Commit Graph

Select branches

Hide Pull Requests

develop

develop-keycloak-pattern1

develop-keycloak-pattern2

develop-keycloak-pattern3

develop-keycloak-pattern4

develop-keycloak-session-store

feature/keycloak-a1-jgroups-transport-block

feature/keycloak-a2-database-loss

feature/keycloak-a3-database-crash

feature/keycloak-a4-node-loss

feature/keycloak-a5-asymmetric-partition

feature/keycloak-a6-latency-injection

feature/keycloak-a7-volatile-comparison

feature/keycloak-a8-rolling-restart

feature/keycloak-account-linking-spa-ux

feature/keycloak-account-linking-sub-vs-email

feature/keycloak-b0-bff-redis-deploy

feature/keycloak-b1-redis-session-store

feature/keycloak-b2-multi-instance-session

feature/keycloak-b3-refresh-token-contention

feature/keycloak-b4-edge-authorization-scope

feature/keycloak-b5-redis-loss-persistence

feature/keycloak-b6-key-rotation

feature/keycloak-b7-cookie-secret-rotation

feature/keycloak-bff-csrf-samesite-defense

feature/keycloak-bff-oauth2login-session

feature/keycloak-bff-vs-spa-direct

feature/keycloak-c1-multi-app-sso

feature/keycloak-c2-backchannel-logout

feature/keycloak-d1-backup-restore

feature/keycloak-d2-version-upgrade

feature/keycloak-d3-secret-management

feature/keycloak-d4-certificate-renewal

feature/keycloak-d4a-deploy-hook

feature/keycloak-docker-compose-stack

feature/keycloak-edge-forwardauth-google-federation

feature/keycloak-edge-forwardauth-no-google

feature/keycloak-federation-spa-zero-change

feature/keycloak-first-broker-login-flow

feature/keycloak-followup-untested-items

feature/keycloak-four-pattern-tradeoff-matrix

feature/keycloak-google-claim-attribute-mapping

feature/keycloak-google-redirect-uri-policy

feature/keycloak-header-spoofing-defense

feature/keycloak-https-termination-caddy-nginx

feature/keycloak-idp-brokering-google-client

feature/keycloak-idp-mappers-claim-to-role

feature/keycloak-internal-spa-direct-google-federation

feature/keycloak-internal-spa-direct-no-google

feature/keycloak-iss-claim-hostname-mismatch

feature/keycloak-multinode-cluster-jdbc-ping

feature/keycloak-nginx-auth-request-integration

feature/keycloak-oauth2-proxy-oidc-flow

feature/keycloak-patterns

feature/keycloak-pkce-flow-stages

feature/keycloak-public-domain-tunneling

feature/keycloak-realm-client-export

feature/keycloak-refresh-rotation-and-logout

feature/keycloak-refresh-token-rotation

feature/keycloak-reverse-proxy-headers

feature/keycloak-single-ec2-google-federation

feature/keycloak-single-ec2-no-google

feature/keycloak-spa-token-storage-tradeoff

feature/keycloak-spring-rs-audience-validator

feature/keycloak-spring-rs-role-mapping

feature/keycloak-three-leg-trust-chain

feature/keycloak-token-mediating-access-handoff

feature/keycloak-token-mediating-confidential-client

feature/keycloak-traefik-forwardauth-alternative

feature/keycloak-vanilla-js-spa-pkce

main

Mono Color

• 9465582b5d chore: 실행 환경 구성 문서 추가 및 수정 feature/keycloak-d4a-deploy-hook DongHyeonka 2026-09-10 15:55:36 +09:00
• 6f6ab86345 docs(guides): reproduction guides for all 26 experiments DongHyeonkaandClaude Opus 5 2026-09-07 18:29:00 +09:00
• 8062cc9a19 docs(guides): bring the seven setup guides in line with the practitioner skill DongHyeonkaandClaude Opus 5 2026-09-07 17:33:31 +09:00
• 88b7bd4bf0 docs(guides): hands-on guides for the seven setup stages DongHyeonkaandClaude Opus 5 2026-09-07 16:48:10 +09:00
