Added required keycloak config

platform/keycloak/client-urls.yaml

@@ -153,5 +153,13 @@ data:
         "webOrigins": [
           "https://sonarr.${BASE_DOMAIN}"
         ]
+      },
+      "vuln-scanner": {
+        "redirectUris": [
+          "https://cve.${BASE_DOMAIN}/oauth2/callback"
+        ],
+        "webOrigins": [
+          "https://cve.${BASE_DOMAIN}"
+        ]
       }
     }

platform/keycloak/keycloak-realm-clients.sops.yaml

@@ -17,6 +17,7 @@ stringData:
     qbittorrent-client-secret: ENC[AES256_GCM,data:jXNg4mF9Li0ilsV53iYeVJCGavVGFjvLk9jKBrRgcH6id1QCzsjs0bbMqJO5nALWfKhD8+CEmYJRrfABYTFKZA==,iv:XbLkX7/tfB/DLeMriHA3Oo2M6hgF1Z6RbHBXmdwUJoA=,tag:gikgdU0ajNKZxxYEUGc1aw==,type:str]
     radarr-client-secret: ENC[AES256_GCM,data:acsBXdewKB/gJNyoo1CsPLCvZe6fuJWbrKLim1/57OPnDHNoA+OvkQqt12Y4VMAXjzl7BWD2afFTIkIcaNGgaQ==,iv:VSvMaDZeuFyIAWpUoa++khvx07hY6g7X8PxORtjFTVI=,tag:jY5QSw6cMvUhCfX32RNgXA==,type:str]
     sonarr-client-secret: ENC[AES256_GCM,data:6cCVadKAKh5YbZIPocXG8pNY/AZbo3zCUP/19a0aHK0fIx6QzvBBl7v2vTsY/tq5tiVx8Uzr6oQNo/xt6pIgIA==,iv:EBXBZgpgdt7GiIS0w/Uj/vNE9EBgSgrbaMOKP346GKA=,tag:I2skAB+fdfQTsMgcywOrAg==,type:str]
+    vuln-scanner-client-secret: ENC[AES256_GCM,data:8LHIcFx42UzW3XMqgDe+lPJD6cdj8m/AWQa7tNPweIFZ7dZgvsDp5zjOUN8z+F+BnAVgMlt4fwHh6F/OyRy12w==,iv:BxdvgUWFyGPcFpWx+rYu2GDwc+cUEKqQGBxtBiuu/Lc=,tag:WQ322UyYtxSewyQBo5Ec1w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -32,8 +33,8 @@ sops:
             YXJGUUJiTnFndFhDZDU1bmxXTENCbmsKuhb3RQ3LZmuTPAXEck8b6iuZ5vxLb9fV
             +fQELmU4kOTbZrPSxy+kpttLG5Cy5d6X2ieZXBf6opzpLTUhlBOkHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-31T13:42:49Z"
-    mac: ENC[AES256_GCM,data:/sOLb/XYQ2WB+mPgnTfYXD3y7xwDi926v0e2upBqgcCugtfKHg+Q1C9+XUiG2qE/iIBJyYVtOu9pmiMMNyT9hJ9vm7WFOC6gqukFMo42PjAI4I4PExfjVMKt76kKJ4OZZrKF2IKLjccZFuKDQhfADIR3zl6UNf/x5wz7XpXPEvI=,iv:iV4eOcRxsgTm1uNVMkMwsspj9glKCSZQlBciRY+MDJY=,tag:c72Pks1VJH+gmfP5FOQPSw==,type:str]
+    lastmodified: "2026-11-09T22:22:55Z"
+    mac: ENC[AES256_GCM,data:xZTYvTnXI/W5bKpa5orycFIK00+oZXtck9XASOulL9pvvZL+g3VR79mSN5bjmKHvA7LNcd8z2SJhNVqDxuEs1ciOiFHDgMq/ZNS4l0xmy3LJPFKKvgTYjKWgEfGJM9xxzr3SkrTtIFllydQ/7Q2RhHhb5m4pbr2HCLpANkp5bKo=,iv:tYOuIkS5oS2h623gIRUar5M75xd8E1TKTlkloHft3iU=,tag:/rYmgOs9Pz4D0kO53uaoTw==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4

platform/keycloak/keycloak-realm-clients.sops.yaml.example

@@ -40,3 +40,4 @@ stringData:
   headlamp-client-secret: REPLACE-ME
   # Mirror into platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml (key: client-secret).
   crafty-client-secret: REPLACE-ME
+  vuln-scanner-client-secret: REPLACE-ME

platform/keycloak/keycloak-realm-import.yaml

@@ -43,6 +43,10 @@ spec:
       secret:
         name: keycloak-realm-clients
         key: crafty-client-secret
+    VULN_SCANNER_CLIENT_SECRET:
+     secret:
+       name: keycloak-realm-clients
+       key: vuln-scanner-client-secret
     PIHOLE_CLIENT_SECRET:
       secret:
         name: keycloak-realm-clients
@@ -525,6 +529,29 @@ spec:
       # the SAME value is mirrored in apps/wave-0/pihole-oauth2-proxy-credentials.sops.yaml (cross-
       # namespace mirror). Provisioned live via kcadm at authoring time (2026-08-31) and captured here
       # as the durable GitOps source of truth (the operator imports the realm once; kcadm is authoritative).
+      - clientId: vuln-scanner
+        name: CVE report (oauth2-proxy)
+        protocol: openid-connect
+        enabled: true
+        publicClient: false
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: false
+        secret: "$(env:VULN_SCANNER_CLIENT_SECRET)"
+        redirectUris:
+          - https://cve.${BASE_DOMAIN}/oauth2/callback
+        webOrigins:
+          - https://cve.${BASE_DOMAIN}
+        defaultClientScopes: [email, profile, roles]
+        protocolMappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              "full.path": "false"
+              "id.token.claim": "true"
+              "access.token.claim": "true"
+              "userinfo.token.claim": "true"
+              "claim.name": groups
       - clientId: pihole
         name: PiHole (oauth2-proxy)
         protocol: openid-connect