Single sign-on hardened with PKCE and strict token validation

Single sign-on is hardened. The authorization code exchange is protected with PKCE, and every endpoint is taken from the provider’s own discovery document, so Entra, Google, and Okta work alongside Keycloak. The identity token must be signed with an asymmetric algorithm the issuer publishes, and a token issued for another application or another tenant is refused.

Provider secrets never leave the server: bind passwords, client secrets, and client keys are stored as encrypted references, are never returned by the API, and are never written to the audit trail or logs.

No action required.