Skip to content

🔐 Keycloak Integration – Status Report (Historical)

Date: 2025-11-20
Status: ✅ 95% implemented – ready for tests
Note: Keycloak was later replaced by Authentik; this document is kept for traceability only.

Implemented Phases

1) Docker & Infrastructure (100%)

  • Keycloak container (port 8090) + PostgreSQL DB (llars_keycloakdb)
  • docker-compose.yml configured, realm import (llars, clients: llars-frontend, llars-backend)
  • Admin user admin/admin123, roles admin, rater, evaluator
  • CORS and env variables set

2) Backend (100%)

  • Dependencies: python-keycloak, PyJWT, cryptography
  • Token validation: app/auth/keycloak_validator.py
  • Decorators: @keycloak_required, @admin_required, @roles_required, @optional_auth
  • Routes: /auth/keycloak/health_check, /auth/keycloak/me, /auth/keycloak/validate, /auth/keycloak/admin/check

3) Frontend (100%)

  • @dsb-norge/vue-keycloak-js integrated (Axios interceptor, token refresh)
  • Login flow switched to Keycloak, router guards with role checks
  • Yjs WebSocket: JWT validation with jwks-rsa

Known Points & Fixes

  • Dependency: python-keycloak upgraded to 5.0.0 (4.8.0 does not exist).
  • .env: Placeholder for OpenAI API corrected.
  • docker-compose: Optional SSH proxy dependency removed.

Test Checklist (Keycloak Setup)

  • Keycloak runs on port 8090, admin console reachable.
  • Realm llars imported, clients present.
  • Backend health: /auth/keycloak/health_check responds.
  • Login flow: redirect to Keycloak, token in browser, return to /Home.
  • WebSocket: JWT validation active.

Deployment Notes (Historical)

  • Development: docker compose up -d --build (all ports exposed).
  • Production: only nginx ports 80/443 open; backend/frontend/yjs internal.
  • Admin console: http://localhost:8090/admin (admin / admin_secure_password_123).

Conclusion: The Keycloak integration was functionally complete; later versions migrated to Authentik. This document remains as an archival reference.