Skip to content

keycloak_realm_localization: new module - realm localization control #10841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 25 commits into
base: main
Choose a base branch
from
Open

keycloak_realm_localization: new module - realm localization control #10841

wants to merge 25 commits into from

Conversation

danekja
Copy link
Contributor

@danekja danekja commented Sep 19, 2025

SUMMARY

This pull request adds new module for Keycloak management - localization overrides. Keycloak provides API/Admin Console access to configure localization keys dynamically (outside bundled templates). This functionality is especially relevant together with Keycloak's User Profile functionality - each profile attribute must have localization keys if localization is enabled for a realm.

The newly added module allows users to configure both user profile and it's attributes' localization values using this collection.

Due to KC API requirement this PR also extends signature of KeycloakAPI._request (in module_utils/identity/keycloak.py) to allow http request headers override.

ISSUE TYPE
  • New Module/Plugin Pull Request
COMPONENT NAME

keycloak_realm_localization

ADDITIONAL INFORMATION

Keycloak documentation
Keycloak API description - search for GET /admin/realms/{realm}/localization and continue from there

Testing was done against RedHat build of Keycloak 26.0.13.

@ansibullbot
Copy link
Collaborator

cc @eikef @mattock @ndclt @thomasbach-dev
click here for bot help

@ansibullbot ansibullbot added identity module module module_utils module_utils new_plugin New plugin plugins plugin (any type) tests tests unit tests/unit labels Sep 19, 2025
@ansibullbot

This comment was marked as resolved.

Sign in to view
@ansibullbot ansibullbot added the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 19, 2025
@danekja
Copy link
Contributor Author

danekja commented Sep 19, 2025 via email

@felixfontein felixfontein added check-before-release PR will be looked at again shortly before release and merged if possible. backport-11 Automatically create a backport for the stable-10 branch labels Sep 20, 2025
@ansibullbot

This comment was marked as resolved.

Sign in to view
@ansibullbot ansibullbot removed the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 25, 2025
@russoz russoz changed the title Keycloak: new module - realm localization control keycloak_realm_localization: new module - realm localization control Sep 26, 2025
russoz
russoz requested changes Sep 26, 2025
View reviewed changes
Copy link
Collaborator

@russoz russoz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @danekja

Thanks for your contribution! There is a number of adjustments needed, and some parts of the code could be simplified/improved. Please review carefully.

changelogs/fragments/10841-keycloak-add-optional-headers-request.yml Outdated
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changelog fragments are not required for new modules, please remove this file

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, i have added it only because of the change to KeycloakAPI's API

@ansibullbot ansibullbot added the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 26, 2025
@danekja
Copy link
Contributor Author

danekja commented Sep 26, 2025

@russoz ok, hopefully better now

russoz
russoz reviewed Sep 27, 2025
View reviewed changes
Copy link
Collaborator

@russoz russoz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @danekja thanks for your updates. I spotted a couple of other things, mostly minor adjustments, but one "larger" suggestion as well.

plugins/modules/keycloak_realm_localization.py

if module.check_mode:
# Dry-run: report intent without side effects
result['msg'] = "Locale %s overrides would be updated." % (locale)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a single variable the brackets are redundant.

Suggested change
result['msg'] = "Locale %s overrides would be updated." % (locale)
result['msg'] = "Locale %s overrides would be updated." % locale

plugins/modules/keycloak_realm_localization.py
for override in to_update:
kc.set_localization_value(locale, override['key'], override['value'], parent_id)

result['msg'] = "Locale %s overrides have been updated." % (locale)
Copy link
Collaborator

@russoz russoz Sep 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

Suggested change
result['msg'] = "Locale %s overrides have been updated." % (locale)
result['msg'] = "Locale %s overrides have been updated." % locale

plugins/modules/keycloak_realm_localization.py

# Compute two sets:
# - to_update: keys missing or with different values
# - to_remove: keys existing in current state but not in desired
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You might want to consider an option for the user on whether to remove these existing keys or not. As comparison, see the ansible.builtin.user module and how it handles groups - when you pass a list of groups you have the option to append them (keep old ones), or to make the user's group list exactly as passed (remove the old ones). That is usually a good way to handle this situation, but I am not sure if it makes sense in this use case.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Im going to take a look. Sounds like a useful option to have, even though I dont have a use for it (strongly believe in having whole configuration as code).

@ansibullbot ansibullbot added stale_ci CI is older than 7 days, rerun before merging stale_review labels Oct 12, 2025
@felixfontein felixfontein removed the backport-11 Automatically create a backport for the stable-10 branch label Oct 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@russoz russoz russoz requested changes

Assignees

No one assigned

Labels

check-before-release PR will be looked at again shortly before release and merged if possible. identity module_utils module_utils module module needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR new_plugin New plugin plugins plugin (any type) stale_ci CI is older than 7 days, rerun before merging stale_review tests tests unit tests/unit

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@danekja @ansibullbot @russoz @felixfontein