feat(ap4): defend forwarded identity headers

.env.example

@@ -0,0 +1,19 @@
+# Copy this file to .env and replace every change-me value.
+KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KC_BOOTSTRAP_ADMIN_PASSWORD=change-me-admin-password
+
+POSTGRES_DB=keycloak
+POSTGRES_USER=keycloak
+POSTGRES_PASSWORD=change-me-postgres-password
+
+# Keycloak resolves these placeholders while importing the realm.
+TOKEN_MEDIATING_CLIENT_SECRET=change-me-token-mediating-client-secret
+BFF_CLIENT_SECRET=change-me-bff-client-secret
+EDGE_PROXY_CLIENT_SECRET=change-me-edge-proxy-client-secret
+OAUTH2_PROXY_COOKIE_SECRET=generate-a-base64-encoded-32-byte-secret
+INTERNAL_AUTH_TOKEN=generate-a-long-random-edge-to-backend-token
+ADMIN_USER_PASSWORD=change-me-admin-user-password
+REGULAR_USER_PASSWORD=change-me-regular-user-password
+
+# Port 80 is the single-EC2 target. 8088 avoids common local port conflicts.
+NGINX_PORT=8088

.gitignore

@@ -0,0 +1,9 @@
+.env
+.idea/
+.vscode/
+*.iml
+
+backend/target/
+**/node_modules/
+frontend/dist/
+build/

README.md

@@ -1,2 +1,117 @@
-# keycloak-pattern
+# Keycloak Authentication Patterns
 
+Keycloak을 중심으로 네 가지 브라우저 인증 통합 패턴을 같은 로컬
+인프라에서 비교하는 학습 프로젝트입니다.
+
+- AP1: Browser-based OAuth Client (SPA direct + Resource Server)
+- AP2: Token-Mediating Backend
+- AP3: Backend-for-Frontend (BFF)
+- AP4: Edge forward-auth
+
+현재 `develop`의 공통 baseline은 Keycloak, PostgreSQL, Spring Boot API,
+nginx를 Docker Compose로 실행하는 토대입니다. 패턴별 구현은 이 baseline
+위에서 별도 브랜치로 진행합니다.
+
+## 요구 사항
+
+- Docker Engine
+- Docker Compose
+- `curl`
+
+로컬 Java나 Maven은 필요하지 않습니다. Spring Boot 빌드와 테스트는 Maven
+컨테이너에서 수행합니다.
+
+## 시작
+
+```bash
+cp .env.example .env
+docker compose up --build -d
+./scripts/verify-stack.sh
+```
+
+기본 주소는 다음과 같습니다.
+
+| 구성 요소 | 주소 |
+|---|---|
+| Keycloak | <http://localhost:8080> |
+| Spring Boot API | <http://localhost:8081> |
+| nginx | <http://localhost:8088> |
+
+host의 80번 포트를 쓸 수 있는 single-EC2 환경에서는 `.env`의
+`NGINX_PORT=80`으로 변경할 수 있습니다.
+
+## 상태 확인
+
+```bash
+docker compose ps
+docker compose logs -f keycloak
+curl http://localhost:8088/api/public
+curl -i http://localhost:8088/api/me
+```
+
+`/api/public`은 `200`, 인증 정보가 없는 `/api/me`는 `401`이 정상입니다.
+
+## 환경 초기화
+
+PostgreSQL과 Keycloak data volume을 제거하고 realm import부터 다시
+검증하려면 다음 한 줄을 사용합니다.
+
+```bash
+docker compose down -v && docker compose up --build -d
+```
+
+`start-dev`와 로컬 HTTP 설정은 학습 전용입니다. 운영 환경에서는
+optimized Keycloak image, HTTPS, 엄격한 hostname 및 외부 secret store를
+사용해야 합니다.
+
+## Realm baseline
+
+`keycloak/import/keycloak-patterns-realm.json`은 시작 시 자동 import됩니다.
+하나의 `keycloak-patterns` realm 안에서 패턴마다 client를 분리합니다.
+
+| Client | 유형 | 패턴 |
+|---|---|---|
+| `spa-public` | public + PKCE S256 | AP1 |
+| `token-mediating-confidential` | confidential | AP2 |
+| `bff-confidential` | confidential | AP3 |
+| `edge-proxy` | confidential | AP4 |
+
+confidential client secret과 테스트 사용자 password는 JSON에 평문으로
+저장하지 않습니다. JSON에는 `${ENVIRONMENT_VARIABLE}` placeholder만
+커밋하고, Keycloak 26.7.0이 import 시 `.env` 값을 주입합니다.
+
+```bash
+python3 scripts/validate-realm.py
+docker compose down -v
+docker compose up -d --wait
+./scripts/verify-realm.sh
+```
+
+실행 중인 DB에서 CLI realm export를 재현하려면 다음 명령을 사용합니다.
+Keycloak을 잠시 중지하고 export한 뒤 자동으로 다시 올립니다.
+
+```bash
+./scripts/export-realm.sh
+```
+
+runtime export에는 실제 client secret과 credential hash가 포함될 수 있어
+gitignored `build/keycloak-export/`에 권한 `0600`으로만 저장됩니다.
+
+## AP4: oauth2-proxy Edge Forward Auth
+
+`develop-keycloak-pattern4`는 oauth2-proxy와 Nginx `auth_request`가
+인증을 edge에서 강제하는 패턴입니다.
+
+```bash
+./scripts/verify-pattern4.sh
+```
+
+첫 feature에서는 oauth2-proxy를 `http://localhost:4180`에 직접 노출해
+OIDC redirect/PKCE/callback과 forwarded-user를 분리 확인합니다. 두 번째
+feature부터 `http://localhost:8088` Nginx가 단일 진입점이며, 내부
+`auth_request`는 브라우저 요청을 login 302로, API 요청을 JSON 401로
+구분합니다. 최종 feature에서는 backend와 oauth2-proxy의 호스트 노출을
+제거하고 Nginx 헤더 덮어쓰기와 내부 토큰 검증으로 spoofing을 막습니다.
+자세한 내용은
+[`docs/ap4-edge-forward-auth.md`](docs/ap4-edge-forward-auth.md)를
+참고하세요.

