Verified:GitHub

Identity & Authentication

Combine Keycloak authentication, OPA policy evaluation, and Vault secret handling for controlled access.

Updated Jan 12, 2026

Search Tags:#authorization #rbac #vault #oidc #keycloak #opa #rego

One-click install

npx skills add https://github.com/drdave-flexnetos/ripple-env --skill identity-authentication-drdave-flexnetos

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: Identity & Authentication
Source: https://github.com/drdave-flexnetos/ripple-env/tree/main/.claude/skills/identity-auth
Command: npx skills add https://github.com/drdave-flexnetos/ripple-env --skill identity-authentication-drdave-flexnetos

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identity and access systems are hard to implement correctly, especially when you need consistent authentication (login/token issuance) and authorization (role-based and policy-based access) across services.

Core Features & Use Cases

Keycloak setup and admin workflows: Configure realms, clients, users, roles, and groups, then manage credentials with the Keycloak admin CLI.
OIDC token handling: Acquire and introspect tokens using the OpenID Connect endpoints for development and integration testing.
OPA authorization with Rego: Write and evaluate authorization rules so access decisions are made from structured input like user roles and resource attributes.
Vault secret management and auth: Store secrets safely and secure service-to-service authentication using AppRole, plus optional dynamic credential generation patterns.
Integration patterns: Validate JWTs in application code and use an OPA sidecar pattern in deployment environments.

Quick Start

Configure Keycloak for a realm and client, then write an OPA policy that allows admin users while denying unauthorized actions, and finally store required credentials in Vault.

Frequently Asked Questions about Identity & Authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Keycloak realms and clients for OIDC token flows?▼

Write OPA authorization policies using Rego to evaluate structured input like user roles and resource attributes, enabling RBAC or ABAC access decisions for your services.

Can I use Vault AppRole for service-to-service authentication and dynamic credentials?▼

Use Vault AppRole for service-to-service authentication to securely store secrets, and optionally configure dynamic credential generation patterns for database access to manage sensitive configuration safely.

What's the best way to combine Keycloak authentication with OPA policy evaluation?▼

Combine Keycloak authentication with OPA policy evaluation by issuing OIDC tokens through Keycloak, then passing structured token claims and user roles to OPA for Rego-based RBAC and ABAC authorization decisions.

Why do I need Rego policies for RBAC and ABAC authorization decisions?▼

Rego policies are needed for RBAC and ABAC authorization decisions to evaluate structured input like user roles and resource attributes, ensuring access decisions are made consistently and transparently.