Install Keycloak using default `h2` database storage.
```puppet
class { 'keycloak': }
```
Install a specific version of Keycloak.
```puppet
class { 'keycloak':
version => '6.0.1',
datasource_driver => 'mysql',
}
```
Upgrading Keycloak version works by changing `version` parameter as long as the `datasource_driver` is not the default of `h2`. An upgrade involves installing the new version without touching the old version, updating the symlink which defaults to `/opt/keycloak`, applying all changes to new version and then restarting the `keycloak` service.
If the previous `version` was `6.0.1` using the following will upgrade to `7.0.0`:
```puppet
class { 'keycloak':
version => '7.0.0',
datasource_driver => 'mysql',
}
```
Install keycloak and use a local MySQL server for database storage
```puppet
include mysql::server
class { 'keycloak':
datasource_driver => 'mysql',
datasource_host => 'localhost',
datasource_port => 3306,
datasource_dbname => 'keycloak',
datasource_username => 'keycloak',
datasource_password => 'foobar',
}
```
The following example can be used to configure keycloak with a local PostgreSQL server.
```puppet
include postgresql::server
class { 'keycloak':
datasource_driver => 'postgresql',
datasource_host => 'localhost',
datasource_port => 5432,
datasource_dbname => 'keycloak',
datasource_username => 'keycloak',
datasource_password => 'foobar',
}
```
Configure a SSL certificate truststore and add a LDAP server's certificate to the truststore.
Setup a host for theme development so that theme changes don't require a service restart, not recommended for production.
```puppet
class { 'keycloak':
theme_static_max_age => -1,
theme_cache_themes => false,
theme_cache_templates => false,
}
```
-Run Keycloak using standalone clustered mode:
+Run Keycloak using standalone clustered mode (multicast):
```puppet
class { 'keycloak':
operating_mode => 'clustered',
}
```
+Run Keycloak using standalone clustered mode (JDBC_PING):
+
+> [JDBC_PING](http://jgroups.org/manual/#_jdbc_ping) uses port **7600** to ensure cluster members are discoverable by each other. This module **does NOT manage firewall changes**.
before => Keycloak_flow_execution['duo-mfa-authenticator under form-browser-with-duo on test'],
}
```
### keycloak_realm
Define a Keycloak realm that uses username and not email for login and to use a local branded theme.
```puppet
keycloak_realm { 'test':
ensure => 'present',
remember_me => true,
login_with_email_allowed => false,
login_theme => 'my_theme',
}
```
**NOTE:** If the flow properties such as `browser_flow` are changed from their defaults then this value will not be set when a realm is first created. The value will also not be updated if the flow does not exist. For new realms you will have to run Puppet twice in order to create the flows then update the realm setting.
### keycloak\_ldap\_user_provider
Define a LDAP user provider so that authentication can be performed against LDAP. The example below uses two LDAP servers, disables importing of users and assumes the SSL certificates are trusted and do not require being in the truststore.
**NOTE** The `Id` for the above resource would be `LDAP-test` where the format is `${resource_name}-${realm}`.
### keycloak\_ldap_mapper
Use the LDAP attribute 'gecos' as the full name attribute.
```puppet
keycloak_ldap_mapper { 'full name for LDAP-test on test:
ensure => 'present',
resource_name => 'full name',
type => 'full-name-ldap-mapper',
ldap_attribute => 'gecos',
}
```
### keycloak\_sssd\_user\_provider
Define SSSD user provider. **NOTE** This type requires that SSSD be properly configured and Keycloak service restarted after SSSD ifp service is setup. Also requires `keycloak` class be called with `with_sssd_support` set to `true`.
```puppet
keycloak_sssd_user_provider { 'SSSD on test':
ensure => 'present',
}
```
### keycloak_client
Register a client.
```puppet
keycloak_client { 'www.example.com':
ensure => 'present',
realm => 'test',
redirect_uris => [
"https://www.example.com/oidc",
"https://www.example.com",
],
client_template => 'oidc-clients',
secret => 'supersecret',
}
```
### keycloak::client_scope::oidc
Defined type that can be used to define both `keycloak_client_scope` and `keycloak_protocol_mapper` resources for OpenID Connect.
```puppet
keycloak::client_scope::oidc { 'oidc-clients':
realm => 'test',
}
```
### keycloak::client_scope::saml
Defined type that can be used to define both `keycloak_client_scope` and `keycloak_protocol_mapper` resources for SAML.
```puppet
keycloak::client_scope::saml { 'saml-clients':
realm => 'test',
}
```
### keycloak\_client_scope
Define a Client Scope of `email` for realm `test` in Keycloak:
```puppet
keycloak_client_scope { 'email on test':
protocol => 'openid-connect',
}
```
### keycloak\_protocol_mapper
Associate a Protocol Mapper to a given Client Scope. The name in the following example will add the `email` protocol mapper to client scope `oidc-email` in the realm `test`.
```puppet
keycloak_protocol_mapper { "email for oidc-email on test":
claim_name => 'email',
user_attribute => 'email',
}
```
### keycloak\_client\_protocol\_mapper
Add `email` protocol mapper to `test.example.com` client in realm `test`
```puppet
keycloak_client_protocol_mapper { "email for test.example.com on test":
The following is an example of deploying a custom Flow.
The name for the top level flow is `$alias on $realm`
The name for an execution is `$provider under $flow on $realm`.
The name for the flow under a top level flow is `$alias under $flow_alias on $realm`.
```puppet
keycloak_flow { 'browser-with-duo on test':
ensure => 'present',
}
keycloak_flow_execution { 'auth-cookie under browser-with-duo on test':
ensure => 'present',
configurable => false,
display_name => 'Cookie',
index => 0,
requirement => 'ALTERNATIVE',
}
keycloak_flow_execution { 'identity-provider-redirector under browser-with-duo on test':
ensure => 'present',
configurable => true,
display_name => 'Identity Provider Redirector',
index => 1,
requirement => 'ALTERNATIVE',
}
keycloak_flow { 'form-browser-with-duo under browser-with-duo on test':
ensure => 'present',
index => 2,
requirement => 'ALTERNATIVE',
top_level => false,
}
keycloak_flow_execution { 'auth-username-password-form under form-browser-with-duo on test':
ensure => 'present',
configurable => false,
display_name => 'Username Password Form',
index => 0,
requirement => 'REQUIRED',
}
keycloak_flow_execution { 'duo-mfa-authenticator under form-browser-with-duo on test':
ensure => 'present',
configurable => true,
display_name => 'Duo MFA',
alias => 'Duo',
config => {
"duomfa.akey" => "foo-akey",
"duomfa.apihost" => "api-foo.duosecurity.com",
"duomfa.skey" => "secret",
"duomfa.ikey" => "foo-ikey",
"duomfa.groups" => "duo"
},
requirement => 'REQUIRED',
index => 1,
}
```
### keycloak\_api
The keycloak_api type can be used to define how this module's types access the Keycloak API if this module is only used for the types/providers and the module's `kcadm-wrapper.sh` is not installed.
```puppet
keycloak_api { 'keycloak'
install_dir => '/opt/keycloak',
server => 'http://localhost:8080/auth',
realm => 'master',
user => 'admin',
password => 'changeme',
}
```
The path for `install_dir` will be joined with `bin/kcadm.sh` to produce the full path to `kcadm.sh`.