• cdac9b8178 docs: give the twelve experiments that had no architecture diagram one DongHyeonkaandClaude Opus 5 2026-09-04 21:44:36 +09:00
• a2f749292a docs: add architecture diagrams for the three follow-up experiments DongHyeonkaandClaude Opus 5 2026-09-04 21:37:00 +09:00
• e9baac21d5 docs(d4a): the deploy hook works — issuance to serving drops from 38m25s to 1-2s DongHyeonkaandClaude Opus 5 2026-09-04 21:35:00 +09:00
• 3d7778bd3c docs(d4): correct the gap to 38m25s — the two timestamps came from different clocks DongHyeonkaandClaude Opus 5 2026-09-04 21:33:01 +09:00
• 919547a025 docs(b7a): the orphan sessions can be deleted — oauth2-proxy just cannot do it DongHyeonkaandClaude Opus 5 2026-09-04 20:37:11 +09:00
• b9f4ef7bc2 docs(a7a): the volatile refresh failure is a client-scope lookup, not REVOKED_TOKEN DongHyeonkaandClaude Opus 5 2026-09-04 20:27:23 +09:00
• 9dbee18a42 docs(b4): item 3 is no longer unmeasured — link it to the follow-up result DongHyeonkaandClaude Opus 5 2026-09-04 18:10:43 +09:00
• 905392947d docs: close the three untested items — all three are now measured DongHyeonkaandClaude Opus 5 2026-09-04 18:10:04 +09:00
• faf55dc1be docs(d4): the renewal succeeded and was not served for 36 minutes 39 seconds DongHyeonkaandClaude Opus 5 2026-09-04 18:04:44 +09:00
• 0d84921a56 docs(d4): the renewal unit has no reload, and nginx has not reloaded in 22 hours DongHyeonkaandClaude Opus 5 2026-09-04 17:28:01 +09:00
• 716e62524a docs(d4): measure the controls before the injection that needs a password DongHyeonkaandClaude Opus 5 2026-09-04 17:12:31 +09:00
• 74c9b3cea7 docs: replace prose placeholders in reproduction steps with executable commands DongHyeonkaandClaude Opus 5 2026-09-04 17:01:40 +09:00
• f3f3a8da46 docs: re-measure B-4 role propagation and record it as evidence DongHyeonkaandClaude Opus 5 2026-09-04 16:54:05 +09:00
• e0d27d47ce docs: correct the places where documents contradicted their own evidence feature/keycloak-followup-untested-items DongHyeonkaandClaude Opus 5 2026-09-04 16:35:49 +09:00
• 78b270559c docs: add SVG diagrams, explicit concept sections and the diagram convention DongHyeonkaandClaude Opus 5 2026-09-04 16:20:05 +09:00
• 98a74e90a5 docs: fill the untested items and record why the B layer has no graphs DongHyeonkaandClaude Opus 5 2026-09-04 16:18:33 +09:00
• b5528fae87 docs: index all 23 experiments with what each measured feature/keycloak-d4-certificate-renewal DongHyeonkaandClaude Opus 5 2026-09-04 15:11:32 +09:00
• 4864d837f1 docs: D-4 — the certificate is fine and the renewal itself went untested DongHyeonkaandClaude Opus 5 2026-09-04 15:09:36 +09:00
• 027c24ee27 docs: D-3 — only RBAC actually hides anything feature/keycloak-d3-secret-management DongHyeonkaandClaude Opus 5 2026-09-04 15:07:35 +09:00
• df140ab218 docs: D-2 — rolling back the image does not roll back the schema feature/keycloak-d2-version-upgrade DongHyeonkaandClaude Opus 5 2026-09-04 15:05:36 +09:00
• df5af95cb3 docs: D-1 — an empty database still answered 200 feature/keycloak-d1-backup-restore DongHyeonkaandClaude Opus 5 2026-09-04 14:59:56 +09:00
• 6c310c93b7 docs: C-2 — nothing propagates because nobody implemented the receiving end feature/keycloak-c2-backchannel-logout DongHyeonkaandClaude Opus 5 2026-09-04 14:56:58 +09:00