backend/.dockerignore

@@ -0,0 +1 @@
+target/

backend/Dockerfile

@@ -0,0 +1,19 @@
+FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
+
+WORKDIR /workspace
+COPY pom.xml .
+RUN mvn --batch-mode dependency:go-offline
+
+COPY src src
+RUN mvn --batch-mode verify
+
+FROM eclipse-temurin:21-jre-alpine
+
+RUN addgroup -S spring && adduser -S spring -G spring
+USER spring:spring
+
+WORKDIR /app
+COPY --from=build /workspace/target/keycloak-pattern-api.jar app.jar
+
+EXPOSE 8081
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]

backend/pom.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.5.16</version>
+        <relativePath/>
+    </parent>
+
+    <groupId>com.example</groupId>
+    <artifactId>keycloak-pattern-api</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+    <name>keycloak-pattern-api</name>
+    <description>Shared resource API for the Keycloak authentication patterns</description>
+
+    <properties>
+        <java.version>21</java.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>keycloak-pattern-api</finalName>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>

backend/src/main/java/com/example/keycloakpattern/ApiController.java

@@ -0,0 +1,30 @@
+package com.example.keycloakpattern;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api")
+public class ApiController {
+
+    @GetMapping("/public")
+    public Map<String, String> publicEndpoint() {
+        return Map.of("status", "ok", "service", "keycloak-pattern-api");
+    }
+
+    @GetMapping("/me")
+    public Map<String, Object> currentUser(@AuthenticationPrincipal Jwt jwt) {
+        Map<String, Object> response = new LinkedHashMap<>();
+        response.put("subject", jwt.getSubject());
+        response.put("username", jwt.getClaimAsString("preferred_username"));
+        response.put("issuer", jwt.getIssuer());
+        response.put("audience", jwt.getAudience());
+        return response;
+    }
+}

backend/src/main/java/com/example/keycloakpattern/EdgeIdentityController.java

@@ -0,0 +1,59 @@
+package com.example.keycloakpattern;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class EdgeIdentityController {
+
+    private final byte[] internalAuthToken;
+
+    EdgeIdentityController(@Value("${edge.internal-auth-token}") String internalAuthToken) {
+        if (!hasText(internalAuthToken)) {
+            throw new IllegalStateException("edge.internal-auth-token must be configured");
+        }
+        this.internalAuthToken = internalAuthToken.getBytes(StandardCharsets.UTF_8);
+    }
+
+    @GetMapping("/edge/me")
+    ResponseEntity<Map<String, Object>> currentUser(HttpServletRequest request) {
+        String authRequestUser = request.getHeader("X-Auth-Request-User");
+        if (!hasText(authRequestUser) || !hasValidInternalToken(request)) {
+            return ResponseEntity.status(401).body(Map.of(
+                "error",
+                "trusted edge authentication is required"
+            ));
+        }
+
+        Map<String, Object> response = new LinkedHashMap<>();
+        response.put("pattern", "AP4-edge-forward-auth");
+        response.put("user", authRequestUser);
+        response.put("email", request.getHeader("X-Auth-Request-Email"));
+        response.put("identityHeader", "X-Auth-Request-User");
+        return ResponseEntity.ok(response);
+    }
+
+    private boolean hasValidInternalToken(HttpServletRequest request) {
+        String suppliedToken = request.getHeader("X-Internal-Auth-Token");
+        if (!hasText(suppliedToken)) {
+            return false;
+        }
+        return MessageDigest.isEqual(
+            internalAuthToken,
+            suppliedToken.getBytes(StandardCharsets.UTF_8)
+        );
+    }
+
+    private static boolean hasText(String value) {
+        return value != null && !value.isBlank();
+    }
+}

backend/src/main/java/com/example/keycloakpattern/KeycloakPatternApplication.java

@@ -0,0 +1,12 @@
+package com.example.keycloakpattern;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class KeycloakPatternApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(KeycloakPatternApplication.class, args);
+    }
+}

backend/src/main/java/com/example/keycloakpattern/SecurityConfig.java

@@ -0,0 +1,32 @@
+package com.example.keycloakpattern;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
+        return http
+            .csrf(csrf -> csrf.disable())
+            .sessionManagement(session ->
+                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(authorize -> authorize
+                .requestMatchers(
+                    "/actuator/health",
+                    "/actuator/health/**",
+                    "/api/public",
+                    "/edge/**"
+                )
+                .permitAll()
+                .anyRequest()
+                .authenticated())
+            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
+            .build();
+    }
+}

backend/src/main/resources/application.yml

@@ -0,0 +1,25 @@
+server:
+  port: ${SERVER_PORT:8081}
+
+edge:
+  internal-auth-token: ${EDGE_INTERNAL_AUTH_TOKEN:}
+
+spring:
+  application:
+    name: keycloak-pattern-api
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:http://localhost:8080/realms/keycloak-patterns}
+          jwk-set-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI:http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/certs}
+
+management:
+  endpoint:
+    health:
+      probes:
+        enabled: true
+  endpoints:
+    web:
+      exposure:
+        include: health,info

