1.4 KiB
Keycloak branch implementation index
The source inventory contains 39 feature-keycloak-*.md branch notes. This
repository preserves one local Git feature branch for every note and merges it
with --no-ff into either the common develop baseline or one of the four
authentication-pattern branches.
| Target | Meaning |
|---|---|
common |
Shared realm, federation, deployment, or governance contract. Merge into develop, then propagate to AP1–AP4. |
ap1 |
Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
ap2 |
Token-mediating confidential backend: browser receives access token only. |
ap3 |
BFF: backend owns every OAuth token and browser owns only a session cookie. |
ap4 |
Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
The machine-readable registry is
keycloak-branch-manifest.tsv. Run:
./scripts/audit-keycloak-branches.sh
The audit succeeds only when all 39 note names have matching local feature branches and each feature tip is reachable from its declared target branch.
Google credentials are never committed. The default local acceptance harness uses a second Keycloak realm as a controllable OIDC provider so claim mapping and unsafe-linking failure paths can be reproduced. A real Google login remains an explicit credentialed/public-HTTPS verification profile.