🪪

Keycloak OIDC

Authenticates users via Keycloak using the standard OpenID Connect authorization-code flow — no custom SSO plumbing required.

👤

Automatic User Provisioning

On first login the connector creates a matching account in SuperSaaS using the official Python API client, then forwards the user transparently.

🐳

Container-Ready

Delivered as a single container image published to GitHub Packages. Drop it into any container runtime and configure via environment variables.

🔒

Session Security

Tokens are stored in a server-side signed session. Supports front-channel logout back to Keycloak with a single redirect.

⚙️

Twelve-Factor Config

Every tuneable — SSO realm, API token, redirect URLs — is driven by environment variables with sensible RaBe defaults that are easy to override.

🧪

100 % Test Coverage

The entire codebase is covered by an integration test suite using pytest with mypy strict-mode type checking and ruff linting baked in.