Status: Accepted (inherited from production) · Date: 2026-07
Enterprises demand SSO against their own IdPs; NeoClouds need branded,
multi-tenant customer identity. The Token Factory Identity stack (formerly
moad-auth: customized Keycloak 26 + management API/CLI + Keycloakify theming)
runs in production at auth.amazee.io.
Keycloak is the identity component for all editions where SSO is required.
Amended 2026-07-21 (ADR-005 resolution): the MVP ships the Portal, whose
login is Keycloak OIDC — so Keycloak is part of the default MVP install
rather than a later toggle. The toggle remains for gateway-only installs.
- Production-proven stack with the operational sharp edges already filed off
(realm bootstrap, backup, theming pipeline, disposable-email blocking,
magic links).
- Keycloak is the OSS standard enterprises already accept in security reviews;
IdP brokering (Entra/Okta/SAML) is core Keycloak functionality — our planned
enterprise federation work configures it rather than builds it.
- The management API/CLI removes the classic "Keycloak admin console sprawl"
objection for operators.
- The chart carries a Keycloak subchart (+ MariaDB); enabled by default in
the MVP profile (the Portal needs OIDC), toggleable off for gateway-only
installs.
- LibreChat must support both auth modes (local users / OIDC) — kept honest
by the toggle being a first-class CI matrix entry.
- Multi-tenant IdP brokering (NeoCloud, one realm-per-tenant vs
org-per-tenant) is a deliberate later design — explicitly deferred.