feat(web-arm): per-site Keycloak clients for TYPO3 SSO #294

New issue

Open

opened 2026-08-08 00:23:56 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-08 00:23:56 +02:00

Owner

Several TYPO3 sites across web-arm and amzebs-01 should offer backend login through sso.cloonar.com. A shared OIDC client across all domains would work — redirectUris is a list — but it puts one secret in every site's config, collapses per-site authorization onto a single set of client roles, and leaves only one backchannel-logout URL for all of them.

So: one client per domain. The cost of that is per-site boilerplate (realm JSON block, sops secret, vault key), which is what makes it annoying enough to skip.

Make adding a site cheap:

derive the realm client, the sops declaration and the vault entry from the domain, driven by a list in the keycloak module
scripts/add-typo3-sso <domain> generates the secret, writes it encrypted into hosts/web-arm/secrets.yaml, appends the domain to the list, and prints the AdditionalConfiguration.php block for EXT:oauth2_client

Access stays gated by the existing browser-flow overrides (browser-spnego admin-only / internal), not by TYPO3.

Several TYPO3 sites across `web-arm` and `amzebs-01` should offer backend login through `sso.cloonar.com`. A shared OIDC client across all domains would work — `redirectUris` is a list — but it puts one secret in every site's config, collapses per-site authorization onto a single set of client roles, and leaves only one backchannel-logout URL for all of them. So: one client per domain. The cost of that is per-site boilerplate (realm JSON block, sops secret, vault key), which is what makes it annoying enough to skip. Make adding a site cheap: - derive the realm client, the sops declaration and the vault entry from the domain, driven by a list in the keycloak module - `scripts/add-typo3-sso <domain>` generates the secret, writes it encrypted into `hosts/web-arm/secrets.yaml`, appends the domain to the list, and prints the `AdditionalConfiguration.php` block for EXT:oauth2_client Access stays gated by the existing browser-flow overrides (`browser-spnego admin-only` / `internal`), not by TYPO3.

dominik.polakovics referenced this issue from a commit

2026-08-08 00:24:53 +02:00

feat(web-arm): per-site Keycloak clients for TYPO3 SSO

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-08 00:27:37 +02:00

feat(web-arm): per-site Keycloak clients for TYPO3 SSO #295