Skip to content

feat(keycloak): onboard Apply7 as an OIDC identity provider #5638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shaidar merged 9 commits into from
Sep 10, 2026
Merged

feat(keycloak): onboard Apply7 as an OIDC identity provider #5638

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a987926
feat(keycloak): onboard Apply7 as an OIDC identity provider
shaidar Aug 28, 2026
d1c4cbb
feat(keycloak): map Apply7's customer_id/customer_name OIDC claims
shaidar Sep 1, 2026
61eb29f
fix(keycloak): pass resource_options to the OIDC broker IdentityProvider
shaidar Sep 1, 2026
da9e429
docs(keycloak): fix onboard_oidc_org's None-return docstring
shaidar Sep 1, 2026
cf161be
fix(keycloak): stop misattributing OIDC IdP skip reason to URL access
shaidar Sep 1, 2026
6daee1c
docs(keycloak): document Apply7's customerId/customerName semantics
shaidar Sep 2, 2026
df52315
docs(keycloak): make customerId/customerName a validated contract
shaidar Sep 3, 2026
b69c18a
fix(keycloak): enforce non-empty customerId as documented
shaidar Sep 3, 2026
0ac7e21
Merge remote-tracking branch 'origin/main' into feat/apply7-oidc-idp
shaidar Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions src/ol_infrastructure/substructure/keycloak/olapps.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1487,6 +1487,29 @@ def create_olapps_realm( # noqa: PLR0913, PLR0915
)
# MASAI SCHOOL [END]

onboard_oidc_org(
OIDCIdpConfig(
idp_alias="APPLY7",
idp_display_name="Apply7",
org_oidc_metadata_url="https://keycloak.apply7.cn/realms/mit-learn/.well-known/openid-configuration",
realm_id=ol_apps_realm.id,
first_login_flow=ol_first_login_flow,
resource_options=resource_options,
client_id="mit-learn",

@shaidar shaidar Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified this against oidc_helpers.py:74-105: since no client_secret is set for Apply7, and their discovery document lists private_key_jwt under token_endpoint_auth_methods_supported, this deploys clientAuthMethod: private_key_jwt with an empty client_secret — not an unauthenticated config, you're right.

This actually matches what Apply7 asked for in their original intake: "we will need MIT to provide the public certificate for certificate-based authentication. We will install the certificate..." — that certificate is our realm's JWKS, which is exactly what private_key_jwt requires them to validate our client assertions against. Same pattern as Masai School (see the comment on that block in olapps.py).

So the code is doing the right thing if Apply7 actually configures their mit-learn client to validate against it. What's still needed before this can work end-to-end: sending Apply7 our production realm's JWKS URL (https://sso.ol.mit.edu/realms/olapps/protocol/openid-connect/certs) and confirming they've installed/configured it for private_key_jwt on their side — otherwise every token exchange fails with invalid_client. That's a partner-coordination step, not a code change, so I'm leaving this open and adding it as a pre-merge checklist item on the PR rather than resolving it here.

),
org=OrgConfig(
# Same as upGrad/Masai School: Apply7 users log in via a
# direct kc_idp_hint link, not domain-based home-realm
# discovery, so no domain is needed to gate access.
org_domains=[],
org_name="Apply7",
org_alias="APPLY7",
learn_domain=mitlearn_domain,
realm_id=ol_apps_realm.id,
resource_options=resource_options,
),
)
Comment thread
sentry[bot] marked this conversation as resolved.

# B2B Organizations [END]

if stack_info.env_suffix in ["ci", "qa"]:
Expand Down