docs: add 39-branch Keycloak governance index

.env.example

@@ -0,0 +1,17 @@
+# Copy this file to .env and replace every change-me value.
+KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KC_BOOTSTRAP_ADMIN_PASSWORD=change-me-admin-password
+
+POSTGRES_DB=keycloak
+POSTGRES_USER=keycloak
+POSTGRES_PASSWORD=change-me-postgres-password
+
+# Keycloak resolves these placeholders while importing the realm.
+TOKEN_MEDIATING_CLIENT_SECRET=change-me-token-mediating-client-secret
+BFF_CLIENT_SECRET=change-me-bff-client-secret
+EDGE_PROXY_CLIENT_SECRET=change-me-edge-proxy-client-secret
+ADMIN_USER_PASSWORD=change-me-admin-user-password
+REGULAR_USER_PASSWORD=change-me-regular-user-password
+
+# Port 80 is the single-EC2 target. 8088 avoids common local port conflicts.
+NGINX_PORT=8088

.gitignore

@@ -0,0 +1,10 @@
+.env
+.idea/
+.vscode/
+*.iml
+
+backend/target/
+build/
+e2e/node_modules/
+frontend/node_modules/
+frontend/dist/

README.md

@@ -1,2 +1,101 @@
-# keycloak-pattern
+# Keycloak Authentication Patterns
 
+The 39-branch implementation registry is documented in
+[`docs/keycloak-branch-index.md`](docs/keycloak-branch-index.md).
+
+Keycloak을 중심으로 네 가지 브라우저 인증 통합 패턴을 같은 로컬
+인프라에서 비교하는 학습 프로젝트입니다.
+
+- AP1: Browser-based OAuth Client (SPA direct + Resource Server)
+- AP2: Token-Mediating Backend
+- AP3: Backend-for-Frontend (BFF)
+- AP4: Edge forward-auth
+
+현재 `develop`의 공통 baseline은 Keycloak, PostgreSQL, Spring Boot API,
+nginx를 Docker Compose로 실행하는 토대입니다. 패턴별 구현은 이 baseline
+위에서 별도 브랜치로 진행합니다.
+
+## 요구 사항
+
+- Docker Engine
+- Docker Compose
+- `curl`
+
+로컬 Java나 Maven은 필요하지 않습니다. Spring Boot 빌드와 테스트는 Maven
+컨테이너에서 수행합니다.
+
+## 시작
+
+```bash
+cp .env.example .env
+docker compose up --build -d
+./scripts/verify-stack.sh
+```
+
+기본 주소는 다음과 같습니다.
+
+| 구성 요소 | 주소 |
+|---|---|
+| Keycloak | <http://localhost:8080> |
+| Spring Boot API | <http://localhost:8081> |
+| nginx | <http://localhost:8088> |
+
+host의 80번 포트를 쓸 수 있는 single-EC2 환경에서는 `.env`의
+`NGINX_PORT=80`으로 변경할 수 있습니다.
+
+## 상태 확인
+
+```bash
+docker compose ps
+docker compose logs -f keycloak
+curl http://localhost:8088/api/public
+curl -i http://localhost:8088/api/me
+```
+
+`/api/public`은 `200`, 인증 정보가 없는 `/api/me`는 `401`이 정상입니다.
+
+## 환경 초기화
+
+PostgreSQL과 Keycloak data volume을 제거하고 realm import부터 다시
+검증하려면 다음 한 줄을 사용합니다.
+
+```bash
+docker compose down -v && docker compose up --build -d
+```
+
+`start-dev`와 로컬 HTTP 설정은 학습 전용입니다. 운영 환경에서는
+optimized Keycloak image, HTTPS, 엄격한 hostname 및 외부 secret store를
+사용해야 합니다.
+
+## Realm baseline
+
+`keycloak/import/keycloak-patterns-realm.json`은 시작 시 자동 import됩니다.
+하나의 `keycloak-patterns` realm 안에서 패턴마다 client를 분리합니다.
+
+| Client | 유형 | 패턴 |
+|---|---|---|
+| `spa-public` | public + PKCE S256 | AP1 |
+| `token-mediating-confidential` | confidential | AP2 |
+| `bff-confidential` | confidential | AP3 |
+| `edge-proxy` | confidential | AP4 |
+
+confidential client secret과 테스트 사용자 password는 JSON에 평문으로
+저장하지 않습니다. JSON에는 `${ENVIRONMENT_VARIABLE}` placeholder만
+커밋하고, Keycloak 26.7.0이 import 시 `.env` 값을 주입합니다.
+
+```bash
+python3 scripts/validate-realm.py
+docker compose down -v
+docker compose up -d --wait
+./scripts/verify-realm.sh
+```
+
+실행 중인 DB에서 CLI realm export를 재현하려면 다음 명령을 사용합니다.
+Keycloak을 잠시 중지하고 export한 뒤 자동으로 다시 올립니다.
+
+```bash
+./scripts/export-realm.sh
+```
+
+runtime export에는 실제 client secret과 credential hash가 포함될 수 있어
+gitignored `build/keycloak-export/`에 권한 `0600`으로만 저장됩니다.

