feat(keycloak): audience mapper for forte-drop-mcp on forte-cli (stacks on #26) #44

Merged

jorgen.stensrud merged 2 commits from fm/launchpad-forte-cli-audience into main 2026-10-01 11:25:35 +00:00

Conversation 3 Commits 2 Files Changed 2

+36 -1

2 Commits

Author	SHA1	Message	Date
3 people	95db80fb53	feat(keycloak): audience mapper for forte-drop-mcp on forte-cli (fallback) ... Adds an oidc-audience-mapper to the forte-cli client so its access tokens carry aud=https://mcp.drop.forteapps.net/mcp, the audience the forte-drop-mcp auth sidecar verifies. Fallback for the case where Keycloak ignores the RFC 8707 resource= parameter the skill sends. Stacks on #26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 10:37:12 +00:00
3 people	0bf8c3988e	Add forte-cli public device-code Keycloak client ... Add a shared public client `forte-cli` to the `forte` realm so downloaded skills (forte-drop first) can do RFC 8628 device-code login through the Auth Sidecar. Today no client in the realm has the device grant enabled, so the flow cannot start. Client (inline in forte-realm.json, imported verbatim by keycloak-config-cli): - publicClient: true, standardFlowEnabled: false, directAccessGrantsEnabled: false - attributes: oauth2.device.authorization.grant.enabled=true - no secret, no redirectUris/webOrigins, no k8s.secret.sync It has to go in the realm JSON because the self-service registrar hardcodes publicClient:false/standardFlowEnabled:true and drops attributes. Also add forte-cli to the cleanup CronJob's protected list (belt-and-braces; it does not match the UUID pattern anyway). Additive only: gitea/grafana/argocd and all other realm settings are unchanged. Keycloak is deployed only via the upc-dev overlay, which inherits base values, so this lands on id.forteapps.net. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QciXev3MtCxo3eomcfrDRW	2026-10-01 10:37:12 +00:00