Keycloak Configuration¶
Realm Structure¶
The ses realm contains:
Roles¶
| Role | Description |
|---|---|
ses-superuser |
Full superuser (Django is_superuser=True) |
ses-admin |
Staff access (Django is_staff=True) |
ses-teacher |
Faculty-scoped exam management |
ses-student |
Exam entry only |
Client: ses-server¶
| Setting | Value |
|---|---|
| Client ID | ses-server |
| Flow | Authorization Code + PKCE |
| Scopes | openid, profile, email, roles, ses-claims |
Client Scope: ses-claims¶
| Mapper | Claim | Source |
|---|---|---|
| realm_roles | roles |
User's realm roles |
| faculty | faculty |
User attribute |
| student_number | student_number |
User attribute |
| employee_number | employee_number |
User attribute |
Test Users (Local Development)¶
| Username | Roles | Identifier |
|---|---|---|
| superuser | ses-superuser | employee_number=SUP001 |
| admin | ses-admin | employee_number=ADM001 |
| teacher1 | ses-teacher | faculty=CS |
| teacher2 | ses-teacher | faculty=MATH |
| student1 | ses-student | student_number=S12345678 |
| student2 | ses-student | student_number=S87654321 |
Accessing Keycloak Admin¶
- Local:
http://localhost:8080/admin/ - Username:
admin - Password: Value of
KEYCLOAK_ADMIN_PASSWORDin.env.secrets
OIDC Endpoints¶
| Endpoint | URL |
|---|---|
| Authorization | http://localhost:8080/realms/ses/protocol/openid-connect/auth |
| Token | http://keycloak:8080/realms/ses/protocol/openid-connect/token |
| JWKS | http://keycloak:8080/realms/ses/protocol/openid-connect/certs |
| Logout | http://localhost:8080/realms/ses/protocol/openid-connect/logout |
Security Features¶
- PKCE (S256): Proof Key for Code Exchange
- State parameter: CSRF protection
- Nonce: Replay attack prevention
- JWKS signature verification: ID token signature validation