backend/.dockerignore

@@ -0,0 +1 @@
+target/

backend/Dockerfile

@@ -0,0 +1,19 @@
+FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
+
+WORKDIR /workspace
+COPY pom.xml .
+RUN mvn --batch-mode dependency:go-offline
+
+COPY src src
+RUN mvn --batch-mode verify
+
+FROM eclipse-temurin:21-jre-alpine
+
+RUN addgroup -S spring && adduser -S spring -G spring
+USER spring:spring
+
+WORKDIR /app
+COPY --from=build /workspace/target/keycloak-pattern-api.jar app.jar
+
+EXPOSE 8081
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]

backend/pom.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.5.16</version>
+        <relativePath/>
+    </parent>
+
+    <groupId>com.example</groupId>
+    <artifactId>keycloak-pattern-api</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+    <name>keycloak-pattern-api</name>
+    <description>Shared resource API for the Keycloak authentication patterns</description>
+
+    <properties>
+        <java.version>21</java.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>keycloak-pattern-api</finalName>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>

backend/src/main/java/com/example/keycloakpattern/ApiController.java

@@ -0,0 +1,30 @@
+package com.example.keycloakpattern;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api")
+public class ApiController {
+
+    @GetMapping("/public")
+    public Map<String, String> publicEndpoint() {
+        return Map.of("status", "ok", "service", "keycloak-pattern-api");
+    }
+
+    @GetMapping("/me")
+    public Map<String, Object> currentUser(@AuthenticationPrincipal Jwt jwt) {
+        Map<String, Object> response = new LinkedHashMap<>();
+        response.put("subject", jwt.getSubject());
+        response.put("username", jwt.getClaimAsString("preferred_username"));
+        response.put("issuer", jwt.getIssuer());
+        response.put("audience", jwt.getAudience());
+        return response;
+    }
+}

backend/src/main/java/com/example/keycloakpattern/KeycloakPatternApplication.java

@@ -0,0 +1,12 @@
+package com.example.keycloakpattern;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class KeycloakPatternApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(KeycloakPatternApplication.class, args);
+    }
+}

backend/src/main/java/com/example/keycloakpattern/SecurityConfig.java

@@ -0,0 +1,27 @@
+package com.example.keycloakpattern;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
+        return http
+            .csrf(csrf -> csrf.disable())
+            .sessionManagement(session ->
+                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(authorize -> authorize
+                .requestMatchers("/actuator/health", "/actuator/health/**", "/api/public")
+                .permitAll()
+                .anyRequest()
+                .authenticated())
+            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
+            .build();
+    }
+}

backend/src/main/resources/application.yml

@@ -0,0 +1,22 @@
+server:
+  port: ${SERVER_PORT:8081}
+
+spring:
+  application:
+    name: keycloak-pattern-api
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:http://localhost:8080/realms/keycloak-patterns}
+          jwk-set-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI:http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/certs}
+
+management:
+  endpoint:
+    health:
+      probes:
+        enabled: true
+  endpoints:
+    web:
+      exposure:
+        include: health,info

