keycloak_client add option to support client-x509 authentication

[Boolman]

SUMMARY

keycloak_client is missing support for x509 client authentication,
this PR updates client_authenticator_type with the choice client-x509

ISSUE TYPE

Feature Pull Request

COMPONENT NAME

modules/keycloak_client

ADDITIONAL INFORMATION

Below is steps to test the result with this PR applied.

cat ~/keycloak/certs/start.sh  
export KEYCLOAK_ADMIN=admin
export KEYCLOAK_ADMIN_PASSWORD=admin


cd /opt/keycloak
bin/kc.sh start-dev --https-certificate-key-file=/certs/certificate.key --https-certificate-file=/certs/certificate.crt --https-trust-store-file=/certs/truststore.jks --https-trust-store-password=password --https-client-auth=request --log-level=trace

Start Keycloak
docker run --rm -it -p 8080:8080 -p 8443:8443 -v ~/keycloak/certs:/certs --entrypoint=/bin/bash keycloak/keycloak:25.0 bash /certs/start.sh

Apply config

ansible-playbook ....

Verify

$ curl --cacert ~/keycloak/certs/ca.crt --cert ~/keycloak/certs/certificate.crt --key ~/keycloak/certs/certificate.key https://127.0.0.1:8443/realms/test/protocol/openid-connect/token --data "client_id=test&username=testuser&password=testuser&grant_type=password" -k -v

[ansibullbot]

cc @eikef @mattock @ndclt @thomasbach-dev
click here for bot help

[felixfontein]

Thanks for your contribution. I've added some first comments below.

[russoz]

Hi @Boolman thanks for your contribution!

Just left a small comment below, about the docs.

Other than that, I am assuming (lazily not checking the code) that the simple fact of adding new keys to attributes makes them be passed through KC's API. If that's not the case, then maybe more code is needed to ensure the new options are passed along.

[felixfontein]

CC @fgruenbauer