• e856e7af4d docs: C-1 — killing the SSO session logs nobody out feature/keycloak-c1-multi-app-sso DongHyeonkaandClaude Opus 5 2026-09-04 14:49:36 +09:00
• bcb563a04e docs: B-7 — the cookie secret has no overlap window and rotation orphans sessions feature/keycloak-b7-cookie-secret-rotation DongHyeonkaandClaude Opus 5 2026-09-04 14:44:00 +09:00
• aa2c3907f5 docs: B-6 — rotation is safe, retiring the old key is not feature/keycloak-b6-key-rotation DongHyeonkaandClaude Opus 5 2026-09-04 14:33:42 +09:00
• f45a2a2aaa docs: B-5 — the pod stays Ready while every request hangs feature/keycloak-b5-redis-loss-persistence DongHyeonkaandClaude Opus 5 2026-09-04 14:29:17 +09:00
• 7dc0a3e5da docs: B-4 — the edge does not overwrite the headers it never sets feature/keycloak-b4-edge-authorization-scope DongHyeonkaandClaude Opus 5 2026-09-04 14:23:41 +09:00
• b16e1dccf7 docs: B-3 — concurrent refresh does not lose a race, it destroys the session feature/keycloak-b3-refresh-token-contention DongHyeonkaandClaude Opus 5 2026-09-04 14:20:04 +09:00
• 711878379c docs: B-2 — sharing the stores fixes one problem and exposes three more feature/keycloak-b2-multi-instance-session DongHyeonkaandClaude Opus 5 2026-09-04 14:15:05 +09:00
• f2595f748f docs: B-1 — Redis moves the session and leaves the tokens behind feature/keycloak-b1-redis-session-store DongHyeonkaandClaude Opus 5 2026-09-04 14:05:02 +09:00
• e62bbb4df0 docs: B-0 — deploy the BFF and read what autoconfiguration actually chose feature/keycloak-b0-bff-redis-deploy DongHyeonkaandClaude Opus 5 2026-09-04 13:48:33 +09:00
• 8f6d67df35 docs: A-7 — three results invert when persistent sessions are turned off feature/keycloak-a7-volatile-comparison DongHyeonkaandClaude Opus 5 2026-09-04 13:33:33 +09:00
• 114d21aebe docs: A-8 — a rolling restart keeps every session and drops only the cache feature/keycloak-a8-rolling-restart DongHyeonkaandClaude Opus 5 2026-09-04 13:20:56 +09:00
• dba0c3975c docs: A-6 — 200ms of network delay becomes 22 seconds of user latency feature/keycloak-a6-latency-injection DongHyeonkaandClaude Opus 5 2026-09-04 13:18:10 +09:00
• 2fa77a899e docs: A-5 — a one-way block heals itself and a full split still leaves one node serving feature/keycloak-a5-asymmetric-partition DongHyeonkaandClaude Opus 5 2026-09-04 13:12:04 +09:00
• d0666c5ba0 docs: A-4 — a dead pod reports healthier than a live one feature/keycloak-a4-node-loss DongHyeonkaandClaude Opus 5 2026-09-04 12:25:30 +09:00
• 99b689e715 docs: A-3 — four logins returned tokens for sessions the crash erased feature/keycloak-a3-database-crash DongHyeonkaandClaude Opus 5 2026-09-04 12:05:08 +09:00
• 4177fb6a48 docs: A-2 — losing the database takes every node down while up stays 1 feature/keycloak-a2-database-loss DongHyeonkaandClaude Opus 5 2026-09-04 11:57:55 +09:00
• 2a98ef1090 docs: A-1 — sessions survive a JGroups partition but logout invalidation does not feature/keycloak-a1-jgroups-transport-block DongHyeonkaandClaude Opus 5 2026-09-04 11:52:49 +09:00
• 9c3cde457e docs: close nine gaps found by re-reading every open question in full feature/keycloak-multinode-cluster-jdbc-ping DongHyeonkaandClaude Opus 5 2026-09-04 11:16:59 +09:00
• f1e8c35805 docs: plan all remaining experiments with architecture, injection points and predictions DongHyeonkaandClaude Opus 5 2026-09-04 10:50:23 +09:00
• 1de6108157 docs: add the prerequisite knowledge this lab assumes DongHyeonkaandClaude Opus 5 2026-09-04 10:24:21 +09:00