backend/src/test/java/com/example/keycloakpattern/ApiSecurityTest.java

@@ -0,0 +1,43 @@
+package com.example.keycloakpattern;
+
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.web.servlet.MockMvc;
+
+@SpringBootTest
+@AutoConfigureMockMvc
+class ApiSecurityTest {
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Test
+    void publicEndpointDoesNotRequireAuthentication() throws Exception {
+        mockMvc.perform(get("/api/public"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.status").value("ok"));
+    }
+
+    @Test
+    void protectedEndpointRejectsAnonymousRequests() throws Exception {
+        mockMvc.perform(get("/api/me"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void protectedEndpointAcceptsJwtAuthentication() throws Exception {
+        mockMvc.perform(get("/api/me").with(jwt().jwt(token -> token
+                .subject("test-subject")
+                .claim("preferred_username", "regular-user"))))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.subject").value("test-subject"))
+            .andExpect(jsonPath("$.username").value("regular-user"));
+    }
+}

docker-compose.yml

@@ -0,0 +1,114 @@
+name: keycloak-patterns
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-keycloak}
+      POSTGRES_USER: ${POSTGRES_USER:-keycloak}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?copy .env.example to .env and set POSTGRES_PASSWORD}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.7.0
+    command:
+      - start-dev
+      - --import-realm
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-keycloak}
+      KC_DB_USERNAME: ${POSTGRES_USER:-keycloak}
+      KC_DB_PASSWORD: ${POSTGRES_PASSWORD:?copy .env.example to .env and set POSTGRES_PASSWORD}
+      KC_HOSTNAME: http://localhost:8080
+      KC_HTTP_ENABLED: "true"
+      KC_HEALTH_ENABLED: "true"
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME:?set KC_BOOTSTRAP_ADMIN_USERNAME in .env}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD:?set KC_BOOTSTRAP_ADMIN_PASSWORD in .env}
+      TOKEN_MEDIATING_CLIENT_SECRET: ${TOKEN_MEDIATING_CLIENT_SECRET:?set TOKEN_MEDIATING_CLIENT_SECRET in .env}
+      BFF_CLIENT_SECRET: ${BFF_CLIENT_SECRET:?set BFF_CLIENT_SECRET in .env}
+      EDGE_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
+      ADMIN_USER_PASSWORD: ${ADMIN_USER_PASSWORD:?set ADMIN_USER_PASSWORD in .env}
+      REGULAR_USER_PASSWORD: ${REGULAR_USER_PASSWORD:?set REGULAR_USER_PASSWORD in .env}
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - keycloak_data:/opt/keycloak/data
+      - ./keycloak/import:/opt/keycloak/data/import:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - bash
+        - -c
+        - "{ printf 'HEAD /health/ready HTTP/1.0\r\n\r\n' >&0; grep 'HTTP/1.0 200'; } 0<>/dev/tcp/localhost/9000"
+      interval: 10s
+      timeout: 5s
+      retries: 18
+      start_period: 60s
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  app:
+    build:
+      context: ./backend
+    environment:
+      SERVER_PORT: "8081"
+      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI: http://localhost:8080/realms/keycloak-patterns
+      SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
+    ports:
+      - "127.0.0.1:8081:8081"
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -q -O - http://127.0.0.1:8081/actuator/health | grep -q '"status":"UP"'
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+  nginx:
+    build:
+      context: ./frontend
+    ports:
+      - "127.0.0.1:${NGINX_PORT:-8088}:80"
+    depends_on:
+      app:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -q -O - http://127.0.0.1/health | grep -q '^ok$'
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    networks:
+      - keycloak-net
+    restart: unless-stopped
+
+volumes:
+  keycloak_data:
+  postgres_data:
+
+networks:
+  keycloak-net:
+    driver: bridge

