themes'] %>) /subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheTemplates, value=<%= scope['keycloak::theme_cache_templates'] %>) +/subsystem=deployment-scanner/scanner=default:write-attribute(name="auto-deploy-exploded",value=<%= scope['keycloak::auto_deploy_exploded'] %>) +/subsystem=deployment-scanner/scanner=default:write-attribute(name="auto-deploy-zipped",value=<%= scope['keycloak::auto_deploy_zipped'] %>)