backend/src/test/java/com/example/keycloakpattern/ApiSecurityTest.java

@@ -0,0 +1,75 @@
+package com.example.keycloakpattern;
+
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.web.servlet.MockMvc;
+
+@SpringBootTest(properties = "edge.internal-auth-token=test-internal-edge-token")
+@AutoConfigureMockMvc
+class ApiSecurityTest {
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Test
+    void publicEndpointDoesNotRequireAuthentication() throws Exception {
+        mockMvc.perform(get("/api/public"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.status").value("ok"));
+    }
+
+    @Test
+    void protectedEndpointRejectsAnonymousRequests() throws Exception {
+        mockMvc.perform(get("/api/me"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void protectedEndpointAcceptsJwtAuthentication() throws Exception {
+        mockMvc.perform(get("/api/me").with(jwt().jwt(token -> token
+                .subject("test-subject")
+                .claim("preferred_username", "regular-user"))))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.subject").value("test-subject"))
+            .andExpect(jsonPath("$.username").value("regular-user"));
+    }
+
+    @Test
+    void edgeEndpointRejectsMissingTrustedHeaders() throws Exception {
+        mockMvc.perform(get("/edge/me"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointRejectsForgedIdentityWithoutInternalToken() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "spoofed-admin"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointRejectsWrongInternalToken() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "spoofed-admin")
+                .header("X-Internal-Auth-Token", "wrong-token"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointAcceptsIdentityFromTrustedEdge() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "regular-user")
+                .header("X-Auth-Request-Email", "regular-user@example.test")
+                .header("X-Internal-Auth-Token", "test-internal-edge-token"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.user").value("regular-user"))
+            .andExpect(jsonPath("$.identityHeader").value("X-Auth-Request-User"));
+    }
+}

docker-compose.yml

@@ -0,0 +1,173 @@
+name: keycloak-patterns
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-keycloak}
+      POSTGRES_USER: ${POSTGRES_USER:-keycloak}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?copy .env.example to .env and set POSTGRES_PASSWORD}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.7.0
+    command:
+      - start-dev
+      - --import-realm
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-keycloak}
+      KC_DB_USERNAME: ${POSTGRES_USER:-keycloak}
+      KC_DB_PASSWORD: ${POSTGRES_PASSWORD:?copy .env.example to .env and set POSTGRES_PASSWORD}
+      KC_HOSTNAME: http://localhost:8080
+      KC_HTTP_ENABLED: "true"
+      KC_HEALTH_ENABLED: "true"
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}
+      TOKEN_MEDIATING_CLIENT_SECRET: ${TOKEN_MEDIATING_CLIENT_SECRET:?set TOKEN_MEDIATING_CLIENT_SECRET in .env}
+      BFF_CLIENT_SECRET: ${BFF_CLIENT_SECRET:?set BFF_CLIENT_SECRET in .env}
+      EDGE_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
+      ADMIN_USER_PASSWORD: ${ADMIN_USER_PASSWORD:?set ADMIN_USER_PASSWORD in .env}
+      REGULAR_USER_PASSWORD: ${REGULAR_USER_PASSWORD:?set REGULAR_USER_PASSWORD in .env}
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - keycloak_data:/opt/keycloak/data
+      - ./keycloak/import:/opt/keycloak/data/import:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - bash
+        - -c
+        - "{ printf 'HEAD /health/ready HTTP/1.0\r\n\r\n' >&0; grep 'HTTP/1.0 200'; } 0<>/dev/tcp/localhost/9000"
+      interval: 10s
+      timeout: 5s
+      retries: 18
+      start_period: 60s
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  app:
+    build:
+      context: ./backend
+    environment:
+      SERVER_PORT: "8081"
+      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI: http://localhost:8080/realms/keycloak-patterns
+      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
+      EDGE_INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
+    expose:
+      - "8081"
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -q -O - http://127.0.0.1:8081/actuator/health | grep -q '"status":"UP"'
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  oauth2-proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
+    command:
+      - --http-address=0.0.0.0:4180
+      - --provider=keycloak-oidc
+      - --oidc-issuer-url=http://localhost:8080/realms/keycloak-patterns
+      - --skip-oidc-discovery=true
+      - --login-url=http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/auth
+      - --redeem-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/token
+      - --oidc-jwks-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
+      - --profile-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
+      - --validate-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
+      - --redirect-url=http://localhost:8088/oauth2/callback
+      - --upstream=http://app:8081
+      - --email-domain=*
+      - --scope=openid profile email
+      - --code-challenge-method=S256
+      - --reverse-proxy=true
+      - --trusted-proxy-ip=172.30.40.10/32
+      - --cookie-name=AP4_SESSION
+      - --cookie-secure=false
+      - --cookie-samesite=lax
+      - --cookie-expire=1h
+      - --skip-provider-button=true
+      - --set-xauthrequest=true
+      - --pass-user-headers=true
+      - --whitelist-domain=localhost:8088
+      - --whitelist-domain=localhost:8080
+    environment:
+      OAUTH2_PROXY_CLIENT_ID: edge-proxy
+      OAUTH2_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
+      OAUTH2_PROXY_COOKIE_SECRET: ${OAUTH2_PROXY_COOKIE_SECRET:?set OAUTH2_PROXY_COOKIE_SECRET in .env}
+    expose:
+      - "4180"
+    depends_on:
+      keycloak:
+        condition: service_healthy
+      app:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - /bin/oauth2-proxy
+        - --version
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  nginx:
+    build:
+      context: ./frontend
+    environment:
+      INTERNAL_AUTH_TOKEN: ${INTERNAL_AUTH_TOKEN:?set INTERNAL_AUTH_TOKEN in .env}
+    ports:
+      - "127.0.0.1:${NGINX_PORT:-8088}:80"
+    depends_on:
+      oauth2-proxy:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -q -O - http://127.0.0.1/health | grep -q '^ok$'
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    networks:
+      keycloak-net:
+        ipv4_address: 172.30.40.10
+    restart: unless-stopped
+
+volumes:
+  keycloak_data:
+  postgres_data:
+
+networks:
+  keycloak-net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.40.0/24

