redeploy authentic policies as code.

ansible/playbooks/roles/step-ca/tasks/main.yml

@@ -95,3 +95,29 @@
   community.docker.docker_compose_v2:
     project_src: "{{ stepca_base_dir }}"
     state: present
+
+- name: Template OIDC provisioner patch script
+  ansible.builtin.template:
+    src: patch_oidc_provisioner.py.j2
+    dest: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    owner: root
+    group: root
+    mode: "0700"
+  no_log: true
+
+- name: Patch OIDC provisioner in ca.json
+  ansible.builtin.command:
+    cmd: python3 {{ stepca_base_dir }}/patch_oidc_provisioner.py
+  register: oidc_patch_result
+  changed_when: "'CHANGED' in oidc_patch_result.stdout"
+
+- name: Restart step-ca if OIDC provisioner changed
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: restarted
+  when: oidc_patch_result is changed
+
+- name: Clean up patch script
+  ansible.builtin.file:
+    path: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    state: absent

ansible/playbooks/roles/step-ca/templates/patch_oidc_provisioner.py.j2

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# Managed by Ansible — do not edit manually
+# Patches the OIDC provisioner in step-ca's ca.json with values from Ansible vars
+import json
+import sys
+
+ca_json_path = "{{ stepca_data_dir }}/config/ca.json"
+provisioner_name = "{{ stepca_oidc_provisioner_name }}"
+desired_domains = {{ stepca_oidc_domains | to_json }}
+desired_client_id = "{{ stepca_oidc_client_id }}"
+desired_client_secret = "{{ stepca_oidc_client_secret }}"
+desired_config_endpoint = "{{ stepca_oidc_configuration_endpoint }}"
+desired_listen_address = "{{ stepca_oidc_listen_address }}"
+
+with open(ca_json_path) as f:
+    cfg = json.load(f)
+
+changed = False
+found = False
+
+for p in cfg["authority"]["provisioners"]:
+    if p.get("name") == provisioner_name and p.get("type") == "OIDC":
+        found = True
+        updates = {
+            "domains": desired_domains,
+            "clientID": desired_client_id,
+            "clientSecret": desired_client_secret,
+            "configurationEndpoint": desired_config_endpoint,
+            "listenAddress": desired_listen_address,
+        }
+        for key, value in updates.items():
+            if p.get(key) != value:
+                p[key] = value
+                changed = True
+        break
+
+if not found:
+    # Add the OIDC provisioner if it doesn't exist
+    cfg["authority"]["provisioners"].append({
+        "type": "OIDC",
+        "name": provisioner_name,
+        "clientID": desired_client_id,
+        "clientSecret": desired_client_secret,
+        "configurationEndpoint": desired_config_endpoint,
+        "domains": desired_domains,
+        "listenAddress": desired_listen_address,
+        "claims": {"enableSSHCA": True},
+        "options": {"x509": {}, "ssh": {}},
+    })
+    changed = True
+
+if changed:
+    with open(ca_json_path, "w") as f:
+        json.dump(cfg, f, indent=8)
+    print("CHANGED")
+else:
+    print("OK")