---

- name: "Authenticate on keycloak for {{ inventory_hostname }}"
  include_role:
    name: keycloak
    tasks_from: _authenticate

- name: "Deleting realm <{{ current_realm_name }}>"
  community.general.keycloak_realm:
    id: "{{ current_realm_name }}"
    realm: "{{ current_realm_name }}"
    auth_realm: "master"
    auth_client_id: "admin-cli"
    auth_username: "{{ keycloak_admin_username }}"
    auth_password: "{{ keycloak_admin_password }}"
    auth_keycloak_url: "{{ shared_service_url_keycloak }}/auth"
    state: absent
  tags:
    - always
  when:
    - keycloak_force_prune

- name: "Setup realm for {{ inventory_hostname }}"
  include_role:
    name: keycloak
    tasks_from: _configure_realm

- name: "Create realm users"
  include_role:
    name: keycloak
    tasks_from: _create_realm_groups

- name: "Create realm users"
  include_role:
    name: keycloak
    tasks_from: _create_realm_users

- name: "Create realm admin"
  include_role:
    name: keycloak
    tasks_from: _create_realm_admin

- name: "Create user group mappings"
  include_role:
    name: keycloak
    tasks_from: _configure_user_groupmembership_crud
  vars:
    realm_name: '{{ current_realm_name }}'
    bearer_token: '{{ access_token }}'
    username: '{{ item.username }}'
    destination_group: '{{ item.destination_group }}'
  loop: "{{ current_user_groupmembership | default([]) }}"
  loop_control:
    label: "{{ item.username }} >> {{ item.destination_group }}"

- name: "Create custom clientscope mappers"
  delegate_to: 127.0.0.1
  become: false
  community.general.keycloak_clientscope:
    auth_client_id: "admin-cli"
    auth_keycloak_url: "{{ shared_service_url_keycloak }}/auth"
    auth_realm: "master"
    auth_username: "{{ keycloak_admin_username }}"
    auth_password: "{{ keycloak_admin_password }}"
    name: "groups"
    realm: "{{ current_realm_name }}"
    protocol: "openid-connect"
    protocol_mappers:
      # add custom group mapper to avoid paths in group names
      - name: "groups"
        protocol: "openid-connect"
        protocolMapper: "oidc-group-membership-mapper"
        config:
          access.token.claim: true
          claim.name: "groups"
          full.path: false
          id.token.claim: true
          userinfo.token.claim: true