# Local Keycloak Setup

This folder contains the repo-managed Keycloak setup used by Aspire local development.

## Realm Import

- Realm import directory: `backend/Kds.Ai.AppHost/Keycloak/Realms`
- Imported realm: `kdsai`

Aspire mounts this folder into the Keycloak container by calling `WithRealmImport("./Keycloak/Realms")` from `AppHost.cs`.

## Local Admin Credentials

- username: `admin`
- password: `admin`

These are defined in AppHost parameters for local development.

## Seeded Clients

- `kdsai-front`: confidential OpenID Connect client intended for the Laravel BFF
- `kdsai-api`: bearer-only resource client intended for backend JWT validation

## Seeded Users

- `admin@kdsai.local` / `Passw0rd!`
- `user@kdsai.local` / `Passw0rd!`

## Notes

- This setup is for local development only.
- The realm JSON is the source of truth for local bootstrap.
- If local Keycloak state ever drifts from the checked-in realm definition, restart the Aspire app after removing the Keycloak container state.