docs(infra): document MFA on the medewerker realm + ADR-0031 (refs #132)

Runbook gains an MFA section and how to get a code; synthetic-data lists the fixture TOTP secret and the extra grant parameter; demo-script gains the S-15c note and its staff logins now mention the second factor. check_realms.py grows an 'otp' argument that prints a current code for a manual demo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-03 09:11:03 +02:00
parent 3567bc1f42
commit a87a32e269
5 changed files with 129 additions and 5 deletions
@@ -86,4 +86,9 @@ def main():


 if __name__ == "__main__":
-    main()
+    # `check_realms.py otp` prints a current code for the fixture secret — what a human demoing
+    # the medewerker portals types at Keycloak's OTP prompt (docs/runbooks/keycloak.md).
+    if len(sys.argv) > 1 and sys.argv[1] == "otp":
+        print(totp())
+    else:
+        main()