Overview
DocApply uses Keycloak as its central identity provider for authentication, token issuance, and identity federation via OpenID Connect (OIDC). Authorization (roles, access checks, data ownership) is handled within the DocApply server, not in Keycloak.
For the local development Keycloak setup, see the Developer Documentation.
Role Separation
| Responsibility | Location |
|---|---|
| Authentication (login, tokens) | Keycloak |
| Authorization (roles, access checks) | Spring Boot / DB |
| User creation on first login | DocApply server |
| Role storage | Database |