MCM-35 — Dedicated Keycloak Realm for Internal Access

← Back to Internal Docs Single Sign-On overview

As a Platform Admin,
I want a Keycloak realm dedicated to internal tooling, with its own client for mcm-docs,
so that staff authentication is centralized and separate from any product or customer identity system, and future internal tools can be added as their own clients.

Acceptance Criteria

• A dedicated realm for internal tooling exists, separate from any realm used by the product itself or by MCM Nexus.
• A client for mcm-docs exists within that realm, configured as confidential with the correct redirect URI for the gateway.
• The client's secret is stored securely and is never committed to a repository.
• At least one staff account can successfully log in through this realm.

---

Technical Design

A new Keycloak realm is created specifically for internal tooling access, kept entirely separate from the realm the product uses for its own customer-facing identity and from MCM Nexus's own realm — three distinct trust domains for three distinct purposes. mcm-docs gets its own client within this new realm; the client secret is generated once and stored in a secrets manager, injected into the gateway's configuration at deploy time rather than written into any config file that gets committed.

---

UI / Frontend Changes

• No end-user UI — Keycloak's own hosted login page is what staff interact with, and it isn't customized by this story.
• Realm/client administration happens in Keycloak's own admin console, not a new screen built for this.