Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.

status: superseded

superseded-by: 0009-use-keycloak-backed-bff-sessions

Use Keycloak SPA authentication and server authorization

Historical first-phase decision. ADR 0009 supersedes its direct browser-token mechanics for the selected local BFF prototype. Its Keycloak, MFA and record-owner authorization requirements continue through the current security contract.

Atlas selects Keycloak with a public SPA client using authorization code flow, mandatory S256 PKCE, and memory-held tokens. Seeded interactive users use password plus TOTP. APIs and record owners independently enforce identity, current business relationships, task assignment, and action permissions.

The direct SPA approach avoids adding a backend-for-frontend and its cookie-session/proxy layer to the synthetic prototype. Tokens remain accessible to malicious JavaScript if the application suffers script injection; memory-only storage limits persistence but does not remove that exposure. A BFF remains a future architecture option, not an implemented protection.

Consequences

Payment-account changes, payment authorization, and payout-authorizing review decisions require verified higher assurance with MFA freshness within five minutes. A refreshed token or browser flag is not proof of fresh MFA. The selected Keycloak flow and claims need focused validation before these actions are implementation-ready.

The security contract specifies session bounds, controlled recovery, service identity, document quarantine and protected downloads, audit redaction, and English/Spanish authentication. Keycloak owns identity; backend owners retain business authorization. Separate administrative identities and platform-console access do not expand portal business roles.

Exact runtime versions, deployment connectivity, storage protection, and scanner configuration remain in the runtime decision. This ADR does not authorize provisioning or establish production compliance.

Evidence: the owner accepted Decide identity, MFA, sensitive documents, and audit controls.