Architecture: Keycloak

arch-keycloak Doc

architecture active

Project

Architecture: Keycloak

Keycloak provides OIDC authentication for pal-enterprises. Single realm (pal-enterprises), single client (pal-enterprises), non-public with PKCE.

Client Pattern

Single client with multiple redirect URIs for dev/prod separation (same pattern as westside-admin, playme2k):

Prod: https://pal-enterprises.tail5b443a.ts.net/auth/keycloak/callback
Dev: https://pal-enterprises-dev.tail5b443a.ts.net/auth/keycloak/callback

Config Location

Client definition: pal-e-services/terraform/k3s.tfvars (lines 238-257)
App config: pal-enterprises/config/initializers/omniauth.rb
Managed via Terraform (IaC), not Keycloak admin console

Future: Client Board Access

Per arch-multi-tenant, client users will get a project_slug user attribute mapped via OIDC protocol mapper. This enables scoped board access through the pal-enterprises proxy pattern.