kevinveenbirkenbachandClaude Opus 5 eda2dd08c0 fix(keycloak): keep the allowed-origins claim out of the access token ...

The web-origins scope mapper listed every registered origin in each access token. openresty forwards that token to SSO-gated upstreams, so on a Tor deployment the claim reached 5457 of the token's 8650 characters and LAM's Apache refused the request with 400 (Moodle#0, run 33689701895).

The realm template carries the change, so a fresh import and every CI round get it directly. The reconcile task exists because 04_realm_import.yml only imports when the realm is missing, which would leave the old mapper in place on running installations.

Keycloak resolves CORS from client.webOrigins in DefaultCors.checkAllowedOrigins whenever the token carries no origins, so enforcement is unchanged; that fallback exists since 26.7 and the role pins 26.7.3. Introspection keeps the claim, and nothing in this repository reads it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:11:41 +02:00

..

cli

fix(inventory): give pinned user passwords the mark the realm policy demands

2026-09-03 02:15:53 +02:00

library

…

plugins

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

roles

fix(keycloak): keep the allowed-origins claim out of the access token

2026-09-03 09:11:41 +02:00

scripts

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

utils

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

__init__.py

…