keycloaklisted

# Purpose Provide Keycloak identity and access management patterns for the platform. Cover realm setup, client configuration for Auth.js v5 in the web portal repo (project.json → mainApp), two-stage Helm deployment (init/full), bootstrap admin recovery, issuer mismatch fixes, and NetworkPolicy requirements. For Helm chart template authoring beyond Keycloak values, defer to `helm-chart-expert`. For GCP firewall or ingress debugging, defer to `kubernetes-deployment`. # When to use - Configuring the `<keycloak-realm>` realm, clients, roles, or groups in Keycloak - Integrating Auth.js v5 with Keycloak OIDC in the web portal - Setting up Keycloak Helm values (init stage or full stage with ingress) - Debugging Auth.js `error=Configuration` or issuer mismatch (`iss` claim) - Recovering from bootstrap admin failures (existing database, OOM-kill) - Configuring NetworkPolicy for ingress-to-Keycloak traffic # When NOT to use - Authoring Helm chart templates or `_helpers.tpl` -- use `helm-chart-expert` - Debugging GCP firewall rules or minikube tunnel -- use `kubernetes-deployment` - Checking migration safety -- use `migration-check` - Detecting IaC config drift -- use `infrastructure-as-code` # Required environment - Runtime: `.claude/skills/keycloak/SKILL.md` - Tools: `kubectl`, `helm`, `bash` - Keycloak version: 26.x (codecentric/keycloakx Helm chart) - Setup script: the infrastructure repo's `files/keycloak/setup-keycloak.sh` (or the project's equivalent) - Namespace: environm