# Keycloak Authentication Setup

## Quick Start

### 1. Start Services
```bash
docker compose -f docker-compose.dev.yml up -d
```

### 2. Access Keycloak Admin Console
- URL: http://localhost:8080
- Username: `admin`
- Password: `admin`

### 3. Create Realm
1. Click "Create Realm"
2. Name: `vip-coordinator`
3. Click "Create"

### 4. Create Client (for your app)
1. Go to **Clients** → **Create client**
2. Client ID: `vip-coordinator-frontend`
3. Client type: `OpenID Connect`
4. Click **Next**
5. **Capability config:**
   - ✅ Client authentication: OFF (public client)
   - ✅ Authorization: OFF
   - ✅ Standard flow: ON
   - ✅ Direct access grants: ON
6. Click **Next**
7. **Login settings:**
   - Valid redirect URIs: `http://localhost:5173/*`
   - Web origins: `http://localhost:5173`
   - Valid post logout redirect URIs: `http://localhost:5173/*`
8. Click **Save**

### 5. Enable Google Social Login (Optional)
1. Go to **Identity providers** → **Add provider** → **Google**
2. Client ID: (your Google OAuth client ID)
3. Client Secret: (your Google OAuth secret)
4. Click **Save**

### 6. Get Configuration
After setup, Keycloak provides:
- **Realm URL**: `http://localhost:8080/realms/vip-coordinator`
- **Client ID**: `vip-coordinator-frontend`
- **Discovery URL**: `http://localhost:8080/realms/vip-coordinator/.well-known/openid-configuration`

## Next Steps
1. Update backend to use Keycloak JWT validation
2. Update frontend to use Keycloak React SDK
3. Test login flow

## Benefits
- ✅ Self-hosted in Docker
- ✅ No external dependencies
- ✅ Full control over users and roles
- ✅ Social login support
- ✅ JWT tokens
- ✅ User management UI
- ✅ Role-based access control