docs: tb-dev dev-only OIDC redirect URIs + app URLs runbook (post Neon-reset)#15
Closed
aatchison wants to merge 2 commits into
Closed
docs: tb-dev dev-only OIDC redirect URIs + app URLs runbook (post Neon-reset)#15aatchison wants to merge 2 commits into
aatchison wants to merge 2 commits into
Conversation
… Neon-reset) A Neon branch reset (sync-with-parent) reverts the tbpro realm to stage, wiping the tb-dev accounts client's redirect URIs + rootUrl/baseUrl/adminUrl (the latter backs 'Back to Application', which otherwise points to accounts-stage.tb.pro). Document the re-add procedure (temp bootstrap-admin + kcadm) so it can be re-applied after each reset.
…-logout + app URLs)
tb-dev accounts is reachable via BOTH the public ALB and the tailnet host, and login+logout
each need a callback -- so the full re-add is per-host oidc/callback + login + logout/callback,
webOrigins for both, post.logout.redirect.uris=+, and rootUrl/baseUrl/adminUrl. Omitting the
tailnet or logout URIs surfaces as invalid_redirect_uri ('We are sorry').
aatchison
added a commit
that referenced
this pull request
Jul 8, 2026
…onfig-cli (#16) Neon branch resets revert the tbpro realm to the stage clone, wiping tb-dev's thunderbird-accounts OIDC client config (redirect URIs, web origins, rootUrl/baseUrl/adminUrl, is_services_admin mapper) and forcing a manual kcadm re-add each time (accounts login 400s; "Back to Application" points at stage). Reconcile that config automatically on every Keycloak start with the keycloak-config-cli already shipped in the image (same tool as the MFA flow) -- nothing baked into thunderbird-accounts. Delivered from this repo as ConfigMaps: - realm-config/tbpro-accounts-client.yaml: desired client state (config-cli import) - realm-config/apply-client-config.sh: ready-poll + config-cli run, fail-soft, launched from the overlay command: (sibling of the image's apply-mfa-config.sh) - admin-client-externalsecret.yaml: KEYCLOAK_ADMIN_CLIENT_SECRET for config-cli auth Auth is client_credentials as the master-realm tb-accounts-admin service account, whose secret is the cloned stage value (mzla/tb-dev/keycloak-customer-admin-client) -- so it keeps matching after a reset. Wiring it also un-skips the image's apply-mfa-config.sh (silently skipped on tb-dev until now). IMPORT_MANAGED_CLIENT= no-delete: only this client is touched; other tbpro clients/users are never deleted (verified live: 25 clients / 152 users unchanged, and a simulated reset was restored). Domain-parameterized for the prod cutover (platform-infrastructure#142): the tb-prod overlay reuses the same mechanism with real-domain values. Supersedes the manual runbook in PR #15. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Neon branch reset reverts the tbpro realm to stage and wipes the tb-dev accounts client's redirect URIs + rootUrl/baseUrl/adminUrl (the last backs Keycloak's 'Back to Application', which otherwise sends users to accounts-stage.tb.pro).
docs/dev-realm-redirect-uris.mddocuments the re-add procedure (temp bootstrap-admin + kcadm), the exact tb-dev values, verification, and notes which other reset-reverted clients are irrelevant on tb-dev (all butstalwart, pending #146). Docs-only.