Initial commit: add .gitignore and README

identity/user-management/keycloak-realm.json

@@ -0,0 +1,69 @@
+{
+  "realm": "workspace",
+  "enabled": true,
+  "displayName": "Workspace Realm",
+  "displayNameHtml": "<div class=\"kc-logo-text\"><span>Workspace</span></div>",
+  "users": [
+    {
+      "username": "admin",
+      "enabled": true,
+      "emailVerified": true,
+      "firstName": "Admin",
+      "lastName": "User",
+      "email": "admin@example.com",
+      "credentials": [
+        {
+          "type": "password",
+          "value": "change-me-in-production",
+          "temporary": false
+        }
+      ],
+      "realmRoles": ["admin", "user"]
+    }
+  ],
+  "roles": {
+    "realm": [
+      {
+        "name": "admin",
+        "description": "Administrator role"
+      },
+      {
+        "name": "user",
+        "description": "Standard user role"
+      },
+      {
+        "name": "developer",
+        "description": "Developer role"
+      },
+      {
+        "name": "viewer",
+        "description": "View-only role"
+      }
+    ]
+  },
+  "clients": [
+    {
+      "clientId": "workspace-api",
+      "enabled": true,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "change-me-in-production",
+      "redirectUris": ["*"],
+      "webOrigins": ["*"],
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": true
+    }
+  ],
+  "identityProviders": [],
+  "smtpServer": {
+    "host": "smtp.example.com",
+    "port": "587",
+    "from": "noreply@example.com",
+    "auth": true,
+    "starttls": true,
+    "user": "smtp-user",
+    "password": "smtp-password"
+  }
+}
+

identity/user-management/setup.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Setup centralized user management in Keycloak
+
+set -e
+
+NAMESPACE="identity"
+KEYCLOAK_URL="${KEYCLOAK_URL:-http://keycloak.${NAMESPACE}.svc.cluster.local:8080}"
+ADMIN_USER="${KEYCLOAK_ADMIN:-admin}"
+ADMIN_PASSWORD="${KEYCLOAK_ADMIN_PASSWORD:-change-me-in-production}"
+
+echo "👥 Setting up centralized user management..."
+
+# Check if Keycloak is accessible
+if ! curl -s "${KEYCLOAK_URL}/health" > /dev/null; then
+  echo "⚠️  Keycloak not accessible at $KEYCLOAK_URL"
+  echo "   → Ensure Keycloak is deployed and running"
+  exit 1
+fi
+
+# Get admin token
+echo "🔑 Getting admin token..."
+TOKEN=$(curl -s -X POST "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
+  -d "client_id=admin-cli" \
+  -d "username=${ADMIN_USER}" \
+  -d "password=${ADMIN_PASSWORD}" \
+  -d "grant_type=password" | jq -r '.access_token')
+
+if [ -z "$TOKEN" ] || [ "$TOKEN" == "null" ]; then
+  echo "❌ Failed to get admin token"
+  exit 1
+fi
+
+# Create realm
+echo "🌍 Creating workspace realm..."
+curl -s -X POST "${KEYCLOAK_URL}/admin/realms" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d @keycloak-realm.json
+
+echo "✅ User management setup complete!"
+echo ""
+echo "📝 Next steps:"
+echo "   1. Access Keycloak admin console"
+echo "   2. Review realm configuration"
+echo "   3. Create additional users and roles"
+echo "   4. Configure identity providers (if needed)"
+echo "   5. Set up user federation (if needed)"
+