docs(auth): runbook Keycloak — SPID + registrazione email-OTP (#235 Fase 5) - #243
Conversation
…ase 5) Fase 5 = configurazione IdP, non codice app. docs/keycloak-setup.md: realm/client public PKCE, redirect URI, audience mapper opzionale, registrazione con verifica email/OTP, SPID via aggregatore o plugin keycloak-spid, ruoli nel nostro DB + BOOTSTRAP_ADMIN_EMAIL, wiring env OIDC_ISSUER/NEXT_PUBLIC_OIDC_*, verifica e2e, modalita dev senza IdP. README: puntatore al runbook nella sezione auth (R14). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32b31f4c49
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Browser (opendata-ai-ui) ──OIDC Auth Code + PKCE──▶ Keycloak (realm opendata) | ||
| │ access_token (JWT) │ broker SPID | ||
| ▼ └─ registrazione email+OTP | ||
| opendata-backend ──verifica JWT via JWKS ${OIDC_ISSUER}/.well-known/jwks.json──▶ |
There was a problem hiding this comment.
In deployments following this Keycloak runbook, OIDC_ISSUER=https://<sso-host>/realms/opendata makes the backend call issuer.rstrip('/') + '/.well-known/jwks.json' (opendata-backend/src/opendata_backend/auth/clerk.py:_jwks_client), but Keycloak publishes realm signing keys at the discovery document's jwks_uri (.../protocol/openid-connect/certs), not at that suffix. As a result, every authenticated API call with a Keycloak token will fail at signing-key lookup; this needs either discovery-based JWKS lookup in the backend or a documented, tested Keycloak-compatible setting before telling operators this setup is ready.
Useful? React with 👍 / 👎.
1 participant
Fase 5 di #235. SPID e la registrazione con codice via email sono funzionalità di Keycloak (l'IdP), non della nostra app: questo runbook spiega come configurarle e collegarle.
docs/keycloak-setup.mdopendata.users.role+/admin= autorizzazione.opendata+ client public PKCEopendata-ui, redirecthttps://<ui>/*, audience mapper opzionale (perOIDC_AUDIENCE).prompt=create.keycloak-spid; mapping attributi→claim; nota su CF come dato personale (§7 del pivot).BOOTSTRAP_ADMIN_EMAIL; wiring env backend/frontend (issuer condiviso); checklist di verifica e2e; modalità dev senza IdP.Solo documentazione. Con questo, il codice di #235 è completo (Fasi 1–4 + 6 mergiate); la Fase 5 è operativa e si esegue quando c'è un Keycloak da configurare.
Closes #235
🤖 Generated with Claude Code