docs/keycloak-branch-index.md

@@ -0,0 +1,29 @@
+# Keycloak branch implementation index
+
+The source inventory contains 39 `feature-keycloak-*.md` branch notes. This
+repository preserves one local Git feature branch for every note and merges it
+with `--no-ff` into either the common `develop` baseline or one of the four
+authentication-pattern branches.
+
+| Target | Meaning |
+|---|---|
+| `common` | Shared realm, federation, deployment, or governance contract. Merge into `develop`, then propagate to AP1–AP4. |
+| `ap1` | Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
+| `ap2` | Token-mediating confidential backend: browser receives access token only. |
+| `ap3` | BFF: backend owns every OAuth token and browser owns only a session cookie. |
+| `ap4` | Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
+
+The machine-readable registry is
+[`keycloak-branch-manifest.tsv`](keycloak-branch-manifest.tsv). Run:
+
+```bash
+./scripts/audit-keycloak-branches.sh
+```
+
+The audit succeeds only when all 39 note names have matching local feature
+branches and each feature tip is reachable from its declared target branch.
+
+Google credentials are never committed. The default local acceptance harness
+uses a second Keycloak realm as a controllable OIDC provider so claim mapping
+and unsafe-linking failure paths can be reproduced. A real Google login remains
+an explicit credentialed/public-HTTPS verification profile.

docs/keycloak-branch-manifest.tsv

@@ -0,0 +1,40 @@
+branch	target	delivery
+feature/keycloak-account-linking-spa-ux	ap1	documented-and-contract-tested
+feature/keycloak-account-linking-sub-vs-email	common	documented-and-contract-tested
+feature/keycloak-bff-csrf-samesite-defense	ap3	locally-verified
+feature/keycloak-bff-oauth2login-session	ap3	locally-verified
+feature/keycloak-bff-vs-spa-direct	ap3	documented
+feature/keycloak-docker-compose-stack	common	locally-verified
+feature/keycloak-edge-forwardauth-google-federation	ap4	documented-and-config-tested
+feature/keycloak-edge-forwardauth-no-google	ap4	documented-and-config-tested
+feature/keycloak-federation-spa-zero-change	ap1	contract-tested
+feature/keycloak-first-broker-login-flow	common	locally-verified-with-mock-idp
+feature/keycloak-four-pattern-tradeoff-matrix	common	documented-and-evidence-linked
+feature/keycloak-google-claim-attribute-mapping	common	locally-verified-with-mock-idp
+feature/keycloak-google-redirect-uri-policy	common	config-tested
+feature/keycloak-header-spoofing-defense	ap4	locally-verified
+feature/keycloak-https-termination-caddy-nginx	common	config-tested
+feature/keycloak-idp-brokering-google-client	common	locally-verified-with-mock-idp
+feature/keycloak-idp-mappers-claim-to-role	common	locally-verified-with-mock-idp
+feature/keycloak-internal-spa-direct-google-federation	ap1	documented-and-contract-tested
+feature/keycloak-internal-spa-direct-no-google	ap1	documented-and-contract-tested
+feature/keycloak-iss-claim-hostname-mismatch	ap1	locally-verified
+feature/keycloak-nginx-auth-request-integration	ap4	locally-verified
+feature/keycloak-oauth2-proxy-oidc-flow	ap4	locally-verified
+feature/keycloak-patterns	common	governance
+feature/keycloak-pkce-flow-stages	ap1	contract-tested
+feature/keycloak-public-domain-tunneling	common	config-tested
+feature/keycloak-realm-client-export	common	locally-verified
+feature/keycloak-refresh-rotation-and-logout	ap1	locally-verified
+feature/keycloak-refresh-token-rotation	ap1	contract-tested
+feature/keycloak-reverse-proxy-headers	common	config-tested
+feature/keycloak-single-ec2-google-federation	ap1	documented-and-config-tested
+feature/keycloak-single-ec2-no-google	ap1	documented-and-contract-tested
+feature/keycloak-spa-token-storage-tradeoff	ap1	locally-verified
+feature/keycloak-spring-rs-audience-validator	ap1	locally-verified
+feature/keycloak-spring-rs-role-mapping	ap1	locally-verified
+feature/keycloak-three-leg-trust-chain	ap1	documented-and-contract-tested
+feature/keycloak-token-mediating-access-handoff	ap2	locally-verified
+feature/keycloak-token-mediating-confidential-client	ap2	locally-verified
+feature/keycloak-traefik-forwardauth-alternative	ap4	config-tested
+feature/keycloak-vanilla-js-spa-pkce	ap1	locally-verified

