메뉴
Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | keycloak-auth |
| description | Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims. |
Sources: ui/src/lib/auth.ts, jad/keycloak-realm.json, CLAUDE.md gotcha #5,
ui/__tests__/unit/config/keycloak-realm.test.ts,
docs/knowledge/runbooks/keycloak-realm-drift.md.
wellKnown in the NextAuth provider — set token, userinfo,
jwks_endpoint to the Docker-internal host (keycloak:8080) and
authorization/issuer to the public URL (incident-tested invariant).health-dataspace-ui is confidential + PKCE S256; NextAuth checks
must include ["pkce", "state"] or Keycloak returns invalid_request.token.realm_access?.roles in the JWT callback; route
protection lives in ui/src/middleware.ts — read it before adding routes.DEMO_PERSONAS array in auth.ts.jad/keycloak-realm.json is the source of truth, but a
realm re-import returns 409 and imports nothing on an existing realm — new
users/roles/redirect-URIs must be reconciled via the Admin REST API on
deployed instances (see the realm-drift runbook for the exact procedure).keycloak-realm.test.ts green — it pins the production URIs.Realm file, live instance, and the regression test stay in agreement.
Use when the user adds or modifies a Next.js API route under ui/src/app/api/.
Use when the user works on EHDS articles, DSP protocol, DCP credentials, ODRL policies, or the audit trail.
Use when the user works on the force-directed graph explorer, layer colours, persona views, or node filtering.
Use when the user adds nodes, relationships, constraints, or indexes to the Neo4j knowledge graph, or edits any *.cypher file.
Use when the user adds E2E tests, Playwright specs, or journey coverage.
Use when the user works on demo personas, localStorage persistence, or GitHub Pages static-export behaviour.