feat(security): SSO/JWT authentication migration (Phase 1)#1569

Draft

jsell-rh wants to merge 62 commits into

mainfrom

jsell/spec/sso-authentication

Commits on May 12, 2026

spec(security): add SSO authentication specification

jsell-rh
and
claude
committed
spec(security): add IAM consolidation roadmap from PR #1466

jsell-rh
and
claude
committed

Commits on May 13, 2026

spec(security): add OIDC callback route coexistence and client config requirements

jsell-rh
and
claude
committed

Commits on May 14, 2026

spec(security): add local Keycloak dev instance requirement

jsell-rh
and
claude
committed
workflow(security): add local Keycloak dev setup and Identity Brokering

jsell-rh
and
claude
committed
feat(security): add Keycloak dev instance, JWT validation package, and impersonation RBAC

jsell-rh
and
claude
committed
feat(security): add backend dual-path JWT/TokenReview auth with K8s impersonation

jsell-rh
and
claude
committed
feat(frontend): add BFF OIDC authentication with Keycloak

jsell-rh
and
claude
committed
fix(security): use portless localhost redirect URI for Keycloak

jsell-rh
and
claude
committed
fix(frontend): use standard URL for OIDC callback and match redirect_uri

jsell-rh
and
claude
committed
fix(frontend): remap iss parameter in OIDC callback for dual-URL envs

jsell-rh
and
claude
committed
fix(security): set KC_HOSTNAME for consistent issuer across URLs

jsell-rh
and
claude
committed
fix(security): handle split-URL Keycloak in Kind dev environments

jsell-rh
and
claude
committed
fix(frontend): add TTL to OIDC discovery cache to prevent stale endpoints

jsell-rh
and
claude
committed
fix(backend): align RoleBinding subject with impersonation identity

jsell-rh
and
claude
committed
fix(frontend): auto-retry on stale OIDC state and fix logout redirect

jsell-rh
and
claude
committed
fix(frontend): use runtime ssoEnabled flag for logout redirect

jsell-rh
and
claude
committed
fix(frontend): update project layout logout to use SSO when enabled

jsell-rh
and
claude
committed
feat(e2e): migrate test auth to Keycloak client_credentials

jsell-rh
and
claude
committed
feat(frontend): add session expired dialog with global 401 detection

jsell-rh
and
claude
committed
fix(frontend): add refresh logging and fix middleware CORS on expiry

jsell-rh
and
claude
committed
fix(frontend): use manual token refresh in split-URL dev environments

jsell-rh
and
claude
committed
fix(security): proxy Keycloak through frontend to eliminate split URLs

jsell-rh
and
claude
committed
fix(security): use KC_HOSTNAME_BACKCHANNEL_DYNAMIC for consistent issuer

jsell-rh
and
claude
committed
docs: update dev environment docs for Keycloak SSO authentication

jsell-rh
and
claude
committed
docs: clarify sso-authentication is an infrastructure flag, not user-facing

jsell-rh
and
claude
committed
Merge branch 'main' into jsell/spec/sso-authentication
jsell-rh
authored
Merge branch 'jsell/spec/sso-authentication' of https://github.com/ambient-code/platform into jsell/spec/sso-authentication
jsell-rh
committed
feat: add make kind-sso-toggle to switch auth modes in Kind

jsell-rh
and
claude
committed
style(backend): fix gofmt formatting in SSO files

jsell-rh
and
claude
committed
fix(frontend): resolve useEffect missing dependency lint warning

jsell-rh
and
claude
committed
fix(backend): add package comment to jwtauth for staticcheck ST1000

jsell-rh
and
claude
committed
fix(backend): unflake 3 project handler tests and add userID fallback

jsell-rh
and
claude
committed

Commits on May 15, 2026

Commits on May 18, 2026

fix(frontend): SSO redirect and session cookie fixes for reverse-proxy deployments

jsell-rh
and
claude
committed

Commits on May 19, 2026

fix(frontend): SSO logout redirects to Keycloak end-session endpoint

jsell-rh
and
claude
committed

Commits on May 21, 2026