frontend/Dockerfile

@@ -0,0 +1,4 @@
+FROM nginx:1.29-alpine
+
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY index.html /usr/share/nginx/html/index.html

frontend/index.html

@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="ko">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Keycloak Authentication Patterns</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      font-family: system-ui, sans-serif;
+    }
+    body {
+      max-width: 48rem;
+      margin: 8vh auto;
+      padding: 0 1.5rem;
+      line-height: 1.6;
+    }
+    code {
+      padding: 0.15rem 0.35rem;
+      border-radius: 0.25rem;
+      background: color-mix(in srgb, CanvasText 10%, Canvas);
+    }
+  </style>
+</head>
+<body>
+  <h1>Keycloak Authentication Patterns</h1>
+  <p>공통 Docker Compose baseline이 실행 중입니다.</p>
+  <p>
+    공개 API는 <code>/api/public</code>, 보호 API는
+    <code>/api/me</code>에서 확인할 수 있습니다.
+  </p>
+</body>
+</html>

frontend/nginx.conf

@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location = /health {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    location /api/ {
+        proxy_pass http://app:8081;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}

keycloak/import/.gitkeep

@@ -0,0 +1 @@
+

keycloak/import/keycloak-patterns-realm.json

@@ -0,0 +1,165 @@
+{
+  "realm": "keycloak-patterns",
+  "displayName": "Keycloak Authentication Patterns",
+  "enabled": true,
+  "sslRequired": "external",
+  "registrationAllowed": false,
+  "resetPasswordAllowed": false,
+  "editUsernameAllowed": false,
+  "loginWithEmailAllowed": true,
+  "duplicateEmailsAllowed": false,
+  "bruteForceProtected": true,
+  "accessTokenLifespan": 300,
+  "ssoSessionIdleTimeout": 1800,
+  "ssoSessionMaxLifespan": 36000,
+  "offlineSessionIdleTimeout": 2592000,
+  "revokeRefreshToken": true,
+  "refreshTokenMaxReuse": 0,
+  "roles": {
+    "realm": [
+      {
+        "name": "admin-role",
+        "description": "Administrative role used by authorization examples"
+      },
+      {
+        "name": "user-role",
+        "description": "Regular authenticated user role"
+      }
+    ]
+  },
+  "clients": [
+    {
+      "clientId": "spa-public",
+      "name": "AP1 SPA Public Client",
+      "description": "Browser-based OAuth client using Authorization Code and PKCE",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": true,
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8088/*",
+        "http://127.0.0.1:8088/*"
+      ],
+      "webOrigins": [
+        "http://localhost:8088",
+        "http://127.0.0.1:8088"
+      ],
+      "attributes": {
+        "pkce.code.challenge.method": "S256",
+        "post.logout.redirect.uris": "http://localhost:8088/*##http://127.0.0.1:8088/*"
+      }
+    },
+    {
+      "clientId": "token-mediating-confidential",
+      "name": "AP2 Token-Mediating Backend",
+      "description": "Confidential backend that keeps refresh tokens server-side",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${TOKEN_MEDIATING_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8082/login/oauth2/code/keycloak"
+      ],
+      "webOrigins": [
+        "http://localhost:8082"
+      ],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:8082/*"
+      }
+    },
+    {
+      "clientId": "bff-confidential",
+      "name": "AP3 Backend-for-Frontend",
+      "description": "Confidential BFF that keeps all OAuth tokens server-side",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${BFF_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:8083/login/oauth2/code/keycloak"
+      ],
+      "webOrigins": [
+        "http://localhost:8083"
+      ],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:8083/*"
+      }
+    },
+    {
+      "clientId": "edge-proxy",
+      "name": "AP4 Edge Forward Auth",
+      "description": "Confidential oauth2-proxy OIDC client",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${EDGE_PROXY_CLIENT_SECRET}",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": false,
+      "frontchannelLogout": true,
+      "redirectUris": [
+        "http://localhost:4180/oauth2/callback"
+      ],
+      "webOrigins": [],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:8088/*"
+      }
+    }
+  ],
+  "users": [
+    {
+      "username": "admin-user",
+      "enabled": true,
+      "email": "admin-user@example.test",
+      "emailVerified": true,
+      "firstName": "Admin",
+      "lastName": "User",
+      "realmRoles": [
+        "admin-role"
+      ],
+      "credentials": [
+        {
+          "type": "password",
+          "value": "${ADMIN_USER_PASSWORD}",
+          "temporary": false
+        }
+      ]
+    },
+    {
+      "username": "regular-user",
+      "enabled": true,
+      "email": "regular-user@example.test",
+      "emailVerified": true,
+      "firstName": "Regular",
+      "lastName": "User",
+      "realmRoles": [
+        "user-role"
+      ],
+      "credentials": [
+        {
+          "type": "password",
+          "value": "${REGULAR_USER_PASSWORD}",
+          "temporary": false
+        }
+      ]
+    }
+  ]
+}

