SSO: Wire Forgejo → Keycloak OIDC

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ldraney/pal-e-platform#336

forgejo_admin commented

2026-05-05 04:06:16 +00:00

Contributor

Type

Feature

Lineage

Standalone — scoped during platform SSO initiative (2026-05-04). Depends on platform realm ticket.

Repo

forgejo_admin/pal-e-platform

User Story

As a platform admin
I want to log into Forgejo via Keycloak SSO
So that I don't need a separate password and get seamless click-through from the admin dashboard

Context

Forgejo supports OAuth2 providers natively. Config goes in Helm values under gitea.config or via Forgejo admin API auth source. Once Forgejo uses Keycloak, Woodpecker CI inherits SSO for free (it uses Forgejo as its auth backend). The zero-re-login experience works because Keycloak session cookie persists — Forgejo redirects to Keycloak, Keycloak sees existing session, bounces back with token.

File Targets

Files the agent should modify or create:

terraform/modules/forgejo/main.tf — add OAuth2 provider config to Helm values

Files the agent should NOT touch:

terraform/modules/keycloak/main.tf — realm is managed separately
terraform/modules/ci/main.tf — Woodpecker inherits from Forgejo automatically

Acceptance Criteria

Forgejo login page shows "Sign in with Keycloak" button
ldraney can authenticate via Keycloak and lands as admin in Forgejo
No second login prompt when navigating from pal-e-admin (SSO session reuse)
Existing forgejo_admin local account still works as fallback
Woodpecker CI recognizes Keycloak-authenticated Forgejo user

Test Expectations

Integration: login via Keycloak, verify Forgejo session created
Verify: Woodpecker shows authenticated user after Forgejo SSO
Run command: curl -s https://forgejo.tail5b443a.ts.net/api/v1/settings/api | jq .

Constraints

Keep local auth as fallback (don't disable it)
OIDC client ID/secret must be stored in k8s secret, not plaintext in terraform
Follow existing Helm values pattern in modules/forgejo/main.tf

Checklist

PR opened
Tests pass
No unrelated changes

project-pal-e-platform — platform project

### Type Feature ### Lineage Standalone — scoped during platform SSO initiative (2026-05-04). Depends on platform realm ticket. ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform admin I want to log into Forgejo via Keycloak SSO So that I don't need a separate password and get seamless click-through from the admin dashboard ### Context Forgejo supports OAuth2 providers natively. Config goes in Helm values under `gitea.config` or via Forgejo admin API auth source. Once Forgejo uses Keycloak, Woodpecker CI inherits SSO for free (it uses Forgejo as its auth backend). The zero-re-login experience works because Keycloak session cookie persists — Forgejo redirects to Keycloak, Keycloak sees existing session, bounces back with token. ### File Targets Files the agent should modify or create: - `terraform/modules/forgejo/main.tf` — add OAuth2 provider config to Helm values Files the agent should NOT touch: - `terraform/modules/keycloak/main.tf` — realm is managed separately - `terraform/modules/ci/main.tf` — Woodpecker inherits from Forgejo automatically ### Acceptance Criteria - [ ] Forgejo login page shows "Sign in with Keycloak" button - [ ] ldraney can authenticate via Keycloak and lands as admin in Forgejo - [ ] No second login prompt when navigating from pal-e-admin (SSO session reuse) - [ ] Existing forgejo_admin local account still works as fallback - [ ] Woodpecker CI recognizes Keycloak-authenticated Forgejo user ### Test Expectations - [ ] Integration: login via Keycloak, verify Forgejo session created - [ ] Verify: Woodpecker shows authenticated user after Forgejo SSO - Run command: `curl -s https://forgejo.tail5b443a.ts.net/api/v1/settings/api | jq .` ### Constraints - Keep local auth as fallback (don't disable it) - OIDC client ID/secret must be stored in k8s secret, not plaintext in terraform - Follow existing Helm values pattern in `modules/forgejo/main.tf` ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-pal-e-platform` — platform project

forgejo_admin referenced this issue from a pull request that will close it,

2026-05-09 16:39:58 +00:00

fix(forgejo): persist sessions to disk instead of memory #356

forgejo_admin referenced this issue

2026-05-09 16:41:22 +00:00

forgejo_admin closed this issue

2026-05-09 16:45:33 +00:00