---
# Param: openbao_group - one entry of the registered group-id loop (item = role name, stdout = group id)
# Param: alias_mount - auth mount path, e.g. "oidc/" or "ldap/"
# Param: alias_name - identity-provider group name the claim will carry
- name: "🔍 Read the existing alias of identity group '{{ openbao_group.item }}'"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao read -format=json identity/group/id/{{ openbao_group.stdout | trim | quote }}
register: openbao_group_read
changed_when: false
- name: "🔗 Create the group alias '{{ alias_name }}' on mount '{{ alias_mount }}'"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao write identity/group-alias
name={{ alias_name | quote }}
mount_accessor={{ openbao_auth_mounts[alias_mount].accessor | quote }}
canonical_id={{ openbao_group.stdout | trim | quote }}
changed_when: true
when: >-
((openbao_group_read.stdout | from_json).data.alias | default({})).name | default('')
!= alias_name
