MCM-37 — mcm-docs Requires Login

← Back to Internal Docs Single Sign-On overview

As an Engineering Staff member,
I want to be redirected to login when I visit mcm-docs without a session, and to browse freely once I have one,
so that I can't view internal documentation unless I'm authenticated, without being asked to log in on every page.

Acceptance Criteria

• Visiting any mcm-docs page without a valid session redirects to Keycloak login.
• After a successful login, the user lands back on the exact page they originally requested, not a generic landing page.
• With a valid session, every page of mcm-docs is reachable without being asked to log in again.
• The session persists across a browser refresh.
• The session expires according to the realm's configured SSO session timeout (see the overview's Open Questions for the actual policy).

---

Technical Design

The gateway checks for a valid session on every request to mcm-docs. Without one, it redirects to Keycloak's login page, carrying the originally requested URL through the login flow so the user lands back on it after authenticating; with one, the request is forwarded straight to mcm-docs's origin with no further prompt. The first visit costs one round trip through login; every visit after that is just a session check.

---

UI / Frontend Changes

• No new pages built for this — Keycloak's own hosted login page is what staff see when unauthenticated.
• mcm-docs's own pages are unchanged; the only difference is that reaching them now requires passing through login first.