donghyeon.kang/keycloak-pattern
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
50 Commits 71 Branches 0 Tags
6dce35ec8356da9a25a04ec64adad2c34cb7a391
Commit Graph
50 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
DongHyeonkaandClaude Opus 5 6dce35ec83 feat: deploy Keycloak multi-node cluster with PostgreSQL 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 17:17:25 +09:00
DongHyeonkaandClaude Opus 5 001efd624a docs: correct the memory analysis to distinguish host and guest headroom 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 17:02:11 +09:00
DongHyeonkaandClaude Opus 5 d6f8b9f8b3 docs: restructure roadmap into A/B/operations layers and add five operational items 
Adds backup rehearsal, version upgrade, observability, secret management and certificate renewal. Corrects the experiment order so the refresh-token contention test runs after the shared store exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:56:13 +09:00
DongHyeonkaandClaude Opus 5 df4d3b4345 docs: map published open questions to lab coverage and fix experiment order 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:44:12 +09:00
DongHyeonkaandClaude Opus 5 61ba5db259 docs: add lab operations guide with tooling, commands and drills 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:39:45 +09:00
DongHyeonkaandClaude Opus 5 bc784fcd6e docs: surface the spoofing bypass finding in the roadmap 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:24:52 +09:00
DongHyeonkaandClaude Opus 5 ddcb1c08e6 docs: record the session store lab roadmap and progress 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:20:38 +09:00
DongHyeonkaandClaude Opus 5 e1ba9c5626 docs: record proxy-bypass closure with before and after evidence 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:17:24 +09:00
DongHyeonkaandClaude Opus 5 3af52bb66a feat: narrow Traefik trusted range and restrict echo ingress to Traefik 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 16:15:28 +09:00
DongHyeonkaandClaude Opus 5 98874b0c6c docs: retake staged evidence screenshots with indented output 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:52:47 +09:00
DongHyeonkaandClaude Opus 5 b708c8d503 feat: indent echo responses for readable evidence 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:48:57 +09:00
DongHyeonkaandClaude Opus 5 7737787937 docs: record the staged fix and post-fix evidence 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:33:40 +09:00
DongHyeonkaandClaude Opus 5 1c1b86e849 feat: let the app interpret forwarded headers 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:30:31 +09:00
DongHyeonkaandClaude Opus 5 2294c52095 feat: make Traefik trust forwarded headers from the host nginx 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:29:18 +09:00
DongHyeonkaandClaude Opus 5 69d4502757 docs: collect evidence for the two-hop header contract failure 
Control experiment isolates two independent causes: the nginx 443 block still emits X-Forwarded-Proto http, and Traefik rewrites forwarded headers regardless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 15:04:38 +09:00
DongHyeonkaandClaude Opus 5 ae1f391598 docs: expand two-hop header contract with switch locations and per-pattern impact 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 14:57:08 +09:00
DongHyeonkaandClaude Opus 5 844d6f1d33 docs: measure and diagnose the two-hop proxy header contract 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 14:35:27 +09:00
DongHyeonkaandClaude Opus 5 a831792c5c docs: map deploy/ assets and record why unapplied configs are kept 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 14:18:08 +09:00
DongHyeonkaandClaude Opus 5 bcfdeb93ee docs: explain every setting used in the echo manifest 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 14:11:18 +09:00
DongHyeonkaandClaude Opus 5 deae8966b8 docs: record why Docker must not be installed on the lab host 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 13:53:36 +09:00
DongHyeonkaandClaude Opus 5 6c90468c5a feat: report pod address from echo endpoint 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-03 13:44:29 +09:00
DongHyeonka 51bb055d61 feat: 2홉 구성 진행 2026-09-03 11:46:56 +09:00
DongHyeonka c22b217fbd chore: 메타데이터 gitignore 2026-09-02 14:44:06 +09:00
donghyeon-ka c07593c471 merge: four-pattern tradeoff matrix 2026-07-25 16:31:44 +09:00
donghyeon-ka d01a60964a docs: compare four authentication patterns 2026-07-25 16:31:44 +09:00
donghyeon-ka 5d7544256a merge: public domain tunnel profile 2026-07-25 16:31:13 +09:00
donghyeon-ka eacc0e86c9 feat: add validated named tunnel profile 2026-07-25 16:31:13 +09:00
donghyeon-ka ac912cb354 merge: HTTPS termination profiles 2026-07-25 16:30:25 +09:00
donghyeon-ka e4cee2a06d feat: add validated HTTPS termination profiles 2026-07-25 16:30:25 +09:00
donghyeon-ka 006b405ad5 merge: reverse proxy header contract 2026-07-25 16:29:32 +09:00
donghyeon-ka 8539d1bf5b feat: define trusted reverse proxy header contract 2026-07-25 16:29:32 +09:00
donghyeon-ka 3473875d9a merge: Google redirect URI policy 2026-07-25 16:28:53 +09:00
donghyeon-ka f077e5038e docs: define exact Google redirect URI policy 2026-07-25 16:28:53 +09:00
donghyeon-ka e4eb7e54f7 merge: federated subject identity contract 2026-07-25 16:28:00 +09:00
donghyeon-ka bdde0feb86 test: verify broker identity uses subject not email 2026-07-25 16:28:00 +09:00
donghyeon-ka 3da8e609ae merge: broker claim-to-role mapping 2026-07-25 16:26:59 +09:00
donghyeon-ka ed064473dc feat: map broker claims to realm roles 2026-07-25 16:26:59 +09:00
donghyeon-ka a84f7d50a1 merge: Google claim attribute mapping 2026-07-25 16:24:24 +09:00
donghyeon-ka 98b07b4fdf feat: map upstream Google identity claims 2026-07-25 16:24:24 +09:00
donghyeon-ka 98566a713d merge: hardened First Broker Login flow 2026-07-25 16:17:54 +09:00
donghyeon-ka aeb783e592 test: reproduce and block unsafe broker auto-link 2026-07-25 16:17:54 +09:00
donghyeon-ka 3bbbaf5230 merge: Google broker configuration profiles 2026-07-25 15:30:47 +09:00
donghyeon-ka 2ee4b2af1c feat: add Google broker configuration profiles 2026-07-25 15:30:47 +09:00
donghyeon-ka 030ae94be3 merge: Keycloak branch governance index 2026-07-25 15:26:26 +09:00
donghyeon-ka 728e737dc8 docs: add 39-branch Keycloak governance index 2026-07-25 15:26:26 +09:00
donghyeon-ka e2fba41f56 merge: shared Keycloak realm baseline 2026-07-25 13:21:42 +09:00
donghyeon-ka 998eada6f5 feat: add shared realm and pattern clients 2026-07-25 13:21:36 +09:00
donghyeon-ka 5ddb97d3a1 merge: shared Keycloak compose baseline 2026-07-25 13:14:58 +09:00
donghyeon-ka f47dea3e24 feat: add shared Keycloak compose baseline 2026-07-25 13:14:58 +09:00
donghyeon.kang 1eeff83d0b Initial commit 2026-07-23 04:24:38 +00:00