yksa-django-oidc

Keycloak sign-in for the YKSA services that have operators: realm yksa at auth.intra.yksa.space, through mozilla-django-oidc. Opt-in: a service that does not install it never pulls in mozilla-django-oidc, and yksa-django-kit does not depend on it.

Keycloak groups map onto Django groups, one per role. A user in no mapped group cannot sign in. The roles are reconciled on every sign-in; other group memberships are left alone. The Django username follows the Keycloak preferred_username unless a local account holds it.

# settings/base.py
from yksa_oidc import groups_from_env, keycloak_settings

AUTHENTICATION_BACKENDS = [
    "yksa_oidc.backend.RoleOIDCBackend",
    "django.contrib.auth.backends.ModelBackend",
]
globals().update(keycloak_settings(
    client_id="svc.tmtc.yksa.space", client_secret=read_secret("svc_oidc_client_secret", ""),
))
YKSA_OIDC_ROLES = {
    "svc-admin": groups_from_env("SVC_ADMIN_GROUPS", "yksa_admin"),
    "svc-operator": groups_from_env("SVC_OPERATOR_GROUPS", "yksa_operator"),
}
YKSA_OIDC_STAFF_ROLES = ("svc-admin",)

# urls.py
path("oidc/", include("mozilla_django_oidc.urls")),

Every OIDC_* value keycloak_settings returns can be overridden from the environment (OIDC_OP_BASE_URL moves all four endpoints). What a role allows is the service's business; this package only fills the groups.

python -m pytest