docs/ap4-edge-forward-auth.md

@@ -0,0 +1,70 @@
+# AP4 · oauth2-proxy Edge Forward Auth
+
+## 첫 단계: oauth2-proxy 자체 OIDC 흐름
+
+`feature/keycloak-oauth2-proxy-oidc-flow`에서는 oauth2-proxy를
+`http://localhost:4180`에 직접 노출해 구성 요소를 분리해서 확인합니다.
+
+1. `/edge/me` 미인증 요청이 Keycloak로 redirect됩니다.
+2. oauth2-proxy는 confidential `edge-proxy` client와 PKCE S256을 사용합니다.
+3. callback에서 code/token 교환과 ID/access token 검증은 서버끼리
+   수행합니다.
+4. 브라우저에는 HttpOnly `AP4_SESSION` cookie만 남습니다.
+5. oauth2-proxy가 backend 요청에 `X-Forwarded-User`를 붙여 200을 받습니다.
+
+Keycloak이 발급하는 issuer는 브라우저 기준
+`http://localhost:8080/realms/keycloak-patterns`입니다. 컨테이너 내부의
+`localhost`는 oauth2-proxy 자신이므로 discovery endpoint에 도달할 수
+없습니다. 그래서 이 로컬 Compose 구성은 issuer 검증값은 외부 URL로
+유지하되, login URL은 브라우저용 외부 주소, token/JWKS/userinfo는
+`http://keycloak:8080` 내부 주소로 각각 명시합니다.
+
+HTTP 로컬 시연이라 `cookie-secure=false`를 사용합니다. 운영 HTTPS에서는
+반드시 secure cookie로 되돌려야 합니다.
+
+## 다음 단계의 보안 전제
+
+이 첫 feature의 backend는 전달된 사용자 헤더를 신뢰하며 8081도
+loopback에 publish되어 있습니다. 따라서 로컬에서 직접
+`X-Forwarded-User: spoofed-admin`을 보내면 우회가 재현됩니다. 이후
+Nginx `auth_request` 통합을 거쳐 최종 feature에서 backend no-publish와
+내부 shared-secret 검증을 함께 적용합니다.
+
+## 두 번째 단계: Nginx `auth_request`
+
+`feature/keycloak-nginx-auth-request-integration`부터 외부 진입점은
+`http://localhost:8088` Nginx 하나입니다. oauth2-proxy의 4180 포트는
+Compose 네트워크에만 expose됩니다.
+
+- Nginx의 정확 일치 `location = /oauth2/auth`는 `internal`이라 외부에서
+  직접 호출할 수 없습니다.
+- 인증 서브리퀘스트에는 본문을 보내지 않고 `Content-Length`도
+  비웁니다.
+- 일반 브라우저 요청의 401은 `/oauth2/start` 302로 변환합니다.
+- API 요청 `/api/edge`는 redirect하지 않고 JSON 401을 반환합니다.
+- 인증 성공 시 oauth2-proxy의 `X-Auth-Request-User`와 email만 backend로
+  전달합니다.
+
+Nginx 컨테이너 IP를 전용 Compose subnet에서 고정하고 oauth2-proxy의
+trusted proxy를 그 단일 IP로 제한합니다. 다만 이 단계에서는 backend
+8081이 로컬 호스트에 열려 있어 신뢰 헤더를 직접 위조할 수 있습니다.
+그 재현 조건은 마지막 feature에서 제거합니다.
+
+## 마지막 단계: 신뢰 경계와 헤더 스푸핑 방어
+
+`feature/keycloak-header-spoofing-defense`에서는 신뢰 경계를 실제
+네트워크와 application 양쪽에서 강제합니다.
+
+1. backend 8081과 oauth2-proxy 4180은 host에 publish하지 않습니다.
+   브라우저가 접근 가능한 application 포트는 Nginx 8088뿐입니다.
+2. Nginx는 client가 보낸 `X-Auth-Request-User`, email, 내부 토큰을
+   그대로 전달하지 않고 oauth2-proxy 결과와 server-side 토큰으로
+   항상 덮어씁니다.
+3. backend는 `X-Auth-Request-User`와 `X-Internal-Auth-Token`이 모두
+   유효할 때만 edge identity를 받아들이며 token은 constant-time으로
+   비교합니다.
+
+shared token은 방어 심층화 수단입니다. 운영에서는 Secret Manager나
+orchestrator secret으로 주입하고 주기적으로 교체해야 합니다. 서비스
+간 mTLS 또는 service mesh identity를 사용할 수 있다면 단순 shared
+token보다 강한 workload identity로 대체하는 편이 좋습니다.

