scott 73701b4a34 Inherit nginx x509 header config, add operator runbook ...

- LookupConfig: ssl-client-cert / ssl-cert-chain-prefix /
  certificate-chain-length now fall back to the built-in nginx
  provider's settings (Config scope, then KC_SPI_X509CERT_LOOKUP_NGINX_*
  env vars), so switching the provider to "hybrid" needs no duplicated
  Helm values. Explicit hybrid-scope settings still override.
- Add LookupConfigTest covering inheritance, override, and defaults
  (14 tests total, all passing).
- Add RUNBOOK.md: phase-by-phase deployment procedure sized to 30-min
  test windows, with verification checklists, forged-header negative
  test, rollback per phase, and failure triage table.
- README/Dockerfile.example updated to match; stop tracking target/
  build output (.gitignore added).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-01 14:06:38 -07:00

keycloak-hybrid-x509-spi

Inherit nginx x509 header config, add operator runbook

2026-07-01 14:06:38 -07:00

.gitignore

Inherit nginx x509 header config, add operator runbook

2026-07-01 14:06:38 -07:00

Description

No description provided

106 KiB

Languages

Java 100%