Clients

tasks/main.yml

@@ -13,6 +13,23 @@
     fail_msg: Configure database/LDAP credentials, client secrets and explicit database chart version if managing PostgreSQL.
   no_log: true
 
+- name: Validate explicit OIDC clients
+  ansible.builtin.assert:
+    that:
+      - item.id | default('') | length > 0
+      - item.name | default('') | length > 0
+      - item.redirectURIs | default([]) | length > 0
+      - item.public | default(false) or ((item.secret | default('') | length > 0) != (item.secretEnv | default('') | length > 0))
+    fail_msg: Every confidential client needs an ID, name, exact callback URI and either a secret or secretEnv, but not both.
+  loop: "{{ dex_static_clients }}"
+  no_log: true
+
+- name: Reject duplicate explicit client IDs
+  ansible.builtin.assert:
+    that:
+      - dex_static_clients | map(attribute='id') | unique | length == dex_static_clients | length
+  no_log: true
+
 - name: Ensure Dex namespace
   kubernetes.core.k8s:
     state: present