e2e/package-lock.json

@@ -0,0 +1,28 @@
+{
+  "name": "keycloak-pattern-e2e",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "keycloak-pattern-e2e",
+      "version": "1.0.0",
+      "devDependencies": {
+        "playwright-core": "1.62.0"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.62.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.0.tgz",
+      "integrity": "sha512-nsNRyq0r2zsG8AcRHWknc9QRA5XCueC7gWMrs+Gx2tlZn9hcl8zudfh00lhJPY1DE7NmZ6bDsT9g2yey8mXljA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    }
+  }
+}

e2e/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "keycloak-pattern-e2e",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "test:pattern4": "node pattern4.mjs"
+  },
+  "devDependencies": {
+    "playwright-core": "1.62.0"
+  }
+}

e2e/pattern4.mjs

@@ -0,0 +1,138 @@
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+
+const password = process.env.E2E_PASSWORD;
+assert.ok(password, "E2E_PASSWORD must be set");
+
+const edgeBaseUrl = "http://localhost:8088";
+const edgeEntryUrl = `${edgeBaseUrl}/`;
+
+async function completeKeycloakLogin(page) {
+  for (let attempt = 1; attempt <= 2; attempt += 1) {
+    await page.locator("#username").fill(
+      process.env.E2E_USERNAME ?? "regular-user",
+    );
+    await page.locator("#password").fill(password);
+    await page.locator("#kc-login").click();
+    await page.waitForLoadState("domcontentloaded");
+
+    if (page.url() === edgeEntryUrl) {
+      return;
+    }
+    if (attempt === 1) {
+      await page.goto(`${edgeBaseUrl}/oauth2/start?rd=${encodeURIComponent(edgeEntryUrl)}`);
+      await page.waitForURL(/localhost:8080/u);
+    }
+  }
+  throw new Error(`Keycloak login did not return to AP4: ${page.url()}`);
+}
+
+const browser = await chromium.launch({
+  executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
+  headless: true,
+  args: ["--no-sandbox"],
+});
+
+try {
+  const context = await browser.newContext();
+  const page = await context.newPage();
+  const browserRequests = [];
+  page.on("request", (request) =>
+    browserRequests.push({ method: request.method(), url: request.url() }),
+  );
+
+  const edgeResponsePromise = page.waitForResponse(
+    (response) =>
+      response.url() === edgeEntryUrl &&
+      response.status() === 302,
+  );
+  const authorizationRequestPromise = page.waitForRequest((request) =>
+    request.url().includes(
+      "/protocol/openid-connect/auth?approval_prompt=",
+    ),
+  );
+  await page.goto(edgeEntryUrl);
+  const unauthenticatedEdgeResponse = await edgeResponsePromise;
+  assert.equal(unauthenticatedEdgeResponse.status(), 302);
+
+  const authorizationRequest = await authorizationRequestPromise;
+  const authorizationUrl = new URL(authorizationRequest.url());
+  assert.equal(authorizationUrl.searchParams.get("client_id"), "edge-proxy");
+  assert.equal(authorizationUrl.searchParams.get("code_challenge_method"), "S256");
+  assert.ok(authorizationUrl.searchParams.get("code_challenge"));
+
+  await page.waitForURL(/localhost:8080/u);
+  await completeKeycloakLogin(page);
+  const edgeIdentity = JSON.parse(await page.locator("body").innerText());
+  assert.equal(edgeIdentity.pattern, "AP4-edge-forward-auth");
+  assert.ok(edgeIdentity.user);
+  assert.equal(edgeIdentity.identityHeader, "X-Auth-Request-User");
+
+  const callbackRequest = browserRequests.find(({ url }) =>
+    url.startsWith(`${edgeBaseUrl}/oauth2/callback?`),
+  );
+  assert.ok(callbackRequest);
+  assert.equal(callbackRequest.method, "GET");
+  assert.equal(
+    browserRequests.some(({ url }) =>
+      url.includes("/protocol/openid-connect/token"),
+    ),
+    false,
+    "the confidential token exchange must be server-to-server",
+  );
+
+  const cookies = await context.cookies(edgeEntryUrl);
+  const sessionCookie = cookies.find((cookie) => cookie.name === "AP4_SESSION");
+  assert.ok(sessionCookie);
+  assert.equal(sessionCookie.httpOnly, true);
+  assert.equal(sessionCookie.sameSite, "Lax");
+  assert.equal(sessionCookie.secure, false);
+
+  const storage = await page.evaluate(() => ({
+    localStorage: Object.values(localStorage),
+    sessionStorage: Object.values(sessionStorage),
+    readableCookies: document.cookie,
+  }));
+  assert.deepEqual(storage.localStorage, []);
+  assert.deepEqual(storage.sessionStorage, []);
+  assert.equal(storage.readableCookies.includes("AP4_SESSION"), false);
+
+  const spoofAttempt = await page.evaluate(async () => {
+    const response = await fetch("/", {
+      headers: {
+        "X-Auth-Request-User": "spoofed-admin",
+        "X-Auth-Request-Email": "spoofed-admin@example.test",
+        "X-Internal-Auth-Token": "attacker-controlled-token",
+      },
+    });
+    return { status: response.status, body: await response.json() };
+  });
+  assert.equal(spoofAttempt.status, 200);
+  assert.equal(spoofAttempt.body.user, edgeIdentity.user);
+  assert.notEqual(spoofAttempt.body.user, "spoofed-admin");
+
+  const externalAuthSubrequest = await fetch(`${edgeBaseUrl}/oauth2/auth`);
+  assert.equal(externalAuthSubrequest.status, 404);
+
+  const apiResponse = await fetch(`${edgeBaseUrl}/api/edge`, {
+    redirect: "manual",
+  });
+  assert.equal(apiResponse.status, 401);
+  assert.equal(apiResponse.headers.get("location"), null);
+
+  await assert.rejects(
+    fetch("http://localhost:4180/ping"),
+    "oauth2-proxy must not be published on the host",
+  );
+
+  await assert.rejects(
+    fetch("http://localhost:8081/edge/me"),
+    "backend must not be published on the host",
+  );
+
+  console.log(
+    "pattern4 hardened edge verified: auth_request, no backend publish, spoofed headers overwritten",
+  );
+} finally {
+  await browser.close();
+}

