Anthony LC 59bf86822c 🔧(keycloak) configure realm for the MCP server ...

Add to the dev realm:

- `docs-mcp-client`, the public PKCE client MCP clients authenticate
  with, with optional scopes `docs:documents:{search,read,create}` and
  `docs-mcp`.
- `docs-api`, the confidential client Django uses as introspection
  credentials (`OIDC_RS_CLIENT_ID/SECRET`).
- the `docs:documents:*` consent scopes and a `docs-mcp` audience-mapper
  scope that stamps the `docs-mcp` audience only when requested.

Point the resource-server env at the `impress` realm and the new
clients, allow the `docs-mcp-client` audience, and grant users
`offline_access` for refresh tokens.

2026-09-06 14:19:57 +02:00

..

realm.json

🔧(keycloak) configure realm for the MCP server

2026-09-06 14:19:57 +02:00