Building an OAuth2-secured MCP mail server against a real Dovecot/Postfix mailbox surfaced four separate Keycloak client registrations, a Default-vs-Optional scope trap, and a genuinely counter-intuitive Audience-mapper gotcha behind a mysterious active: false.
Category: OIDC
First: Store credentials for future kcadm.sh calls: Now we can use kcadm.sh without entering passwords every time (at least for some time): Lessons learned For security reasons I had TOTP activated for my (master realm) admin account. When trying to add credentials for kcadm.sh usage I always got: So I had to dig a little […]