• 22d873eb4f docs: capture the SQL the other node actually runs, and correct the replication claim DongHyeonkaandClaude Opus 5 2026-09-04 10:14:45 +09:00
• e5ebaeb623 docs: prove sessions are shared by PostgreSQL, not Infinispan replication DongHyeonkaandClaude Opus 5 2026-09-04 09:58:10 +09:00
• 006da7d490 docs: record observability setup and add concept layers 10-13 DongHyeonkaandClaude Opus 5 2026-09-04 09:21:45 +09:00
• d5cc2b55a9 fix: grant nodes/proxy so kubelet metrics can be scraped DongHyeonkaandClaude Opus 5 2026-09-04 09:14:51 +09:00
• 0bb0e0ac49 feat: add Prometheus, node-exporter and Grafana for fault-injection observability DongHyeonkaandClaude Opus 5 2026-09-04 09:13:41 +09:00
• 33878e8880 docs: record multi-node cluster setup, rationale and formation evidence DongHyeonkaandClaude Opus 5 2026-09-03 17:26:45 +09:00
• 6dce35ec83 feat: deploy Keycloak multi-node cluster with PostgreSQL DongHyeonkaandClaude Opus 5 2026-09-03 17:17:25 +09:00
• 001efd624a docs: correct the memory analysis to distinguish host and guest headroom develop-keycloak-session-store DongHyeonkaandClaude Opus 5 2026-09-03 17:02:11 +09:00
• d6f8b9f8b3 docs: restructure roadmap into A/B/operations layers and add five operational items DongHyeonkaandClaude Opus 5 2026-09-03 16:56:13 +09:00
• df4d3b4345 docs: map published open questions to lab coverage and fix experiment order DongHyeonkaandClaude Opus 5 2026-09-03 16:44:12 +09:00
• 61ba5db259 docs: add lab operations guide with tooling, commands and drills DongHyeonkaandClaude Opus 5 2026-09-03 16:39:45 +09:00
• bc784fcd6e docs: surface the spoofing bypass finding in the roadmap DongHyeonkaandClaude Opus 5 2026-09-03 16:24:52 +09:00
• ddcb1c08e6 docs: record the session store lab roadmap and progress DongHyeonkaandClaude Opus 5 2026-09-03 16:20:38 +09:00
• e1ba9c5626 docs: record proxy-bypass closure with before and after evidence DongHyeonkaandClaude Opus 5 2026-09-03 16:17:24 +09:00
• 3af52bb66a feat: narrow Traefik trusted range and restrict echo ingress to Traefik DongHyeonkaandClaude Opus 5 2026-09-03 16:15:28 +09:00
• 98874b0c6c docs: retake staged evidence screenshots with indented output DongHyeonkaandClaude Opus 5 2026-09-03 15:52:47 +09:00
• b708c8d503 feat: indent echo responses for readable evidence DongHyeonkaandClaude Opus 5 2026-09-03 15:48:57 +09:00
• 7737787937 docs: record the staged fix and post-fix evidence DongHyeonkaandClaude Opus 5 2026-09-03 15:33:40 +09:00
• 1c1b86e849 feat: let the app interpret forwarded headers DongHyeonkaandClaude Opus 5 2026-09-03 15:30:31 +09:00
• 2294c52095 feat: make Traefik trust forwarded headers from the host nginx DongHyeonkaandClaude Opus 5 2026-09-03 15:29:18 +09:00
• 69d4502757 docs: collect evidence for the two-hop header contract failure DongHyeonkaandClaude Opus 5 2026-09-03 15:04:38 +09:00
• ae1f391598 docs: expand two-hop header contract with switch locations and per-pattern impact DongHyeonkaandClaude Opus 5 2026-09-03 14:57:08 +09:00
• 844d6f1d33 docs: measure and diagnose the two-hop proxy header contract DongHyeonkaandClaude Opus 5 2026-09-03 14:35:27 +09:00
• a831792c5c docs: map deploy/ assets and record why unapplied configs are kept DongHyeonkaandClaude Opus 5 2026-09-03 14:18:08 +09:00
• bcfdeb93ee docs: explain every setting used in the echo manifest DongHyeonkaandClaude Opus 5 2026-09-03 14:11:18 +09:00
