Repository navigation
0.17c Production identity: production realm, admin MFA, auth event logging #121
Description
Split from #29 (Marco, 2026-10-04). Agent: identity-dev. Depends on: #120.
Scope
- C-03, production realm (0.05 Keycloak realm export + bff client + seeded users #17 F-1; keycloak-realm T-01, T-02, T-18 and T-20; T77-09):
- no seeded users, with a check that no
dev-user or.testemail exists; sslRequired: allandKC_HOSTNAME;- the admin console is not published (or sits on a separate host);
- realm values written as
${VAR:?}; - a realm migration strategy;
- F-77-2: mount exactly one realm file, never the directory.
- no seeded users, with a check that no
- 0.13 Modules.Admin API #25 C-5 (MFA for platform admins): every holder of
platform-adminmust use MFA, and/api/adminrequires an MFAacr/amrvalue in the access token, not only the role. - C-02, MFA and password checks: MFA for every user, and checks against common, context-specific and breached passwords (ASVS V6.3.3, V6.2.4, V6.2.11, V6.2.12).
- Trigger: before the first non-synthetic user.
- The private Phase 0 VPS has synthetic users only, so this issue designs and configures it, and enforcement may be switched on at the first real user (G1 records which).
- C-10, authentication event logging (ASVS V16.3.1, V16.3.2):
- Keycloak login and admin events on, with retention;
- fixed-text BFF events for sign-in success and failure, and for sign-out;
- an Api Warning for a rejected bearer token, with a reason code and no token data.
Sources: the #29 comments from #25 and #27.
Tier
Full: auth.
Done when
- The production realm imports with no seeded users.
/api/adminrefuses a token without MFA.- The authentication events are emitted and tested.
- The C-02 enforcement point is decided and documented.
Activity
mpcs2013 commentedon Oct 5, 2026
Hosting decisions for this issue (#124, ADR-0016, accepted by Marco on 2026-10-04 and 2026-10-05).
app.p0.home.arpaandid.p0.home.arpa(Caddy on 8443), andnas.home.arpafor DSM..home.arpacannot get public certificates.docs/adr/0016-phase-0-hosting.mdanddocs/architecture/phase-0-hosting.md("Ripple into the downstream issues"), onmainonce 0.17-pre Hosting decision for the private Phase 0 VPS (ADR-0016) #124 merges. Combined review:docs/security/reviews/124.md.What this issue receives:
KC_HOSTNAME=https://id.p0.home.arpa:8443; realm redirect URIs and web origins onhttps://app.p0.home.arpa:8443;KC_PROXY_HEADERS=xforwardedfrom Caddy only, Keycloak not published. Back-channel trust: the BFF (OIDC discovery, token endpoint) and the Api (JWKS, issuer validation) reachhttps://id.p0.home.arpa:8443through Caddy's alias on the back-channel network, so the issuer is identical on front and back channel, and they validate Caddy's certificate against the mounted root; no disabled validation, noKC_HOSTNAME_BACKCHANNEL_DYNAMICneeded. Admin console not on the app-facing path (C-03):/admin/*and/realms/master/*from Marco's workstation only, unrouted if source addresses are not kept; management port 9000 never routed. Healthcheckstart_periodsized to the measured F1. Names and port are variables, so the VPS changes configuration only.