frontend/Dockerfile

@@ -0,0 +1,4 @@
+FROM nginx:1.29-alpine
+
+COPY default.conf.template /etc/nginx/templates/default.conf.template
+COPY index.html /usr/share/nginx/html/index.html

frontend/default.conf.template

@@ -0,0 +1,75 @@
+server {
+    listen 80;
+    server_name _;
+
+    large_client_header_buffers 4 16k;
+
+    location = /health {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    location = /oauth2/auth {
+        internal;
+        proxy_pass http://oauth2-proxy:4180;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+    }
+
+    location /oauth2/ {
+        proxy_pass http://oauth2-proxy:4180;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Auth-Request-Redirect $scheme://$http_host$request_uri;
+    }
+
+    location = /api/edge {
+        auth_request /oauth2/auth;
+        error_page 401 = @api_unauthorized;
+
+        auth_request_set $auth_user $upstream_http_x_auth_request_user;
+        auth_request_set $auth_email $upstream_http_x_auth_request_email;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie always;
+
+        proxy_pass http://app:8081/edge/me;
+        proxy_set_header X-Auth-Request-User $auth_user;
+        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
+    }
+
+    location / {
+        auth_request /oauth2/auth;
+        error_page 401 = @oauth2_signin;
+
+        auth_request_set $auth_user $upstream_http_x_auth_request_user;
+        auth_request_set $auth_email $upstream_http_x_auth_request_email;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie always;
+
+        proxy_pass http://app:8081/edge/me;
+        proxy_set_header X-Auth-Request-User $auth_user;
+        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
+    }
+
+    location @oauth2_signin {
+        return 302 $scheme://$http_host/oauth2/start?rd=$scheme://$http_host$request_uri;
+    }
+
+    location @api_unauthorized {
+        default_type application/json;
+        return 401 '{"error":"authentication required"}';
+    }
+}

frontend/index.html

@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="ko">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Keycloak Authentication Patterns</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      font-family: system-ui, sans-serif;
+    }
+    body {
+      max-width: 48rem;
+      margin: 8vh auto;
+      padding: 0 1.5rem;
+      line-height: 1.6;
+    }
+    code {
+      padding: 0.15rem 0.35rem;
+      border-radius: 0.25rem;
+      background: color-mix(in srgb, CanvasText 10%, Canvas);
+    }
+  </style>
+</head>
+<body>
+  <h1>Keycloak Authentication Patterns</h1>
+  <p>공통 Docker Compose baseline이 실행 중입니다.</p>
+  <p>
+    공개 API는 <code>/api/public</code>, 보호 API는
+    <code>/api/me</code>에서 확인할 수 있습니다.
+  </p>
+</body>
+</html>

keycloak/import/.gitkeep

@@ -0,0 +1 @@
+

keycloak/import/keycloak-patterns-realm.json

@@ -0,0 +1,166 @@
+{
+  "realm": "keycloak-patterns",
+  "displayName": "Keycloak Authentication Patterns",
+  "enabled": true,
+  "sslRequired": "external",
+  "registrationAllowed": false,
+  "resetPasswordAllowed": false,
+  "editUsernameAllowed": false,
+  "loginWithEmailAllowed": true,
+  "duplicateEmailsAllowed": false,
+  "bruteForceProtected": true,
+  "accessTokenLifespan": 300,
+  "ssoSessionIdleTimeout": 1800,
+  "ssoSessionMaxLifespan": 36000,
+  "offlineSessionIdleTimeout": 2592000,
+  "revokeRefreshToken": true,
+  "refreshTokenMaxReuse": 0,
+  "roles": {
+    "realm": [
+      {
+        "name": "admin-role",
+        "description": "Administrative role used by authorization examples"
+      },
+      {
+        "name": "user-role",
+        "description": "Regular authenticated user role"
+      }
+    ]
+  },
+  "clients": [
+    {
+      "clientId": "spa-public",
+      "name": "AP1 SPA Public Client",
+      "description": "Browser-based OAuth client using Authorization Code and PKCE",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": true,
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8088/*",
+        "http://127.0.0.1:8088/*"
+      ],
+      "webOrigins": [
+        "http://localhost:8088",
+        "http://127.0.0.1:8088"
+      ],
+      "attributes": {
+        "pkce.code.challenge.method": "S256",
+        "post.logout.redirect.uris": "http://localhost:8088/*##http://127.0.0.1:8088/*"
+      }
+    },
+    {
+      "clientId": "token-mediating-confidential",
+      "name": "AP2 Token-Mediating Backend",
+      "description": "Confidential backend that keeps refresh tokens server-side",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${TOKEN_MEDIATING_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8082/login/oauth2/code/keycloak"
+      ],
+      "webOrigins": [
+        "http://localhost:8082"
+      ],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:8082/*"
+      }
+    },
+    {
+      "clientId": "bff-confidential",
+      "name": "AP3 Backend-for-Frontend",
+      "description": "Confidential BFF that keeps all OAuth tokens server-side",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${BFF_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8083/login/oauth2/code/keycloak"
+      ],
+      "webOrigins": [
+        "http://localhost:8083"
+      ],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:8083/*"
+      }
+    },
+    {
+      "clientId": "edge-proxy",
+      "name": "AP4 Edge Forward Auth",
+      "description": "Confidential oauth2-proxy OIDC client",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${EDGE_PROXY_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8088/oauth2/callback"
+      ],
+      "webOrigins": [],
+      "attributes": {
+        "pkce.code.challenge.method": "S256",
+        "post.logout.redirect.uris": "http://localhost:8088/*"
+      }
+    }
+  ],
+  "users": [
+    {
+      "username": "admin-user",
+      "enabled": true,
+      "email": "admin-user@example.test",
+      "emailVerified": true,
+      "firstName": "Admin",
+      "lastName": "User",
+      "realmRoles": [
+        "admin-role"
+      ],
+      "credentials": [
+        {
+          "type": "password",
+          "value": "${ADMIN_USER_PASSWORD}",
+          "temporary": false
+        }
+      ]
+    },
+    {
+      "username": "regular-user",
+      "enabled": true,
+      "email": "regular-user@example.test",
+      "emailVerified": true,
+      "firstName": "Regular",
+      "lastName": "User",
+      "realmRoles": [
+        "user-role"
+      ],
+      "credentials": [
+        {
+          "type": "password",
+          "value": "${REGULAR_USER_PASSWORD}",
+          "temporary": false
+        }
+      ]
+    }
+  ]
+}