scripts/audit-keycloak-branches.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+set -eu
+
+manifest="${1:-docs/keycloak-branch-manifest.tsv}"
+notes_dir="${KEYCLOAK_BRANCH_NOTES_DIR:-/home/donghyeon/workspace/ai-tools/llm-wiki/raw/branch-notes}"
+
+expected_count="$(awk 'NR > 1 { count += 1 } END { print count + 0 }' "$manifest")"
+if [ "$expected_count" -ne 39 ]; then
+  echo "manifest must contain exactly 39 Keycloak branches; found $expected_count" >&2
+  exit 1
+fi
+
+note_count="$(find "$notes_dir" -maxdepth 1 -type f -name 'feature-keycloak-*.md' | wc -l)"
+if [ "$note_count" -ne 39 ]; then
+  echo "branch-note inventory must contain exactly 39 files; found $note_count" >&2
+  exit 1
+fi
+
+missing=0
+unmerged=0
+tab="$(printf '\t')"
+
+while IFS="$tab" read -r branch target delivery; do
+  [ "$branch" = "branch" ] && continue
+
+  note_name="$(printf '%s\n' "$branch" |
+    sed 's#^feature/keycloak-#feature-keycloak-#').md"
+  if [ ! -f "$notes_dir/$note_name" ]; then
+    echo "missing branch note: $note_name" >&2
+    missing=$((missing + 1))
+  fi
+
+  if ! git show-ref --verify --quiet "refs/heads/$branch"; then
+    echo "missing local branch: $branch" >&2
+    missing=$((missing + 1))
+    continue
+  fi
+
+  case "$target" in
+    common) target_branch="develop" ;;
+    ap1) target_branch="develop-keycloak-pattern1" ;;
+    ap2) target_branch="develop-keycloak-pattern2" ;;
+    ap3) target_branch="develop-keycloak-pattern3" ;;
+    ap4) target_branch="develop-keycloak-pattern4" ;;
+    *)
+      echo "unknown target '$target' for $branch ($delivery)" >&2
+      exit 1
+      ;;
+  esac
+
+  if ! git merge-base --is-ancestor "$branch" "$target_branch"; then
+    echo "feature tip is not merged: $branch -> $target_branch" >&2
+    unmerged=$((unmerged + 1))
+  fi
+done < "$manifest"
+
+if [ "$missing" -ne 0 ] || [ "$unmerged" -ne 0 ]; then
+  echo "Keycloak branch audit failed: missing=$missing unmerged=$unmerged" >&2
+  exit 1
+fi
+
+echo "Keycloak branch audit passed: 39/39 branches exist and are merged"

