Component: tokenfactory-identity · Formerly: moad-auth (repo
amazeeio/moad-auth, local: ~/git/amazeeio/moad-auth) · Runs as:
auth.amazee.io + api.auth.amazee.io · Status: ✅ production
The identity stack: a customized Keycloak 26 deployment plus a management
API/CLI that makes Keycloak administration sane. This is the
Identity & SSO capability.
| Component | Stack | What it does |
|---|---|---|
| Keycloak image | Keycloak 26.6 (Quarkus), MariaDB | Custom image bundling extensions + realm import (amazee.io realm) |
| Extensions | Java SPIs | magic-link login (Phase Two), home-IdP discovery, disposable-email blocking (patched for subdomains), marketing opt-in event listener |
| Login theme | Keycloakify 11 + React 18 + Tailwind 4 | Branded login/email themes — per-operator theming for NeoClouds |
| Management API | Symfony 7.4 / PHP 8.3 | REST wrapper over the Keycloak Admin API: apps, users, groups, invites, access grants — clients are provisioned dynamically, not seeded |
| CLI | Symfony console (PHAR) | Operator tooling against the management API, multi-instance aware |
Single amazee.io realm: email-as-username, registration with email
verification, strong password policy, brute-force protection, Google IdP,
magic-link flow, SES SMTP. OIDC clients (e.g. ai-dashboard, moad) are
created through the management API.
| Edition | Usage |
|---|---|
| Enterprise MVP | Optional — the MVP scope allows starting without SSO (gateway-native users) and adding Keycloak when the demo needs enterprise identity. The chart includes it as a toggle. |
| Enterprise | The IdP, plus brokering to the customer's own IdP (Entra/Okta/SAML) — planned work. |
| NeoCloud | The IdP with per-operator theming; multi-tenant IdP brokering is the long-pole item. |
See ADR-004 for why Keycloak.