PhilippTheServer

identity

OIDC, Keycloak, roles and the difference between authentication and authorization.

  1. Self-Hosted Identity with Keycloak: Central Offboarding and Forward Auth

    Keycloak "invalid_grant" "Account disabled": one admin API call disables a user for every OIDC client, plus oauth2-proxy forward auth for apps without login.

    identity security architecture

  2. Forward Auth: Putting Real Authentication in Front of Software That Has None

    Traefik forwardAuth with X-Auth-Request-User: strip the header first or clients can spoof it. oauth2-proxy and Keycloak in front of apps with no login.

    identity networking security

  3. Enforcing Client Identity Alongside Realm Roles

    Keycloak azp claim: a realm role does not show which client the token was issued to. Enforcing azp next to role checks in a FastAPI dependency.

    identity security fastapi

  4. OIDC Client Shapes: A Token-Validating API Is Not a Login Client

    Keycloak directAccessGrantsEnabled on a token-validating API lets it mint tokens. bearerOnly client, oidc-audience-mapper and a PyJWT aud check.

    identity security api-design

  5. Realm-as-Code: Reconciling Clients and Roles But Never Users or Signing Keys

    kc.sh import with --override=true recreates the realm, dropping users and signing keys. Reconciling only clients and roles via the Keycloak Admin REST API.

    identity gitops security

  6. Group-Based Default-Deny Instead of Hand-Maintained Peer Lists

    NetBird Default policy replaced by group-based default-deny: auto_groups on setup keys, role:/tier: group names, and a script diffing live policies.

    networking identity

  7. A Multi-Service docker-compose That a New Contributor Can Actually Start

    depends_on condition: service_healthy: why a plain depends_on list races, with Postgres, Redis and Keycloak healthchecks, --import-realm and a smoke test.

    docker identity testing

  8. A 500 That Was a Misconfigured Client, Not an Auth Failure

    resp.json()["active"] raises KeyError when token introspection returns 401 invalid_client. Check the status code first and report a client config error.

    identity api-design testing

  9. A Confidential OIDC Client That Exists Only to Introspect Tokens

    invalid_client "Parameter client_secret is missing" on Keycloak token introspection for a public SPA client: add a confidential introspection-only client.

    identity security

  10. An OpenAI-Compatible Proxy in Front of a Local Model Server

    /v1/chat/completions behind a FastAPI proxy: bearer API-key auth, unbuffered SSE streaming, and a /healthz that cannot trigger a model load.

    llm fastapi api-design identity

All topics · All writing