• deae8966b8 docs: record why Docker must not be installed on the lab host DongHyeonkaandClaude Opus 5 2026-09-03 13:53:36 +09:00
• 6c90468c5a feat: report pod address from echo endpoint DongHyeonkaandClaude Opus 5 2026-09-03 13:44:29 +09:00
• 51bb055d61 feat: 2홉 구성 진행 DongHyeonka 2026-09-03 11:46:56 +09:00
• c22b217fbd chore: 메타데이터 gitignore develop DongHyeonka 2026-09-02 14:44:06 +09:00
• 64175266df chore: 메타데이터 gitignore develop-keycloak-pattern1 DongHyeonka 2026-09-02 14:42:50 +09:00
• f4aea65dc6 merge: Traefik ForwardAuth alternative develop-keycloak-pattern4 donghyeon-ka 2026-07-25 16:50:52 +09:00
• 4f93a5c92a feat: add validated Traefik ForwardAuth alternative feature/keycloak-traefik-forwardauth-alternative donghyeon-ka 2026-07-25 16:50:52 +09:00
• 7c72abdfed merge: AP4 Google federation profile donghyeon-ka 2026-07-25 16:49:29 +09:00
• 48bdf0b5ff feat: verify Google federation through the AP4 edge feature/keycloak-edge-forwardauth-google-federation donghyeon-ka 2026-07-25 16:49:29 +09:00
• e03ec4eaed merge: AP4 local identity profile donghyeon-ka 2026-07-25 16:42:34 +09:00
• 87edb6634d docs: define AP4 local identity profile feature/keycloak-edge-forwardauth-no-google donghyeon-ka 2026-07-25 16:42:34 +09:00
• 934c5da5d6 merge: BFF versus SPA-direct comparison develop-keycloak-pattern3 donghyeon-ka 2026-07-25 16:41:54 +09:00
• 00081ba14f docs: compare BFF and SPA-direct boundaries feature/keycloak-bff-vs-spa-direct donghyeon-ka 2026-07-25 16:41:54 +09:00
• bb8fd9333d merge: single-EC2 Google federation deployment donghyeon-ka 2026-07-25 16:41:27 +09:00
• 42957abfed docs: define single-EC2 Google federation deployment feature/keycloak-single-ec2-google-federation donghyeon-ka 2026-07-25 16:41:27 +09:00
• 5026b79fc0 merge: single-EC2 local identity deployment donghyeon-ka 2026-07-25 16:41:03 +09:00
• b42db5e93b docs: define single-EC2 local identity deployment feature/keycloak-single-ec2-no-google donghyeon-ka 2026-07-25 16:41:03 +09:00
• aee01c9e90 merge: three-leg trust chain contract donghyeon-ka 2026-07-25 16:40:19 +09:00
• 4a55ee71a9 test: codify the three-leg trust chain feature/keycloak-three-leg-trust-chain donghyeon-ka 2026-07-25 16:40:19 +09:00
• 1341645cf5 merge: AP1 Google federation profile donghyeon-ka 2026-07-25 16:39:53 +09:00
• a289aa2799 docs: define AP1 Google federation profile feature/keycloak-internal-spa-direct-google-federation donghyeon-ka 2026-07-25 16:39:53 +09:00
• a63c901407 merge: AP1 local identity profile donghyeon-ka 2026-07-25 16:39:31 +09:00
• e49f270a0e docs: define AP1 local identity profile feature/keycloak-internal-spa-direct-no-google donghyeon-ka 2026-07-25 16:39:31 +09:00
• 34bcd89bd0 merge: zero-change SPA federation contract donghyeon-ka 2026-07-25 16:39:01 +09:00
• 49863532e1 test: verify federation keeps the AP1 contract feature/keycloak-federation-spa-zero-change donghyeon-ka 2026-07-25 16:39:01 +09:00
• c15aeabb87 merge: SPA account-linking UX contract donghyeon-ka 2026-07-25 16:38:01 +09:00
• eec9feae5c feat: add signed SPA account-linking helper feature/keycloak-account-linking-spa-ux donghyeon-ka 2026-07-25 16:38:01 +09:00
• 32450c35ab merge: refresh token rotation contract donghyeon-ka 2026-07-25 16:37:07 +09:00
• b1c2d05ae9 test: isolate refresh token rotation contract feature/keycloak-refresh-token-rotation donghyeon-ka 2026-07-25 16:37:07 +09:00