Skip to content

feat: Keycloak SSO iframe integration - #5

Merged
rubenvdlinde merged 3 commits into
developmentfrom
feat/keycloak-sso-iframe
Mar 5, 2026
Merged

feat: Keycloak SSO iframe integration#5
rubenvdlinde merged 3 commits into
developmentfrom
feat/keycloak-sso-iframe

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

Summary

  • Add server-side Keycloak token pre-loading for seamless SSO inside a Nextcloud iframe (no browser OIDC redirects)
  • Add token proxy endpoint (/api/auth/token) calling the Keycloak ExApp container-to-container
  • Add TCP proxy thread for OIDC issuer URL consistency between Keycloak tokens and OpenTalk controller
  • Add comprehensive README with component descriptions, Mermaid architecture diagrams, and authentication flow documentation
  • Add screenshot of OpenTalk running embedded in Nextcloud

Components

Component Role
FastAPI Wrapper Auth proxy, frontend serving, AppAPI lifecycle
OpenTalk Controller Meeting management, signaling, REST API
Keycloak ExApp OIDC identity provider, user sync, token API
LiveKit WebRTC SFU for video/audio streams
Redis Session cache, pub/sub
MinIO Object storage for uploads
PostgreSQL Meeting persistence

Test plan

  • Click OpenTalk in Nextcloud top menu — should load in iframe (not new tab)
  • Console should show [OpenTalk ExApp] Token pre-loaded with no errors
  • OpenTalk dashboard should display user profile (Admin User)
  • "Start new" and "Plan new" meeting buttons should be functional
  • No CSP errors in browser console

🤖 Generated with Claude Code

rubenvdlinde and others added 3 commits March 5, 2026 14:47
Replace existing license (Apache-2.0/AGPL) with EUPL-1.2 across all
metadata files: LICENSE, appinfo/info.xml, composer.json, package.json.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Nextcloud App Store schema does not accept EUPL-1.2 as a valid
licence value, causing all release uploads to fail with HTTP 400.
Revert to 'agpl' which is in the accepted set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…loading

Enable seamless OpenTalk video conferencing inside a Nextcloud iframe by
pre-loading Keycloak tokens server-side, bypassing CSP-blocked OIDC redirects.
Adds token proxy endpoint, TCP proxy for OIDC issuer consistency, and
comprehensive architecture documentation with Mermaid diagrams.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@rubenvdlinde
rubenvdlinde merged commit 03713e8 into development Mar 5, 2026
0 of 2 checks passed
@rubenvdlinde
rubenvdlinde deleted the feat/keycloak-sso-iframe branch August 14, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants