Skip to content

Platform Auth

Goal

keycloak.ilgaming.xyz is the shared identity provider for the box.

The intent is to stop creating isolated per-app login systems and move new apps toward one platform SSO model:

  • one Keycloak realm for the platform
  • one client per application backend or BFF
  • app-specific local sessions after the OIDC callback

Current deployment

Item Value
Managed app id keycloak
App directory /home/steam/apps/keycloak
Local port 127.0.0.1:8420
Public hostname keycloak.ilgaming.xyz
Health endpoint http://127.0.0.1:8420/health/ready
Realm baseline iLGaming

Initial bootstrap model

The stack uses:

  • Postgres for Keycloak state
  • bootstrap admin credentials from /home/steam/apps/keycloak/.env
  • startup realm import from /home/steam/apps/keycloak/realm-import/realm.json

The baseline import intentionally avoids shipping demo users, client secrets, or enabled social providers.

Integration pattern for apps

Standardize new apps on these rules:

  1. Create one OIDC client per app backend.
  2. Keep the client secret out of source control.
  3. Use Keycloak as the only identity provider your apps talk to directly.
  4. Let Keycloak broker external providers later if needed.

Recommended environment shape for app backends:

KEYCLOAK_ISSUER=https://keycloak.ilgaming.xyz/realms/iLGaming
KEYCLOAK_CLIENT_ID=<app-client-id>
KEYCLOAK_CLIENT_SECRET=<generated-secret>
KEYCLOAK_REDIRECT_URI=https://<app-host>/api/auth/callback

First admin tasks

After the first successful boot:

  1. Log into the admin console.
  2. Confirm the iLGaming realm imported successfully.
  3. Create one confidential client per app backend.
  4. Create one or more real test users.
  5. Decide whether to keep or retire the bootstrap admin account.

Future platform direction

Keycloak should become the default answer for authentication across:

  • new apps added to the box
  • existing apps that currently maintain their own local login systems

Migration does not need to be all-at-once. The practical sequence is:

  1. bring Keycloak up and keep it stable
  2. onboard one app at a time to OIDC
  3. remove app-local credential flows only after the Keycloak login path is proven