SSO: Create platform realm + ldraney admin user in Keycloak #335

New issue

Closed

opened 2026-05-05 04:06:09 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-05-05 04:06:09 +00:00

Contributor

Type

Feature

Lineage

Standalone — scoped during platform SSO initiative (2026-05-04).

Repo

forgejo_admin/pal-e-platform

User Story

As a platform admin
I want a dedicated Keycloak realm for platform services
So that I have one login across all infra tools (Forgejo, Grafana, Harbor, MinIO)

Context

Keycloak is deployed but only serves the westside realm today. Per convention (one realm per brand/audience), platform infra services need their own realm. This ticket creates the realm and the ldraney admin user. Unblocks all subsequent OIDC client wiring tickets.

Two approaches: (1) Keycloak admin API calls, or (2) add the terraform-provider-keycloak to manage realm/clients as IaC. Recommend approach 1 for now (faster, no new provider dependency), with a follow-up to IaC it later if desired.

File Targets

Files the agent should modify or create:

No terraform file changes — this is a Keycloak admin API operation
Optionally: terraform/modules/keycloak/main.tf if we add the keycloak terraform provider

Files the agent should NOT touch:

keycloak/themes/westside/ — westside realm is separate

Acceptance Criteria

platform realm exists at keycloak.tail5b443a.ts.net/realms/platform
ldraney user exists in platform realm with password set
User has realm admin role assigned
Realm well-known endpoint responds: /realms/platform/.well-known/openid-configuration

Test Expectations

Curl the OIDC well-known endpoint and confirm valid JSON response
Authenticate as ldraney via token endpoint and receive access token
Run command: curl -s https://keycloak.tail5b443a.ts.net/realms/platform/.well-known/openid-configuration | jq .issuer

Constraints

Use Keycloak admin API (not terraform keycloak provider) for now
Realm name must be platform (not master, not pal-e)
ldraney password should come from secrets, not hardcoded

Checklist

PR opened
Tests pass
No unrelated changes

project-pal-e-platform — platform project

### Type Feature ### Lineage Standalone — scoped during platform SSO initiative (2026-05-04). ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform admin I want a dedicated Keycloak realm for platform services So that I have one login across all infra tools (Forgejo, Grafana, Harbor, MinIO) ### Context Keycloak is deployed but only serves the westside realm today. Per convention (one realm per brand/audience), platform infra services need their own realm. This ticket creates the realm and the ldraney admin user. Unblocks all subsequent OIDC client wiring tickets. Two approaches: (1) Keycloak admin API calls, or (2) add the terraform-provider-keycloak to manage realm/clients as IaC. Recommend approach 1 for now (faster, no new provider dependency), with a follow-up to IaC it later if desired. ### File Targets Files the agent should modify or create: - No terraform file changes — this is a Keycloak admin API operation - Optionally: `terraform/modules/keycloak/main.tf` if we add the keycloak terraform provider Files the agent should NOT touch: - `keycloak/themes/westside/` — westside realm is separate ### Acceptance Criteria - [ ] `platform` realm exists at `keycloak.tail5b443a.ts.net/realms/platform` - [ ] `ldraney` user exists in platform realm with password set - [ ] User has realm admin role assigned - [ ] Realm well-known endpoint responds: `/realms/platform/.well-known/openid-configuration` ### Test Expectations - [ ] Curl the OIDC well-known endpoint and confirm valid JSON response - [ ] Authenticate as ldraney via token endpoint and receive access token - Run command: `curl -s https://keycloak.tail5b443a.ts.net/realms/platform/.well-known/openid-configuration | jq .issuer` ### Constraints - Use Keycloak admin API (not terraform keycloak provider) for now - Realm name must be `platform` (not master, not pal-e) - ldraney password should come from secrets, not hardcoded ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-pal-e-platform` — platform project