roryqi opened a new pull request, #11730: URL: https://github.com/apache/gravitino/pull/11730
### What changes were proposed in this pull request? Fill three documentation gaps in `docs/security/how-to-authenticate.md` for the v2 Web UI OIDC login with Keycloak: 1. **Secure context requirement** — A note in the *OAuth Mode* section explaining that Web UI OIDC login uses the Authorization Code flow with PKCE, which depends on the browser Web Crypto API and therefore requires a secure context (HTTPS or `localhost`). Plain HTTP on a non-`localhost` host fails. 2. **Separate client configurations** — A new *Enable Web UI OIDC login with Keycloak* subsection that distinguishes the confidential client (machine/engine flows) from a public client (`Client authentication` off, `Standard flow` on) required by the browser UI, with the matching `oidc`-provider configuration. 3. **Token issuer alignment** — Guidance to set the Keycloak realm Frontend URL so the `iss` claim matches across split-hostname deployments, avoiding `JWT iss claim value rejected`. ### Why are the changes needed? Users setting up the v2 Web UI with Keycloak OIDC hit undocumented failures: login breaks over plain HTTP, a single confidential client does not work for the browser, and split-hostname setups get token rejections. These were reported in #11716. Fix: #11716 ### Does this PR introduce _any_ user-facing change? No code change. Documentation only. ### How was this patch tested? Documentation-only change. Verified with the repo docs audit scripts (title/intro/heading/spacing and internal link/anchor checks) — all pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
