eho/register-referentie
1
0
Fork 0
Code Issues 16 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(bff): medewerker-realm auth + behandelaar policy + GET /behandel/werkbak (refs #13)

Browse Source 
Adds a second JWT bearer scheme for the medewerker realm; on validation it lifts
Keycloak's realm_access.roles onto the principal so the behandelaar policy can
require the role. /behandel/werkbak proxies the domain werkbak behind that policy
(401 without a token, 403 without the role). openapi.json + api-client regenerated;
Keycloak__MedewerkerAuthority wired into compose.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-07-15 11:07:11 +02:00
parent 08515b9bba
commit 1a6daecc47
5 changed files with 150 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
infra/docker-compose.yml
View File

@@ -349,6 +349,8 @@ services:
# Keycloak (start-dev) derives the issuer from the request host, so the BFF authority and the
# verify token request both use keycloak:8080 to keep the issuer consistent.
Keycloak__Authority: http://keycloak:8080/realms/digid
# Behandelaars authenticate against the medewerker realm; the BFF validates it for /behandel/* (S-12c).
Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
Downstream__Domain__BaseUrl: http://domain:8080/
Downstream__Projection__BaseUrl: http://projection-api:8080/
ports: