feat(identity): pluggable identity providers — Keycloak + OpenIddict

[antosubash]

Summary

• Pluggable identity providers via Identity:Provider config key — supports both OpenIddict (default, self-hosted) and Keycloak (external IdP) in the same binary
• New Identity.Contracts module with provider-agnostic ISessionContracts, IIdentityProvider, SessionDto, and RevokeSessionResult — all consuming modules depend on contracts, not a specific provider
• New Keycloak module with OIDC auth code + PKCE flow, JWT Bearer validation, SmartAuth policy scheme, Admin REST API client with singleton token cache, claims transformation (realm_access → roles), and JIT shadow user provisioning
• Users module dual-mode: local mode (UserManager via ASP.NET Identity) vs external mode (direct EF Core, read-only admin) — auto-selected by config
• Aspire AppHost conditionally starts Keycloak 26.2 Docker container with pre-imported realm, test users, and configured clients via --launch-profile keycloak
• Admin module refactored to depend on Identity.Contracts instead of OpenIddict.Contracts for session management
• Role sync: Keycloak roles are JIT-synced to local ASP.NET Identity roles so permissions resolve correctly

Architecture

Identity.Contracts (ISessionContracts, IIdentityProvider)
    ├── OpenIddict module (implements when Identity:Provider != Keycloak)
    ├── Keycloak module  (implements when Identity:Provider == Keycloak)
    └── Admin module     (consumes contracts, provider-agnostic)

Users module
    ├── Local mode:    UserService → UserManager
    └── External mode: ExternalUserService → direct EF Core

How to switch providers

# OpenIddict (default)
dotnet run --project SimpleModule.AppHost

# Keycloak
dotnet run --project SimpleModule.AppHost --launch-profile keycloak

Screenshots — OpenIddict mode (default)

Landing Page

Login Page

Authenticated Dashboard

Admin Hub

Admin Users

User Sessions (ISessionContracts)

Screenshots — Keycloak OIDC flow

1. Click "Log in" → Redirects to Keycloak

2. Enter Keycloak credentials

3. OIDC callback → Authenticated Dashboard (Admin link visible)

4. Admin Hub (Keycloak mode — roles synced from Keycloak)

5. Admin Users (JIT-provisioned user visible)

6. User dropdown

Test plan

• All 1,230 unit tests pass (0 failures)
• All 172 e2e tests pass (OpenIddict mode)
• Build succeeds with 0 warnings, 0 errors
• Biome lint + format check passes
• Docker image builds successfully
• Browser smoke check: landing page, login, dashboard, admin users all render correctly
• Keycloak OIDC flow verified end-to-end (redirect → Keycloak login → callback → authenticated dashboard)
• Keycloak roles correctly mapped — Admin sidebar visible, permissions working
• Reviewer runs dotnet run --project SimpleModule.AppHost --launch-profile keycloak and verifies Keycloak login flow
• CI is green

[cloudflare-workers-and-pages]

Deploying simplemodule-website with    Cloudflare Pages

Latest commit:	6455a8d
Status:	✅  Deploy successful!
Preview URL:	https://8490fb80.simplemodule-website.pages.dev
Branch Preview URL:	https://feature-keycloak-identity.simplemodule-website.pages.dev

View logs