MrDiderot/auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit: Keycloak SSO for MischLabs

Browse Source 
Keycloak 26.1 + PostgreSQL 16 Docker stack with pre-configured
realm containing 10 OIDC clients for all MischLabs services.
Includes integration guides for Tier 1-3 services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Kroonk
2026-04-13 20:42:59 +02:00
commit 8a4beb879a
5 changed files with 504 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

235
realm/mischlabs-realm.json Normal file
View File

@@ -0,0 +1,235 @@
{
"realm": "mischlabs",
"enabled": true,
"displayName": "MischLabs",
"displayNameHtml": "<strong>Misch</strong>Labs",
"sslRequired": "external",
"registrationAllowed": false,
"registrationEmailAsUsername": false,
"loginWithEmailAllowed": true,
"duplicateEmailsAllowed": false,
"resetPasswordAllowed": true,
"editUsernameAllowed": false,
"bruteForceProtected": true,
"permanentLockout": false,
"maxFailureWaitSeconds": 900,
"maxDeltaTimeSeconds": 43200,
"failureFactor": 5,
"accessTokenLifespan": 300,
"ssoSessionIdleTimeout": 1800,
"ssoSessionMaxLifespan": 36000,
"offlineSessionIdleTimeout": 2592000,
"roles": {
"realm": [
{
"name": "user",
"description": "Standard MischLabs user"
},
{
"name": "admin",
"description": "MischLabs administrator"
}
]
},
"defaultRoles": ["user"],
"clients": [
{
"clientId": "gitea",
"name": "Gitea",
"description": "Code-Repositories (git.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"redirectUris": [
"https://git.mischlabs.de/*"
],
"webOrigins": ["https://git.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "nextcloud",
"name": "Nextcloud",
"description": "Cloud-Speicher (drive.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://drive.mischlabs.de/apps/oidc_login/oidc",
"https://drive.mischlabs.de/apps/user_oidc/code"
],
"webOrigins": ["https://drive.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"],
"attributes": {
"pkce.code.challenge.method": "S256",
"id.token.signed.response.alg": "RS256"
}
},
{
"clientId": "mealie",
"name": "Mealie",
"description": "Rezepte (foodlabs.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://foodlabs.mischlabs.de/*"
],
"webOrigins": ["https://foodlabs.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email", "groups"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "audiobookshelf",
"name": "Audiobookshelf",
"description": "Hoerbuecher (audiobook.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://audiobook.mischlabs.de/auth/openid/callback",
"https://audiobook.mischlabs.de/auth/openid/mobile-redirect"
],
"webOrigins": ["https://audiobook.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"],
"attributes": {
"user.info.response.signature.alg": ""
}
},
{
"clientId": "jellyfin",
"name": "Jellyfin",
"description": "Filme & Serien (movies.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://movies.mischlabs.de/*"
],
"webOrigins": ["https://movies.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "vaultwarden",
"name": "Vaultwarden",
"description": "Passwort-Manager (password.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://password.mischlabs.de/identity/connect/oidc-signin"
],
"webOrigins": ["https://password.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "pocketbase",
"name": "PocketBase",
"description": "Persoenliche Seite (tom.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://tom.mischlabs.de/api/oauth2-redirect",
"https://tom.mischlabs.de/_/*"
],
"webOrigins": ["https://tom.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "docs",
"name": "Docs",
"description": "Dokumentation (docs.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://docs.mischlabs.de/*"
],
"webOrigins": ["https://docs.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "michess",
"name": "MiChess",
"description": "Schach (michess.mischlabs.de)",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://michess.mischlabs.de/*"
],
"webOrigins": ["https://michess.mischlabs.de"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
},
{
"clientId": "cloudflare-access",
"name": "Cloudflare Access",
"description": "Cloudflare Zero Trust als Schutzschicht",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"standardFlowEnabled": true,
"directAccessGrantsEnabled": false,
"redirectUris": [
"https://*.cloudflareaccess.com/cdn-cgi/access/callback"
],
"webOrigins": ["+"],
"defaultClientScopes": ["openid", "profile", "email"],
"optionalClientScopes": ["offline_access"]
}
],
"clientScopes": [
{
"name": "groups",
"description": "User group memberships",
"protocol": "openid-connect",
"protocolMappers": [
{
"name": "groups",
"protocol": "openid-connect",
"protocolMapper": "oidc-group-membership-mapper",
"config": {
"full.path": "false",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "groups",
"userinfo.token.claim": "true"
}
}
]
}
],
"smtpServer": {},
"loginTheme": "keycloak",
"accountTheme": "keycloak.v3",
"internationalizationEnabled": true,
"supportedLocales": ["de", "en"],
"defaultLocale": "de"
}