notandClaude Opus 5 3567bc1f42 feat(infra): enforce MFA on the medewerker realm (refs #132) ...

Every seeded medewerker carries a TOTP credential, so Keycloak's conditional-OTP
step in both the browser and direct-grant flows always challenges them; a password
alone no longer yields a token. CONFIGURE_TOTP becomes a default required action so
any medewerker added later must enrol before logging in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:08:50 +02:00

..

realms

feat(infra): enforce MFA on the medewerker realm (refs #132)

2026-09-03 09:08:50 +02:00

check_realms.py

test(infra): medewerker login must be refused without a second factor (refs #132)

2026-09-03 09:07:45 +02:00

docker-compose.yml

refactor(infra): use upstream images verbatim, seed config via docker cp (refs #30)

2026-06-25 10:22:14 +02:00