stt/infra-librechat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(oidc): Switch LibreChat and MCP OAuth to local Keycloak (keycloak.sttlab.local)

Browse Source
This commit is contained in:
Stéphane Tailland
2026-08-23 07:55:28 +02:00
parent 780e25c15e
commit e235d3dea4
5 changed files with 131 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/configmap.yaml
+19 -4
View File
@@ -6,14 +6,29 @@ metadata:
data:
HOST: "0.0.0.0"
PORT: "3080"
DOMAIN_CLIENT: "https://${DOMAIN}"
DOMAIN_SERVER: "https://${DOMAIN}"
DOMAIN_CLIENT: "https://librechat.sttlab.local"
DOMAIN_SERVER: "https://librechat.sttlab.local"
MEILI_HOST: "http://meilisearch:7700"
NODE_ENV: "production"
ALLOW_EMAIL_LOGIN: "true"
ALLOW_REGISTRATION: "true"
ALLOW_SOCIAL_LOGIN: "false"
ALLOW_SOCIAL_REGISTRATION: "false"
ALLOW_SOCIAL_LOGIN: "true"
ALLOW_SOCIAL_REGISTRATION: "true"
# Keycloak SSO, additive alongside email/password login (not replacing it
# — ALLOW_EMAIL_LOGIN stays true). OPENID_CLIENT_SECRET/OPENID_SESSION_SECRET
# are in librechat-secrets (see librechat/deployment.yaml).
OPENID_ISSUER: "https://keycloak.sttlab.local/realms/classic-models"
OPENID_CLIENT_ID: "librechat"
OPENID_CALLBACK_URL: "/oauth/openid/callback"
OPENID_SCOPE: "openid profile email librechat-audience"
OPENID_BUTTON_LABEL: "classic-models SSO"
# RP-initiated logout — without this, switching Keycloak users silently
# reuses the existing SSO session instead of re-prompting.
OPENID_USE_END_SESSION_ENDPOINT: "true"
SESSION_EXPIRY: "900000"
REFRESH_TOKEN_EXPIRY: "604800000"
DEBUG_LOGGING: "false"
OTEL_TRACING_ENABLED: "true"
OTEL_SERVICE_NAME: "librechat"
OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.observability.svc.cluster.local:4318"
OTEL_TRACES_EXPORTER: "otlp"