Feature/keycloak vscode redirects

.vscode/mcp.json

@@ -28,6 +28,7 @@
 				"servers/basic_mcp_stdio.py"
 			]
 		},
+
 	},
 	"inputs": []
-}
+}

README.md

@@ -450,6 +450,46 @@ This project supports deploying with OAuth 2.0 authentication using Keycloak as
 
    The agent automatically detects `KEYCLOAK_REALM_URL` in the environment and authenticates via DCR + client credentials. On success, it will add an expense and print the result.
 
+### Use Keycloak OAuth MCP server with GitHub Copilot
+
+The Keycloak deployment supports Dynamic Client Registration (DCR), which allows VS Code to automatically register as an OAuth client. VS Code redirect URIs are pre-configured in the Keycloak realm.
+
+To use the deployed MCP server with GitHub Copilot Chat:
+
+1. To avoid conflicts, stop the MCP servers from `mcp.json` and disable the expense MCP servers in GitHub Copilot Chat tools.
+2. Select "MCP: Add Server" from the VS Code Command Palette
+3. Select "HTTP" as the server type
+4. Enter the URL of the MCP server from `azd env get-value MCP_SERVER_URL`
+5. You should see a Keycloak authentication screen open in your browser. Select "Allow access":
+
+   ![Keycloak allow access screen](screenshots/kc-allow-1.jpg)
+
+6. Sign in with a Keycloak user (e.g., `testuser` / `testpass` for the pre-configured demo user):
+
+   ![Keycloak sign-in screen](screenshots/kc-signin-2.jpg)
+
+7. After authentication, the browser will redirect back to VS Code:
+
+   ![VS Code redirect after Keycloak sign-in](screenshots/kc-redirect-3.jpg)
+
+8. Enable the MCP server in GitHub Copilot Chat tools:
+
+   ![Select MCP tools in GitHub Copilot](screenshots/kc-select-tools-4.jpg)
+
+9. Test it with an expense tracking query:
+
+   ```text
+   Log expense for 75 dollars of office supplies on my visa last Friday
+   ```
+
+   ![Example GitHub Copilot Chat with Keycloak auth](screenshots/kc-chat-5.jpg)
+
+10. Verify the expense was added by checking the Cosmos DB `user-expenses` container in the Azure Portal or by asking GitHub Copilot Chat:
+
+    ```text
+    Show me my expenses from last week
+    ```
+
 ### Known limitations (demo trade-offs)
 
 | Item | Current | Production Recommendation | Why |

infra/http-routes.bicep

@@ -29,18 +29,14 @@ resource httpRouteConfig 'Microsoft.App/managedEnvironments/httpRouteConfigs@202
   parent: containerEnv
   properties: {
     rules: [
-      // Route /auth/* to Keycloak (strip /auth prefix since Keycloak serves at root)
-      // Using pathSeparatedPrefix ensures /auth doesn't match /authentication
       {
         description: 'Keycloak Authentication Server'
         routes: [
           {
             match: {
               pathSeparatedPrefix: '/auth'
             }
-            action: {
-              prefixRewrite: '/'
-            }
+            action: {}
           }
         ]
         targets: [
@@ -49,17 +45,14 @@ resource httpRouteConfig 'Microsoft.App/managedEnvironments/httpRouteConfigs@202
           }
         ]
       }
-      // Route everything else to MCP server (catch-all)
       {
         description: 'MCP Expenses Server'
         routes: [
           {
             match: {
               prefix: '/'
             }
-            action: {
-              prefixRewrite: '/'
-            }
+            action: {}
           }
         ]
         targets: [

infra/main.bicep

@@ -782,8 +782,7 @@ module server 'server.bicep' = {
     openTelemetryPlatform: openTelemetryPlatform
     exists: serverExists
     // Keycloak authentication configuration (only when enabled)
-    keycloakRealmUrl: useKeycloak ? '${keycloak!.outputs.uri}/realms/${keycloakRealmName}' : ''
-    keycloakTokenIssuer: useKeycloak ? '${keycloakMcpServerBaseUrl}/realms/${keycloakRealmName}' : ''
+    keycloakRealmUrl: useKeycloak ? '${keycloak!.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
     keycloakMcpServerBaseUrl: useKeycloak ? keycloakMcpServerBaseUrl : ''
     keycloakMcpServerAudience: keycloakMcpServerAudience
     // Azure/Entra ID OAuth Proxy authentication configuration (only when enabled)
@@ -810,7 +809,7 @@ module agent 'agent.bicep' = {
     openAiDeploymentName: openAiDeploymentName
     openAiEndpoint: openAi.outputs.endpoint
     mcpServerUrl: useKeycloak ? 'https://mcproutes.${containerApps.outputs.defaultDomain}/mcp' : '${server.outputs.uri}/mcp'
-    keycloakRealmUrl: useKeycloak ? '${keycloak.outputs.uri}/realms/${keycloakRealmName}' : ''
+    keycloakRealmUrl: useKeycloak ? '${keycloak.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
     exists: agentExists
   }
 }
@@ -946,9 +945,10 @@ output KEYCLOAK_MCP_SERVER_BASE_URL string = useKeycloak ? keycloakMcpServerBase
 