scripts/export-realm.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+output_dir=${REALM_EXPORT_DIR:-"$(pwd)/build/keycloak-export"}
+output_file="$output_dir/keycloak-patterns-realm.json"
+
+mkdir -p "$output_dir"
+
+restart_keycloak() {
+  trap - EXIT INT TERM
+  docker compose -f "$compose_file" up -d --wait >/dev/null
+}
+trap restart_keycloak EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+docker compose -f "$compose_file" stop keycloak >/dev/null
+docker compose -f "$compose_file" run --rm --no-deps \
+  --volume "$output_dir:/opt/keycloak/data/export" \
+  keycloak \
+    export \
+    --realm keycloak-patterns \
+    --file /opt/keycloak/data/export/keycloak-patterns-realm.json \
+    --users same_file
+
+chmod 600 "$output_file"
+python3 scripts/validate-realm.py --runtime "$output_file"
+
+echo "runtime realm export written to $output_file"

scripts/validate-realm.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""Validate the committed realm template or a runtime Keycloak CLI export."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+REALM_NAME = "keycloak-patterns"
+PUBLIC_CLIENT = "spa-public"
+CONFIDENTIAL_CLIENTS = {
+    "token-mediating-confidential": "${TOKEN_MEDIATING_CLIENT_SECRET}",
+    "bff-confidential": "${BFF_CLIENT_SECRET}",
+    "edge-proxy": "${EDGE_PROXY_CLIENT_SECRET}",
+}
+EXPECTED_ROLES = {"admin-role", "user-role"}
+EXPECTED_USERS = {"admin-user", "regular-user"}
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "realm_file",
+        nargs="?",
+        type=Path,
+        default=Path("keycloak/import/keycloak-patterns-realm.json"),
+    )
+    parser.add_argument(
+        "--runtime",
+        action="store_true",
+        help="validate an expanded CLI export instead of the committed template",
+    )
+    return parser.parse_args()
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        raise SystemExit(f"realm validation failed: {message}")
+
+
+def indexed(items: list[dict[str, Any]], key: str) -> dict[str, dict[str, Any]]:
+    return {str(item[key]): item for item in items}
+
+
+def validate(path: Path, runtime: bool) -> None:
+    document = json.loads(path.read_text(encoding="utf-8"))
+    require(document.get("realm") == REALM_NAME, f"realm must be {REALM_NAME}")
+    require(document.get("enabled") is True, "realm must be enabled")
+    require(document.get("accessTokenLifespan") == 300, "access token TTL must be 300s")
+    require(document.get("revokeRefreshToken") is True, "refresh token rotation must be enabled")
+    require(document.get("refreshTokenMaxReuse") == 0, "refresh token max reuse must be 0")
+
+    clients = indexed(document.get("clients", []), "clientId")
+    expected_client_ids = {PUBLIC_CLIENT, *CONFIDENTIAL_CLIENTS}
+    require(expected_client_ids <= clients.keys(), "all four pattern clients must exist")
+    if not runtime:
+        require(clients.keys() == expected_client_ids, "template must declare exactly four clients")
+
+    spa = clients[PUBLIC_CLIENT]
+    require(spa.get("publicClient") is True, "spa-public must be a public client")
+    require("secret" not in spa, "spa-public must not have a client secret")
+    require(spa.get("standardFlowEnabled") is True, "spa-public standard flow must be enabled")
+    require(
+        spa.get("directAccessGrantsEnabled") is False,
+        "spa-public direct access grants must be disabled",
+    )
+    require(
+        spa.get("attributes", {}).get("pkce.code.challenge.method") == "S256",
+        "spa-public must enforce PKCE S256",
+    )
+
+    for client_id, placeholder in CONFIDENTIAL_CLIENTS.items():
+        client = clients[client_id]
+        require(client.get("publicClient") is False, f"{client_id} must be confidential")
+        require(
+            client.get("clientAuthenticatorType") == "client-secret",
+            f"{client_id} must use client-secret authentication",
+        )
+        secret = client.get("secret")
+        if runtime:
+            require(isinstance(secret, str) and len(secret) >= 16, f"{client_id} secret missing")
+            require(not secret.startswith("${"), f"{client_id} placeholder was not resolved")
+        else:
+            require(secret == placeholder, f"{client_id} must use an env placeholder")
+
+    roles = {
+        role["name"]
+        for role in document.get("roles", {}).get("realm", [])
+        if "name" in role
+    }
+    require(EXPECTED_ROLES <= roles, "admin-role and user-role must exist")
+
+    users = indexed(document.get("users", []), "username")
+    require(EXPECTED_USERS <= users.keys(), "both baseline users must exist")
+    if not runtime:
+        expected_passwords = {
+            "admin-user": "${ADMIN_USER_PASSWORD}",
+            "regular-user": "${REGULAR_USER_PASSWORD}",
+        }
+        for username, placeholder in expected_passwords.items():
+            credentials = users[username].get("credentials", [])
+            require(len(credentials) == 1, f"{username} must have one initial credential")
+            require(
+                credentials[0].get("value") == placeholder,
+                f"{username} password must use an env placeholder",
+            )
+
+    print(
+        f"realm validated: {REALM_NAME}, four pattern clients, "
+        f"{len(EXPECTED_ROLES)} roles, {len(EXPECTED_USERS)} users"
+    )
+
+
+if __name__ == "__main__":
+    arguments = parse_args()
+    validate(arguments.realm_file, arguments.runtime)

