30 lines
1.4 KiB
Markdown
30 lines
1.4 KiB
Markdown
# Keycloak branch implementation index
|
||
|
||
The source inventory contains 39 `feature-keycloak-*.md` branch notes. This
|
||
repository preserves one local Git feature branch for every note and merges it
|
||
with `--no-ff` into either the common `develop` baseline or one of the four
|
||
authentication-pattern branches.
|
||
|
||
| Target | Meaning |
|
||
|---|---|
|
||
| `common` | Shared realm, federation, deployment, or governance contract. Merge into `develop`, then propagate to AP1–AP4. |
|
||
| `ap1` | Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
|
||
| `ap2` | Token-mediating confidential backend: browser receives access token only. |
|
||
| `ap3` | BFF: backend owns every OAuth token and browser owns only a session cookie. |
|
||
| `ap4` | Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
|
||
|
||
The machine-readable registry is
|
||
[`keycloak-branch-manifest.tsv`](keycloak-branch-manifest.tsv). Run:
|
||
|
||
```bash
|
||
./scripts/audit-keycloak-branches.sh
|
||
```
|
||
|
||
The audit succeeds only when all 39 note names have matching local feature
|
||
branches and each feature tip is reachable from its declared target branch.
|
||
|
||
Google credentials are never committed. The default local acceptance harness
|
||
uses a second Keycloak realm as a controllable OIDC provider so claim mapping
|
||
and unsafe-linking failure paths can be reproduced. A real Google login remains
|
||
an explicit credentialed/public-HTTPS verification profile.
|