scripts/export-realm.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+output_dir=${REALM_EXPORT_DIR:-"$(pwd)/build/keycloak-export"}
+output_file="$output_dir/keycloak-patterns-realm.json"
+
+mkdir -p "$output_dir"
+
+restart_keycloak() {
+  trap - EXIT INT TERM
+  docker compose -f "$compose_file" up -d --wait >/dev/null
+}
+trap restart_keycloak EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+docker compose -f "$compose_file" stop keycloak >/dev/null
+docker compose -f "$compose_file" run --rm --no-deps \
+  --volume "$output_dir:/opt/keycloak/data/export" \
+  keycloak \
+    export \
+    --realm keycloak-patterns \
+    --file /opt/keycloak/data/export/keycloak-patterns-realm.json \
+    --users same_file
+
+chmod 600 "$output_file"
+python3 scripts/validate-realm.py --runtime "$output_file"
+
+echo "runtime realm export written to $output_file"

scripts/validate-realm.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""Validate the committed realm template or a runtime Keycloak CLI export."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+REALM_NAME = "keycloak-patterns"
+PUBLIC_CLIENT = "spa-public"
+CONFIDENTIAL_CLIENTS = {
+    "token-mediating-confidential": "${TOKEN_MEDIATING_CLIENT_SECRET}",
+    "bff-confidential": "${BFF_CLIENT_SECRET}",
+    "edge-proxy": "${EDGE_PROXY_CLIENT_SECRET}",
+}
+EXPECTED_ROLES = {"admin-role", "user-role"}
+EXPECTED_USERS = {"admin-user", "regular-user"}
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "realm_file",
+        nargs="?",
+        type=Path,
+        default=Path("keycloak/import/keycloak-patterns-realm.json"),
+    )
+    parser.add_argument(
+        "--runtime",
+        action="store_true",
+        help="validate an expanded CLI export instead of the committed template",
+    )
+    return parser.parse_args()
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        raise SystemExit(f"realm validation failed: {message}")
+
+
+def indexed(items: list[dict[str, Any]], key: str) -> dict[str, dict[str, Any]]:
+    return {str(item[key]): item for item in items}
+
+
+def validate(path: Path, runtime: bool) -> None:
+    document = json.loads(path.read_text(encoding="utf-8"))
+    require(document.get("realm") == REALM_NAME, f"realm must be {REALM_NAME}")
+    require(document.get("enabled") is True, "realm must be enabled")
+    require(document.get("accessTokenLifespan") == 300, "access token TTL must be 300s")
+    require(document.get("revokeRefreshToken") is True, "refresh token rotation must be enabled")
+    require(document.get("refreshTokenMaxReuse") == 0, "refresh token max reuse must be 0")
+
+    clients = indexed(document.get("clients", []), "clientId")
+    expected_client_ids = {PUBLIC_CLIENT, *CONFIDENTIAL_CLIENTS}
+    require(expected_client_ids <= clients.keys(), "all four pattern clients must exist")
+    if not runtime:
+        require(clients.keys() == expected_client_ids, "template must declare exactly four clients")
+
+    spa = clients[PUBLIC_CLIENT]
+    require(spa.get("publicClient") is True, "spa-public must be a public client")
+    require("secret" not in spa, "spa-public must not have a client secret")
+    require(spa.get("standardFlowEnabled") is True, "spa-public standard flow must be enabled")
+    require(
+        spa.get("directAccessGrantsEnabled") is False,
+        "spa-public direct access grants must be disabled",
+    )
+    require(
+        spa.get("attributes", {}).get("pkce.code.challenge.method") == "S256",
+        "spa-public must enforce PKCE S256",
+    )
+
+    for client_id, placeholder in CONFIDENTIAL_CLIENTS.items():
+        client = clients[client_id]
+        require(client.get("publicClient") is False, f"{client_id} must be confidential")
+        require(
+            client.get("clientAuthenticatorType") == "client-secret",
+            f"{client_id} must use client-secret authentication",
+        )
+        secret = client.get("secret")
+        if runtime:
+            require(isinstance(secret, str) and len(secret) >= 16, f"{client_id} secret missing")
+            require(not secret.startswith("${"), f"{client_id} placeholder was not resolved")
+        else:
+            require(secret == placeholder, f"{client_id} must use an env placeholder")
+
+    roles = {
+        role["name"]
+        for role in document.get("roles", {}).get("realm", [])
+        if "name" in role
+    }
+    require(EXPECTED_ROLES <= roles, "admin-role and user-role must exist")
+
+    users = indexed(document.get("users", []), "username")
+    require(EXPECTED_USERS <= users.keys(), "both baseline users must exist")
+    if not runtime:
+        expected_passwords = {
+            "admin-user": "${ADMIN_USER_PASSWORD}",
+            "regular-user": "${REGULAR_USER_PASSWORD}",
+        }
+        for username, placeholder in expected_passwords.items():
+            credentials = users[username].get("credentials", [])
+            require(len(credentials) == 1, f"{username} must have one initial credential")
+            require(
+                credentials[0].get("value") == placeholder,
+                f"{username} password must use an env placeholder",
+            )
+
+    print(
+        f"realm validated: {REALM_NAME}, four pattern clients, "
+        f"{len(EXPECTED_ROLES)} roles, {len(EXPECTED_USERS)} users"
+    )
+
+
+if __name__ == "__main__":
+    arguments = parse_args()
+    validate(arguments.realm_file, arguments.runtime)

