Add keycloak project: realm import, resource server with realm and client role mapping, audience and issuer traps, method security, admin client

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRLbHYdXVEBzGVhYq3pz4q

keycloak/scripts/run-all.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Downloads the real Keycloak distribution from Maven Central, imports realm/demo-realm.json, runs the tests against it
+# and writes the transcripts to cap/. No Docker needed. First run downloads about 170 MB.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+KC_VERSION=26.8.1
+KC_HOME=.kc/keycloak-$KC_VERSION
+mkdir -p cap .kc
+
+if [ ! -d "$KC_HOME" ]; then
+  curl -fsSL --retry 5 --retry-delay 15 -o .kc/keycloak.tar.gz \
+    "https://repo1.maven.org/maven2/org/keycloak/keycloak-quarkus-dist/$KC_VERSION/keycloak-quarkus-dist-$KC_VERSION.tar.gz"
+  tar -xzf .kc/keycloak.tar.gz -C .kc
+fi
+rm -rf "$KC_HOME/data"
+mkdir -p "$KC_HOME/data/import"
+cp realm/demo-realm.json "$KC_HOME/data/import/"
+
+KC_BOOTSTRAP_ADMIN_USERNAME=admin KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
+  "$KC_HOME/bin/kc.sh" start-dev --http-port=8180 --import-realm > .kc/keycloak.log 2>&1 &
+KC_PID=$!
+trap 'kill $KC_PID 2>/dev/null || true; wait $KC_PID 2>/dev/null || true' EXIT
+
+for _ in $(seq 1 120); do
+  curl -s -o /dev/null http://localhost:8180/realms/demo/.well-known/openid-configuration && break
+  sleep 2
+done
+curl -fs -o /dev/null http://localhost:8180/realms/demo/.well-known/openid-configuration
+
+{
+  echo "Keycloak distribution: keycloak-quarkus-dist-$KC_VERSION from Maven Central (start-dev, built-in H2 database)"
+  grep -E "KC-SERVICES0030|Realm 'demo' imported|started in" .kc/keycloak.log | sed -E 's/^[0-9-]+ [0-9:,]+ //'
+} > cap/05-keycloak-startup.txt
+
+mvn -q -B test -Dkeycloak.url=http://localhost:8180