Validation: westside-admin Keycloak client + SOP (pal-e-platform#301) — 2026-05-04

validation-301-2026-05-04 Doc

validation pass

Project

Validation: pal-e-platform#301 — Keycloak client + SOP

Ticket

Forgejo: forgejo_admin/pal-e-platform#301 — Create westside-admin Keycloak client + document SOP
Board item: board-westside-admin id=1096
Shipped: OIDC client westside-admin exists in realm westside-basketball; SOP sop-keycloak-client-creation exists in pal-e-docs.

Environment

Keycloak: https://keycloak.tail5b443a.ts.net, realm westside-basketball
Consuming app: https://westside-admin.tail5b443a.ts.net (running off image harbor.tail5b443a.ts.net/westside-admin/app:63e708d)
pal-e-docs MCP: get_note_toc(slug="sop-keycloak-client-creation")

Checks

#	Criterion (from #301)	How to Verify	Result	Evidence
1	OIDC client <code>westside-admin</code> exists in realm <code>westside-basketball</code>	Hit Keycloak admin API <code>GET /admin/realms/westside-basketball/clients?clientId=westside-admin</code>	PASS	API returned 1 client with id <code>19bfe0df-7fbc-463c-97df-59d77901421e</code>
2	Standard Flow enabled, Direct Access Grants disabled, PKCE S256 enforced	Live OIDC redirect: navigate to <code>https://westside-admin.tail5b443a.ts.net/</code>	PASS	302 chain redirected to <code>code_challenge_method=S256</code> + <code>response_type=code</code> + <code>scope=openid profile email</code>; password grant rejected with <code>unauthorized_client \| Client not allowed for direct access grants</code>
3	Valid Redirect URI <code>https://westside-admin.tail5b443a.ts.net/auth/callback</code>	Inspect login redirect URL; complete login round-trip via Playwright	PASS	Redirect URI in OIDC params matches; full login flow completed at 12:09 UTC, cookie set, page rendered
4	Confidential client with <code>KEYCLOAK_CLIENT_SECRET</code> wired into deployment	<code>kubectl -n westside-admin get secret westside-admin-secrets -o json</code>	PASS	Secret has 5 keys including <code>KEYCLOAK_CLIENT_SECRET</code>; pod env consumes it; live login proves cluster-side credential is valid
5	SOP note <code>sop-keycloak-client-creation</code> exists in pal-e-docs	<code>get_note_toc(slug="sop-keycloak-client-creation")</code>	PASS	TOC returned with sections: Purpose, Background, Prerequisites, Steps, OIDC Client Config Summary, State Parameter / CSRF Requirement, Secret Handling, Rules, Related
6	SOP tagged <code>sop,active</code>	SOP injected at session start lists slug among active SOPs	PASS	Session-start board sync injection includes <q>SOP: Keycloak Client Creation (Admin Console) (slug: sop-keycloak-client-creation)</q>

Verdict

PASS — both deliverables (Keycloak client + SOP) are live and exercised. The client is the same one currently serving production logins for westside-admin; the SOP is queryable via MCP and correctly documents the manual admin-console procedure.

Discovered Issues

None. One observation worth noting (not a blocker): the original ticket discussed both public and confidential client modes; the implemented client is confidential (matching the existing westside-app pattern). The SOP correctly documents both options.

Notes

This validation note was filed retroactively on 2026-05-04 during PM review of board-westside-admin TODO column. The work shipped earlier without the gate, but the deliverables stand independent verification today. Future moves to done on this board will go through the validation column live to avoid retroactive filings.