scripts/verify-pattern4.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env; copy .env.example and set development values" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+docker compose down --volumes --remove-orphans
+docker compose up --build -d --wait
+
+docker compose exec -T nginx nginx -V 2>&1 |
+  grep -q -- '--with-http_auth_request_module'
+docker compose exec -T nginx nginx -T 2>&1 |
+  grep -q 'proxy_pass_request_body off'
+
+app_container_id="$(docker compose ps -q app)"
+published_app_port="$(docker inspect "$app_container_id" \
+  --format '{{with (index .NetworkSettings.Ports "8081/tcp")}}{{json .}}{{end}}')"
+if [ -n "$published_app_port" ]; then
+  echo "backend port 8081 must not be published on the host" >&2
+  exit 1
+fi
+
+if docker compose exec -T nginx wget -q -O /dev/null \
+  --header 'X-Auth-Request-User: spoofed-admin' \
+  http://app:8081/edge/me 2>/dev/null; then
+  echo "backend accepted a forged identity without the internal token" >&2
+  exit 1
+fi
+
+npm --prefix e2e ci
+E2E_USERNAME=regular-user \
+E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
+  npm --prefix e2e run test:pattern4
+
+echo "AP4 hardened Nginx auth_request edge flow verified"

scripts/verify-realm.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+
+python3 scripts/validate-realm.py
+./scripts/verify-stack.sh
+
+curl --fail --silent --show-error --output /dev/null \
+  "http://localhost:8080/realms/keycloak-patterns/.well-known/openid-configuration"
+
+docker compose -f "$compose_file" exec -T keycloak sh -ec '
+  kcadm=/opt/keycloak/bin/kcadm.sh
+  "$kcadm" config credentials \
+    --server http://localhost:8080 \
+    --realm master \
+    --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null
+
+  clients=$("$kcadm" get clients -r keycloak-patterns --fields clientId)
+  for client in \
+    spa-public \
+    token-mediating-confidential \
+    bff-confidential \
+    edge-proxy
+  do
+    printf "%s" "$clients" | grep -q "\"$client\""
+  done
+
+  users=$("$kcadm" get users -r keycloak-patterns --fields username)
+  printf "%s" "$users" | grep -q "\"admin-user\""
+  printf "%s" "$users" | grep -q "\"regular-user\""
+
+  roles=$("$kcadm" get roles -r keycloak-patterns --fields name)
+  printf "%s" "$roles" | grep -q "\"admin-role\""
+  printf "%s" "$roles" | grep -q "\"user-role\""
+'
+
+echo "realm verified: import, discovery, four clients, two roles, two users"

scripts/verify-stack.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+nginx_port=${NGINX_PORT:-8088}
+
+wait_for_url() {
+  name=$1
+  url=$2
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    if curl --fail --silent --show-error --output /dev/null "$url"; then
+      return 0
+    fi
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$name did not become ready: $url" >&2
+  return 1
+}
+
+assert_healthy() {
+  service=$1
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    container_id=$(docker compose -f "$compose_file" ps --quiet "$service")
+
+    if [ -n "$container_id" ]; then
+      health=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")
+      if [ "$health" = "healthy" ]; then
+        return 0
+      fi
+    else
+      health="not-running"
+    fi
+
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$service is not healthy: $health" >&2
+  return 1
+}
+
+for service in postgres keycloak app nginx; do
+  assert_healthy "$service"
+done
+
+wait_for_url "Keycloak discovery" \
+  "http://localhost:8080/realms/master/.well-known/openid-configuration"
+wait_for_url "Spring Boot health" "http://localhost:8081/actuator/health"
+wait_for_url "nginx health" "http://localhost:${nginx_port}/health"
+wait_for_url "public API" "http://localhost:${nginx_port}/api/public"
+
+protected_status=$(curl --silent --output /dev/null --write-out '%{http_code}' \
+  "http://localhost:${nginx_port}/api/me")
+if [ "$protected_status" != "401" ]; then
+  echo "expected unauthenticated /api/me to return 401, got $protected_status" >&2
+  exit 1
+fi
+
+echo "baseline stack verified: 4 healthy services, public 200, protected 401"