oidc tower on verdandi: keycloak, the lament realm, web-tier SSO + desktop SPNEGO #109
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "oidc"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
stands up keycloak on
verdandias the fleet's OIDC IdP, federated to the existing krb5+ldap root, and graduates the whole web tier plus ishtar's desktop login onto it. picked keycloak over authelia/kanidm for its native kerberos/SPNEGO brokering, so the silent-TGT endgame landed in-tower rather than as a later bolt-on. the KDC stays the credential root throughout; KC federates to slapd and password auth always rides the{SASL}-> KDC passthrough underneath.keycloakonverdandiservices/identity/keycloak.nix: KC bound to the WG internal addr, plain http behind caddy (TLS terminates at the edge),hostname=https://id.lament.gay,proxy-headers=xforwardedverdandigains thepostgresrole (its own server, persist + backup); DB viacreateLocally+ a sopspasswordFile; the DR dump names thekeycloakdb explicitlyEnvironmentFile(KC_BOOTSTRAP_ADMIN_*), never baked into the storeid.lament.gaypublic vhost (directoryservices.id) + a zoneCNAMEthe
lamentrealm, realm-as-codestatic/keycloak/realm-lament.json(secret-free) reconciled by akeycloak-config-clioneshot on every activation;--import.var-substitution+$(env:LDAP_BIND_PW)pulls the bind pw from a sops env template - same idempotent oneshot idiom as the forgejo/wiki-js auth sourceseditMode=READ_ONLY); agroup-ldap-mapperliftscn=admins->/admins->realm-management:realm-adminid.lament.gay+/adminredirect to thelamentrealm console, not keycloak's built-inmaster(which stays break-glass at its explicit path)web tier graduates to oidc
one shape per app - a realm client + secret, then swap the app's own auth source:
auth.generic_oauth, role from the/adminsgroups claim) -oauth_allow_insecure_email_lookupneeded to link the pre-existing ldap-created admin by email instead of erroringadmin auth add-oauth/update-oauth, old ldap source deactivated not deleted) -oauth2_client.ACCOUNT_LINKING=autolinks the existing admin by emailupdateStrategies, oldldapstrategy kept in the array butisEnabled:false- omitting it entirely triggers a delete that a still-linked user blocks via FK) - wiki-js doesn't email-link across providers at all, so its existing admin needed a one-time manual db re-point (providerKey='oidc', providerId=NULL) into its "pending social user" shapedesktop SPNEGO on ishtar
security.pam.krb5.enablewirespam-krb5into the PAM stack ahead of the local password check, so a normal login does a real kinit and drops a TGT into the session ticket cacheserverPrincipal=HTTP/id.lament.gay, its own service keytab); the browser flow'sauth-spnegoexecution (disabled by default, not a component-config field) gets flipped toALTERNATIVEover the admin REST API in the same realm oneshotid.lament.gay- zen needed the enterpriseAuthentication.SPNEGOpolicy instead of profile prefs, since its profile is deliberately left unmanaged for noctalia's themingmobile deliberately gets no kerberos equivalent - it already inherits the SSO payoff from the web-tier work (one password, one realm session, all three apps) and there's no sane device-side ticket cache to hook into on a phone.
tower is functionally complete; the one open thread is verifying the SPNEGO negotiation live from ishtar.
keycloakstands up onverdandi7c4e013d93lamentrealm binds to the directory 28f2c0513brealm-as-code via keycloak-config-cli: LDAP user federation to slapd (password auth rides the existing {SASL} -> KDC passthrough), attribute mappers, and a group-ldap-mapper lifting cn=admins -> /admins -> realm-admin. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018rUDy1aEZoephQHL2FnQpzlamentrealm, notmastergrafanagraduates tooidcforgejograduates tooidcea32249de544756920794475692079d63eb4d1eed63eb4d1eebb902ae558bb902ae558313de360dbWIP: antooidctower onverdandi:keycloak+ thelamentrealmoidctower onverdandi: keycloak, thelamentrealm, web-tier SSO + desktop SPNEGO