Parent
Goal
Document the supported broker pattern for enterprise identity sources that SkillHub does not natively implement: Keycloak, authentik, or Dex validates LDAP/AD/SAML/Kerberos upstream and exposes one OIDC issuer to SkillHub.
Scope
- Broker topology and responsibility boundary
- Concrete Keycloak/authentik/Dex setup references using their official documentation
- SkillHub Spring OAuth2/OIDC registration variables and redirect URI
- Stable issuer/registration/subject rules and email assurance mapping
- Claim contract, provisioning/link policy, TLS/secret/CSRF/logging checklist
- Upgrade, rollback, troubleshooting, and validation checklist
- Explicit SAML/Kerberos boundary: broker first; no native implementation in this PR
Acceptance
- No runtime/API/database behavior changes
- No generated docs edits
- Configuration examples only use verified SkillHub fields and clearly mark broker-specific fields as upstream examples
- Official reference links are listed and reachable
- Includes a copy/paste-safe validation checklist with no real credentials
- Add README navigation link
Target big-main; do not merge to main without explicit maintainer confirmation.
Parent
docs/21-unified-identity-federation-design.md§20 PR 10Goal
Document the supported broker pattern for enterprise identity sources that SkillHub does not natively implement: Keycloak, authentik, or Dex validates LDAP/AD/SAML/Kerberos upstream and exposes one OIDC issuer to SkillHub.
Scope
Acceptance
Target
big-main; do not merge tomainwithout explicit maintainer confirmation.