feat(keycloak_realm_key): add full support for all Keycloak key providers

[koke1997]

Summary

Add full support for Keycloak's auto-generated key providers where Keycloak manages the key material automatically, rather than requiring imported keys.

New Provider Types

• rsa-generated - Auto-generates RSA signing keys with self-signed certificate
• rsa-enc-generated - Auto-generates RSA encryption keys
• hmac-generated - Auto-generates HMAC signing keys
• aes-generated - Auto-generates AES encryption keys
• ecdsa-generated - Auto-generates ECDSA signing keys
• ecdh-generated - Auto-generates ECDH key exchange keys
• eddsa-generated - Auto-generates EdDSA signing keys

New Algorithms

• HMAC: HS256, HS384, HS512
• ECDSA: ES256, ES384, ES512
• RSA Encryption: RSA1_5, RSA-OAEP, RSA-OAEP-256
• ECDH: ECDH_ES, ECDH_ES_A128KW, ECDH_ES_A192KW, ECDH_ES_A256KW
• AES/EdDSA: No algorithm parameter needed

New Config Options

• secret_size - For HMAC/AES providers (key size in bytes)
• key_size - For RSA-generated/RSA-enc-generated providers (key size in bits: 1024, 2048, 4096)
• elliptic_curve - For ECDSA/ECDH/EdDSA providers:
  • ECDSA: P-256, P-384, P-521
  • ECDH: P-256, P-384, P-521
  • EdDSA: Ed25519, Ed448

Bug Fixes

• Fixes keycloak_realm_key module is unable to delete default keys #11459 - Fix KeyError crash when managing default/generated realm keys that don't have active, enabled, or algorithm fields in their config response
• Make private_key and certificate optional (only required for rsa/rsa-enc imported key providers)

Backward Compatibility

• No breaking changes - Existing playbooks using provider_id=rsa or provider_id=rsa-enc continue to work unchanged
• The algorithm parameter retains its RS256 default, which is valid for rsa and rsa-generated providers
• For new providers, algorithm must be explicitly specified with clear error messages if omitted

Keycloak Source Reference

Configuration options were matched against the official Keycloak source code:

Provider	Keycloak Source	Config Properties
hmac-generated	GeneratedHmacKeyProviderFactory.java	algorithm (HS256/384/512), secretSize
aes-generated	GeneratedAesKeyProviderFactory.java	secretSize (no algorithm - always AES)
ecdsa-generated	GeneratedEcdsaKeyProviderFactory.java	ecdsaEllipticCurveKey (P-256/384/521)
ecdh-generated	GeneratedEcdhKeyProviderFactory.java	ecdhEllipticCurveKey (P-256/384/521)
eddsa-generated	GeneratedEddsaKeyProviderFactory.java	eddsaEllipticCurveKey (Ed25519/Ed448)
rsa-generated	GeneratedRsaKeyProviderFactory.java	algorithm (RS/PS 256/384/512), keySize
rsa-enc-generated	GeneratedRsaEncKeyProviderFactory.java	algorithm (RSA1_5/RSA-OAEP/RSA-OAEP-256), keySize

Parameter Mapping:

• elliptic_curve → provider-specific config keys (ecdsaEllipticCurveKey, ecdhEllipticCurveKey, eddsaEllipticCurveKey)
• secret_size → secretSize (standard camelCase conversion)
• key_size → keySize (standard camelCase conversion)

Test Plan

• Local testing against Keycloak 26 instance
• Tested creation of all provider types
• Verified idempotency (re-run doesn't change)
• Verified deletion works
• Verified backward compatibility (existing RSA playbooks work)
• Verified issue keycloak_realm_key module is unable to delete default keys #11459 fix - managing Keycloak's default keys works correctly
• Added integration tests for all provider types
• All ansible-test sanity checks pass

Example Usage

# RSA encryption key (auto-generated)
- community.general.keycloak_realm_key:
    auth_keycloak_url: http://localhost:8080
    auth_realm: master
    auth_username: admin
    auth_password: admin
    state: present
    name: my-rsa-enc-key
    parent_id: my-realm
    provider_id: rsa-enc-generated
    config:
      priority: 100
      algorithm: RSA-OAEP
      key_size: 2048

# ECDH key exchange (auto-generated)  
- community.general.keycloak_realm_key:
    auth_keycloak_url: http://localhost:8080
    auth_realm: master
    auth_username: admin
    auth_password: admin
    state: present
    name: my-ecdh-key
    parent_id: my-realm
    provider_id: ecdh-generated
    config:
      priority: 100
      algorithm: ECDH_ES
      elliptic_curve: P-256

# EdDSA signing key (auto-generated)
- community.general.keycloak_realm_key:
    auth_keycloak_url: http://localhost:8080
    auth_realm: master
    auth_username: admin
    auth_password: admin
    state: present
    name: my-eddsa-key
    parent_id: my-realm
    provider_id: eddsa-generated
    config:
      priority: 100
      elliptic_curve: Ed25519

[ansibullbot]

cc @eikef @mattock @ndclt @thomasbach-dev
click here for bot help

[ansibullbot]

The test ansible-test sanity --test validate-modules [explain] failed with 2 errors:

plugins/modules/keycloak_realm_key.py:0:0: doc-default-does-not-match-spec: Argument 'algorithm' in argument_spec found in config defines default as ('RS256') but documentation defines default as (None)
plugins/modules/keycloak_realm_key.py:0:0: no-log-needed: Argument 'secret_size' in argument_spec could be a secret, though doesn't have `no_log` set found in config

The test ansible-test sanity --test validate-modules [explain] failed with 2 errors:

plugins/modules/keycloak_realm_key.py:0:0: doc-default-does-not-match-spec: Argument 'algorithm' in argument_spec found in config defines default as ('RS256') but documentation defines default as (None)
plugins/modules/keycloak_realm_key.py:0:0: no-log-needed: Argument 'secret_size' in argument_spec could be a secret, though doesn't have `no_log` set found in config

The test ansible-test sanity --test validate-modules [explain] failed with 2 errors:

plugins/modules/keycloak_realm_key.py:0:0: doc-default-does-not-match-spec: Argument 'algorithm' in argument_spec found in config defines default as ('RS256') but documentation defines default as (None)
plugins/modules/keycloak_realm_key.py:0:0: no-log-needed: Argument 'secret_size' in argument_spec could be a secret, though doesn't have `no_log` set found in config

The test ansible-test sanity --test validate-modules [explain] failed with 2 errors:

plugins/modules/keycloak_realm_key.py:0:0: doc-default-does-not-match-spec: Argument 'algorithm' in argument_spec found in config defines default as ('RS256') but documentation defines default as (None)
plugins/modules/keycloak_realm_key.py:0:0: no-log-needed: Argument 'secret_size' in argument_spec could be a secret, though doesn't have `no_log` set found in config

click here for bot help