keycloak_user_federation: mappers can have list in config

[mixman68]

Summary

The config attribute for mappers in keycloak_user_federation only accept string as value,

The official api of keycloak return array of strings and the value can be multiple for some mapper

Issue Type

Bug Report

Component Name

keycloak_user_federation

Ansible Version

$ ansible --version
ansible [core 2.16.3]
  config file = None
  configured module search path = ['/home/greg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/greg/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.12.3 (main, Jan 22 2026, 20:57:42) [GCC 13.3.0] (/usr/bin/python3)
  jinja version = 3.1.2
  libyaml = True

Community.general Version

$ ansible-galaxy collection list community.general
# /home/greg/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
community.general 12.3.0 

Configuration

$ ansible-config dump --only-changed
CONFIG_FILE() = None

OS / Environment

Debian 13

Steps to Reproduce

- name: Create LDAP user federation
  community.general.keycloak_user_federation:
    auth_keycloak_url: https://keycloak.example.com/auth
    auth_realm: master
    auth_username: admin
    auth_password: password
    realm: my-realm
    name: my-ldap
    state: present
    provider_id: ldap
    provider_type: org.keycloak.storage.UserStorageProvider
    config:
      priority: 0
      enabled: true
      cachePolicy: DEFAULT
      batchSizeForSync: 1000
      editMode: READ_ONLY
      importEnabled: true
      syncRegistrations: false
      vendor: other
      usernameLDAPAttribute: uid
      rdnLDAPAttribute: uid
      uuidLDAPAttribute: entryUUID
      userObjectClasses: inetOrgPerson, organizationalPerson
      connectionUrl: ldaps://ldap.example.com:636
      usersDn: ou=Users,dc=example,dc=com
      authType: simple
      bindDn: cn=directory reader
      bindCredential: password
      searchScope: 1
      validatePasswordPolicy: false
      trustEmail: false
      useTruststoreSpi: ldapsOnly
      connectionPooling: true
      pagination: true
      allowKerberosAuthentication: false
      debug: false
      useKerberosForPasswordAuthentication: false
    mappers:
      - name: "full name"
        providerId: "full-name-ldap-mapper"
        providerType: "org.keycloak.storage.ldap.mappers.LDAPStorageMapper"
        config:
          ldap.full.name.attribute: cn
          read.only: true
          write.only: false
      - config:
          included.attribute: mail
          included.list.attributes:
            - telephone
            - sso_cert
        name: RESTMapper
        providerId: custom-rest-api-mapper
        providerType: org.keycloak.storage.ldap.mappers.LDAPStorageMapper

Expected Results

the attributes config on my mapper is broken, instead of two value, i have unique with ['telephone', 'sso_cert']

Actual Results

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• plugins/modules/keycloak_user_federation.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @eikef @laurpaum @mattock @ndclt @thomasbach-dev
click here for bot help

[mixman68]

I fixed the API calling by change block of line 886 by :

    if mappers is not None:
        for mapper in mappers:
            if mapper.get("config") is not None:
                new_config = {}
                for k, v in mapper["config"].items():
                    if v is None:
                        continue
                    if isinstance(v, list):
                        new_config[k] = [
                            str(item).lower() if not isinstance(item, str) else item
                            for item in v
                        ]
                    else:
                        new_config[k] = [
                            str(v).lower() if not isinstance(v, str) else v
                        ]
                mapper["config"] = new_config

But the diff and change detection still broken

[russoz]

Hi @mixman68 Thanks for reporting.

May I suggest you raise a PR with those changes? That would make it easier for others to collaborate with you in pursuing the solution. :-) Thanks