scripts/verify-realm.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+
+python3 scripts/validate-realm.py
+./scripts/verify-stack.sh
+
+curl --fail --silent --show-error --output /dev/null \
+  "http://localhost:8080/realms/keycloak-patterns/.well-known/openid-configuration"
+
+docker compose -f "$compose_file" exec -T keycloak sh -ec '
+  kcadm=/opt/keycloak/bin/kcadm.sh
+  "$kcadm" config credentials \
+    --server http://localhost:8080 \
+    --realm master \
+    --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null
+
+  clients=$("$kcadm" get clients -r keycloak-patterns --fields clientId)
+  for client in \
+    spa-public \
+    token-mediating-confidential \
+    bff-confidential \
+    edge-proxy
+  do
+    printf "%s" "$clients" | grep -q "\"$client\""
+  done
+
+  users=$("$kcadm" get users -r keycloak-patterns --fields username)
+  printf "%s" "$users" | grep -q "\"admin-user\""
+  printf "%s" "$users" | grep -q "\"regular-user\""
+
+  roles=$("$kcadm" get roles -r keycloak-patterns --fields name)
+  printf "%s" "$roles" | grep -q "\"admin-role\""
+  printf "%s" "$roles" | grep -q "\"user-role\""
+'
+
+echo "realm verified: import, discovery, four clients, two roles, two users"

scripts/verify-stack.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+nginx_port=${NGINX_PORT:-8088}
+
+wait_for_url() {
+  name=$1
+  url=$2
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    if curl --fail --silent --show-error --output /dev/null "$url"; then
+      return 0
+    fi
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$name did not become ready: $url" >&2
+  return 1
+}
+
+assert_healthy() {
+  service=$1
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    container_id=$(docker compose -f "$compose_file" ps --quiet "$service")
+
+    if [ -n "$container_id" ]; then
+      health=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")
+      if [ "$health" = "healthy" ]; then
+        return 0
+      fi
+    else
+      health="not-running"
+    fi
+
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$service is not healthy: $health" >&2
+  return 1
+}
+
+for service in postgres keycloak app nginx; do
+  assert_healthy "$service"
+done
+
+wait_for_url "Keycloak discovery" \
+  "http://localhost:8080/realms/master/.well-known/openid-configuration"
+wait_for_url "Spring Boot health" "http://localhost:8081/actuator/health"
+wait_for_url "nginx health" "http://localhost:${nginx_port}/health"
+wait_for_url "public API" "http://localhost:${nginx_port}/api/public"
+
+protected_status=$(curl --silent --output /dev/null --write-out '%{http_code}' \
+  "http://localhost:${nginx_port}/api/me")
+if [ "$protected_status" != "401" ]; then
+  echo "expected unauthenticated /api/me to return 401, got $protected_status" >&2
+  exit 1
+fi
+
+echo "baseline stack verified: 4 healthy services, public 200, protected 401"