1.6 KiB
1.6 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Authenticate administrators with Keycloak SSO | The operator console requires a Keycloak identity with the configured administrator role. |
|
2026-08-01T18:43:58Z | US-011 | verified |
User Story
As an administrator, I want to authenticate through organizational SSO, so that privileged operations use centrally managed identities and roles.
Acceptance Criteria
- Admin authentication uses Keycloak OpenID Connect authorization code flow.
- Sign-in is denied when the configured required role is absent.
- Realm and configured-client roles are extracted from fresh Keycloak tokens.
- Admin console layouts redirect unauthenticated or unauthorized users to the admin login page.
- Every privileged server action independently rechecks the admin session and role.
- Admin sessions use signed JWT behavior managed by NextAuth.
- Administrators can sign out and return to the restricted login page.
Implementation
apps/web/src/lib/auth/admin-auth.tsapps/web/src/lib/auth/require-admin.tsapps/web/src/app/admindocs/admin-oidc-keycloak-setup.md
Validation
OIDC role extraction is covered by packages/auth/test/oidc-roles.test.ts.