Yilialinn opened a new issue, #13819: URL: https://github.com/apache/apisix/issues/13819
## Current State The current `Set Up SSO with Keycloak (OIDC)` tutorial uses Keycloak 18.0.2 and UI screenshots that no longer match current Keycloak releases. It configures one client for authorization code, client credentials, and password grants, uses a wildcard valid redirect URI, and includes long access and refresh token examples. This makes the setup difficult to reproduce with current Keycloak and does not clearly separate browser SSO from machine-to-machine authentication. The password grant also occupies a main tutorial section even though it is presented as a legacy flow. The affected page is the [current Keycloak OIDC tutorial](https://apisix.apache.org/docs/apisix/tutorials/keycloak-oidc/). I searched the current APISIX Issues and Discussions and did not find an open proposal for this tutorial refresh. ## Desired State Refresh the existing tutorial while keeping its current title. The proposed version would: - pin the local example to Apache APISIX 3.17.0 and Keycloak 26.7.1; - replace version-sensitive UI screenshots with an importable Keycloak realm; - use a dedicated `apisix-browser` client for authorization code flow with PKCE; - register only the exact callback URI; - use a separate `apisix-service` client for client credentials; - validate service tokens through JWKS and require the audience to match `apisix-service`; - keep direct access grants disabled instead of teaching the password grant; - verify valid browser and service requests plus missing-token, invalid-token, disabled-password-grant, and mismatched-audience cases; - add cleanup and clear development-versus-production security guidance; and - add a small Docker Compose fixture, APISIX configuration, and Keycloak realm JSON under `docs/assets/other/keycloak-oidc/` so reviewers and readers can reproduce the steps without an external upstream service. I have prepared and locally validated the draft across clean Compose starts. The tested scenarios include PKCE `S256`, browser login, client credentials, missing and invalid tokens, disabled password grant, and audience mismatch. The exact Docker Hub APISIX image could not be pulled in my environment because the registry timed out; the runtime verification used an equivalent local image built from the official APISIX 3.17.0 arm64 package. If maintainers agree with this direction and fixture location, I can submit the focused documentation PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