 // Keycloak and MCP Server routing outputs (only populated when mcpAuthProvider is keycloak)
 output KEYCLOAK_REALM_URL string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/realms/${keycloakRealmName}' : ''
-output KEYCLOAK_ADMIN_CONSOLE string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/admin' : ''
+output KEYCLOAK_ADMIN_CONSOLE string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/admin/master/console' : ''
 output KEYCLOAK_DIRECT_URL string = keycloak.outputs.uri
-output KEYCLOAK_TOKEN_ISSUER string = useKeycloak ? '${keycloakMcpServerBaseUrl}/realms/${keycloakRealmName}' : ''
+output KEYCLOAK_TOKEN_ISSUER string = useKeycloak ? '${keycloakMcpServerBaseUrl}/auth/realms/${keycloakRealmName}' : ''
+output KEYCLOAK_AGENT_REALM_URL string = useKeycloak ? '${keycloak!.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
 
 // Auth provider for env scripts
 output MCP_AUTH_PROVIDER string = mcpAuthProvider

infra/server.bicep

@@ -22,7 +22,6 @@ param applicationInsightsConnectionString string = ''
 ])
 param openTelemetryPlatform string = 'appinsights'
 param keycloakRealmUrl string = ''
-param keycloakTokenIssuer string = ''
 param keycloakMcpServerAudience string = 'mcp-server'
 param keycloakMcpServerBaseUrl string = ''
 param entraProxyClientId string = ''
@@ -112,10 +111,6 @@ var keycloakEnv = !empty(keycloakRealmUrl) ? [
     name: 'KEYCLOAK_REALM_URL'
     value: keycloakRealmUrl
   }
-  {
-    name: 'KEYCLOAK_TOKEN_ISSUER'
-    value: !empty(keycloakTokenIssuer) ? keycloakTokenIssuer : keycloakRealmUrl
-  }
   {
     name: 'KEYCLOAK_MCP_SERVER_AUDIENCE'
     value: keycloakMcpServerAudience

infra/write_env.ps1

@@ -49,6 +49,7 @@ $KEYCLOAK_REALM_URL = Get-AzdValue KEYCLOAK_REALM_URL
 if ($KEYCLOAK_REALM_URL -and $KEYCLOAK_REALM_URL -ne "") {
     Add-Content -Path $ENV_FILE_PATH -Value "KEYCLOAK_REALM_URL=$KEYCLOAK_REALM_URL"
     Write-EnvIfSet KEYCLOAK_TOKEN_ISSUER
+    Write-EnvIfSet KEYCLOAK_AGENT_REALM_URL
 }
 
 # Entra proxy env vars (only if ENTRA_PROXY_AZURE_CLIENT_ID is set)

infra/write_env.sh

@@ -55,6 +55,7 @@ KEYCLOAK_REALM_URL=$(get_azd_value KEYCLOAK_REALM_URL)
 if [ -n "$KEYCLOAK_REALM_URL" ]; then
   echo "KEYCLOAK_REALM_URL=${KEYCLOAK_REALM_URL}" >> "$ENV_FILE_PATH"
   write_env_if_set KEYCLOAK_TOKEN_ISSUER
+  write_env_if_set KEYCLOAK_AGENT_REALM_URL
 fi
 
 # Entra proxy env vars (only if ENTRA_PROXY_AZURE_CLIENT_ID is set)

keycloak/Dockerfile

@@ -22,5 +22,7 @@ ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
 # Start in dev mode with H2 database (still uses pre-built themes)
 # --proxy-headers=xforwarded tells Keycloak it's behind a reverse proxy that sets X-Forwarded-* headers
 # --hostname-strict=false allows dynamic hostname resolution from proxy headers
+# --http-relative-path=/auth sets the base path so Keycloak serves all content under /auth/*
 # --import-realm imports the MCP realm on startup
-CMD ["start-dev", "--http-port=8080", "--proxy-headers=xforwarded", "--hostname-strict=false", "--import-realm"]
+# --import-strategy=overwrite-existing ensures realm.json changes are applied even if the realm exists
+CMD ["start-dev", "--http-port=8080", "--proxy-headers=xforwarded", "--hostname-strict=false", "--http-relative-path=/auth", "--import-realm", "--import-strategy=overwrite-existing"]