---
- name: "🔎 Check if Keycloak OAuth provider exists"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/select/keycloak/provider-id.sql"
expect_rows: true
register: oauth_check
- name: "🔄 Update existing Keycloak OAuth provider"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/update/keycloak-provider.sql"
named_args:
auth_endpoint: "{{ ODOO_OIDC_AUTHORIZE_URL }}"
userinfo_endpoint: "{{ ODOO_OIDC_USERINFO_URL }}"
client_id: "{{ ODOO_OIDC_CLIENT_ID }}"
when: oauth_check.rows | length > 0
- name: "📁 Create new Keycloak OAuth provider"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/insert/keycloak-provider.sql"
named_args:
auth_endpoint: "{{ ODOO_OIDC_AUTHORIZE_URL }}"
userinfo_endpoint: "{{ ODOO_OIDC_USERINFO_URL }}"
client_id: "{{ ODOO_OIDC_CLIENT_ID }}"
when: oauth_check.rows | length == 0
- name: "🟢 Enable OAuth authentication in system parameters"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
named_args:
key: "auth_oauth.oauth_providers"
value: "True"
- name: "🟢 Enable OAuth signup (allow user creation on first OAuth login)"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
named_args:
key: "auth_signup.invitation_scope"
value: "b2c"
- name: "🔑 Allow uninvited OAuth signup on website"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/update/website-uninvited-b2c.sql"
- name: "🔎 Check if OAuth template user exists"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/select/oauth-template-user.sql"
expect_rows: true
register: oauth_template_check
- name: "📁 Create the OAuth template partner and user"
when: oauth_template_check.rows | length == 0
block:
- name: "📁 Create OAuth template partner"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/insert/oauth-template/partner.sql"
expect_rows: true
register: oauth_template_partner
- name: "📁 Create OAuth template user"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/insert/oauth-template/user.sql"
named_args:
partner_id: "{{ oauth_template_partner.rows[0][0] | int }}"
register: oauth_template_user
when:
- oauth_template_partner.rows is defined
- oauth_template_partner.rows | length > 0
- name: "✅ Ensure OAuth template user is active"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/update/activate-oauth-template.sql"
- name: "🔐 Grant Internal User group to OAuth template"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/grant/internal-user-to-oauth/template.sql"
- name: "🔐 Grant company access to OAuth template"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/grant/company-to-oauth/template.sql"
- name: "🔧 Set OAuth template user for signup (base.template_portal_user_id)"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter-template-user-id.sql"
named_args:
key: "base.template_portal_user_id"
- name: "🔧 Set OAuth template user for signup (auth_signup.template_user_id)"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter-template-user-id.sql"
named_args:
key: "auth_signup.template_user_id"
- name: "🔑 Use Authorization header for OAuth token validation"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
named_args:
key: "auth_oauth.authorization_header"
value: "True"
- name: "🔧 Set web.base.url for HTTPS redirects"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
named_args:
key: "web.base.url"
value: "{{ ODOO_URL }}"
- name: "🧊 Freeze web.base.url to prevent automatic detection"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
named_args:
key: "web.base.url.freeze"
value: "True"
- name: "🔐 Grant Internal User group to OAuth-created users"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/grant/internal-user-to-oauth/users-repair.sql"
- name: "⬇️ Get Keycloak OAuth provider id in Odoo"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc/select/keycloak/provider-id.sql"
expect_rows: true
register: keycloak_provider
- name: "🔗 Link the administrator to the Keycloak OAuth provider"
ansible.builtin.include_tasks: 05_oidc/keycloak_link.yml
when: keycloak_provider.rows | length > 0
