pal-e-docs

Validation: Add paldocs Keycloak OIDC client via Terraform

validation-26-2026-07-17 Doc

validation pass
Project

Verdict: PASS

Ticket

Board item #1387 on board-paldocs — "Add paldocs Keycloak OIDC client via Terraform"
Forgejo issue: ldraney/paldocs#26 (404 — work done in pal-e-services)
Merged PR: ldraney/pal-e-services#163 "Add paldocs Keycloak OIDC client to pal-e-docs realm"
Merge commit: b80c829
Shipped: A Keycloak OIDC client (paldocs) in the pal-e-docs realm, provisioned via Terraform in pal-e-services.

Environment

Production k3s cluster. Keycloak namespace (keycloak-7bdc69975f-lfzts, Running, 0 restarts). Terraform state via pal-e-services/terraform with k3s.tfvars.

Checks

# Criterion How Verified Result Evidence
1 Keycloak OIDC client for paldocs exists in pal-e-docs realm Keycloak Admin API: <code>GET /admin/realms/pal-e-docs/clients?clientId=paldocs</code> PASS Client returned with ID <code>772cbc3d-b732-437a-9052-06c07dcfe71e</code>, clientId=paldocs, enabled=true, protocol=openid-connect
2 Client configured correctly for Rails OIDC integration Keycloak Admin API response field inspection PASS CONFIDENTIAL (publicClient=false), standardFlowEnabled=true (Auth Code), directAccessGrantsEnabled=false, PKCE S256, use_refresh_tokens=true. Redirect URIs: <code>https://paldocs.app/auth/keycloak/callback</code> + <code>https://paldocs.tail5b443a.ts.net/auth/keycloak/callback</code> (OmniAuth convention). Web origins: both domains. Realm-roles protocol mapper active (id_token + access_token + userinfo). backchannel_logout_session_required=true.
3 tofu apply was successful (no drift) <code>tofu plan -lock=false -var-file=k3s.tfvars</code> PASS Zero paldocs-related changes in plan output. All paldocs resources (keycloak_openid_client, realm_role_protocol_mapper, realm, namespace, harbor, argocd app, funnel) refreshed successfully with no drift. Plan summary: "0 to add" for paldocs resources. 6 unrelated changes (ISS, westside-basketball, mdview, gcal-scheduler).

Regression Check

  • pal-e-docs realm: enabled=true, displayName="Pal-E Docs", all 8 clients healthy (account, account-console, admin-cli, broker, pal-e-app, paldocs, realm-management, security-admin-console)
  • OIDC discovery: https://keycloak.tail5b443a.ts.net/realms/pal-e-docs/.well-known/openid-configuration returns valid config with authorization_code grant type
  • Keycloak pod: Running, 0 restarts, 13d uptime
  • Paldocs app: Pod running (paldocs-8585d75c88-ch7p5), root URL returns HTTP 200 on both Tailscale and paldocs.app domains
  • Terraform state: No unexpected drift on any Keycloak resources

Discovered Issues

None. The /auth/keycloak route returns 404 on the paldocs app, which is expected — the Rails OmniAuth integration is a separate ticket from the Keycloak client provisioning validated here.