Skip to content

Document Keycloak-only instances #212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
grzanka wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Document Keycloak-only instances #212

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
29de06b
Document Keycloak-only instances in authentication docs
grzanka Oct 1, 2026
803b7a4
Document single ENABLE_LOCAL_USERS flag, disabled by default
grzanka Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,3 +24,13 @@ These variables needs to be provided to the docker compose files via the `.env`
The backend propagates this variable to the `yaptide_flask` container, to be able to verify keycloak tokens.
The frontend needs to know the URL of the keycloak server, so it can redirect the user to the login page.
To properly setup these variables in case of ansible deployment, please use `yap_dev_vars.yml` as an example.

## Keycloak-only instances

Local users (the first method) are disabled by default: the backend accepts only Keycloak users unless the backend `.env` file sets

* `ENABLE_LOCAL_USERS=true` - allows local users to register and log in with a username and password.

When the variable is unset or `false`, `/auth/register` and `/auth/login` return `403`, and sessions of local users are rejected. This also applies to the `admin` user created by the ansible playbook with `db_manage.py add-user`.

The frontend needs no extra setting: it asks the backend whether local users are enabled and hides the "use password login" option when they are not.
Loading