Claude Skills by p2-inc

github.com/p2-inc

36 skillsA× 32B× 40 installs0 views

SecuringAppsReactMcpAWire Keycloak login into a React SPA with oidc-spa, and register or repair the OIDC client the app needs, driven through the Keycloak MCP server's tools. Use this whenever someone wants login added to a browser app - login/logout controls, route protection, reading the signed-in user - against a Keycloak realm. Covers the oidc-spa v10 builder API (which replaced the removed createReactOidc), why the registered redirect URI needs a trailing slash, why updating an existing client must be a merg...ai-agentsgoreactVotes: 0GitHub stars: 4
SecuringAppsReactRestAWire Keycloak login into a React SPA with oidc-spa, and register or repair the OIDC client the app needs, driven through the Keycloak Admin REST API. Use this whenever someone wants login added to a browser app - login/logout controls, route protection, reading the signed-in user - against a self-managed Keycloak realm. Covers the oidc-spa v10 builder API (which replaced the removed createReactOidc), why the registered redirect URI needs a trailing slash, why updating an existing client must ...ai-agentsgobashVotes: 0GitHub stars: 4
ProtectApiSpringBootAProtect a Spring Boot API with bearer JWTs issued by Keycloak: validate tokens against the realm's JWKS and map Keycloak realm roles to Spring Security authorities so hasRole(...) actually grants access. Use whenever someone wants to "secure my API", "validate a JWT", "require a token on my endpoints", "map Keycloak roles to authorities", or is debugging a 401/403 from a Spring Boot resource server. Bearer tokens only - no login UI, no redirect, no cookie session. Covers the issuer-uri config...ai-agentsgojavaVotes: 0GitHub stars: 4
CorporateSsoLoginMcpASet up corporate SSO / enterprise SSO on a Phase Two hosted Keycloak — send a user to their own company's identity provider based on the domain of the email address they type, while everyone else keeps password login — using the Keycloak MCP server. Use this whenever someone says "I want corporate SSO login", "we need enterprise SSO", "SSO for our customer", "let our customer log in with their company account", "log in with my company's SSO automatically", "redirect to my corporate IdP", "aut...ai-agentspythonrustVotes: 0GitHub stars: 4
CorporateSsoLoginRestASet up corporate SSO / enterprise SSO on a self-managed Keycloak — send a user to their own company's identity provider based on the domain of the email address they type, while everyone else keeps password login — using the Admin REST API only (no MCP server involved). Use this whenever someone says "I want corporate SSO login", "we need enterprise SSO", "SSO for our customer", "let our customer log in with their company account", "log in with my company's SSO automatically", "redirect to my...ai-agentspythonrustVotes: 0GitHub stars: 4
CredentialEnrollmentMcpAEnroll a NEW credential on a user who ALREADY exists in a Keycloak realm - a TOTP authenticator, a passkey, a replacement password, recovery codes - driven through the Keycloak MCP server's tools where they exist, with the genuine gaps covered by documented REST recipes. Use whenever someone wants users to "set up 2FA", "enroll in TOTP", "register an authenticator app", "set up my passkey", or asks how a user actually gets their first credential. Two variants, and the PREREQUISITE picks betwe...ai-agentsrustgoVotes: 0GitHub stars: 4
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
CredentialEnrollmentRestAEnroll a NEW credential on a user who ALREADY exists in a Keycloak realm - a TOTP authenticator, a passkey, a replacement password, recovery codes - via the raw Keycloak Admin REST API. Use whenever someone wants users to "set up 2FA", "enroll in TOTP", "register an authenticator app", "set up my passkey", or asks how a user actually gets their first credential. Two variants, and the PREREQUISITE picks between them rather than preference: a required action set on the user reaches anyone who c...ai-agentsrustgoVotes: 0GitHub stars: 4
EmailOtpLoginMcpATurn on passwordless login by a one-time code emailed to the user, on a Phase Two hosted Keycloak, driven through the Keycloak MCP server. Use this for "email OTP", "email a one-time code", "6-digit login code by email", or "passwordless login with a code instead of a link". Covers authoring the flow with importAuthenticationFlow (none ships auto-created), the load-bearing identifier-step choice that decides whether the realm leaks which addresses have accounts, setSmtpSettings, and setBruteF...ai-agentsrustgoVotes: 0GitHub stars: 4
EmailOtpLoginRestATurn on passwordless login by a one-time code emailed to the user, on a self-managed Keycloak running the p2-inc keycloak-magic-link extension, using the Admin REST API only (no MCP server). Use this for "email OTP", "email a one-time code", "6-digit login code by email", or "passwordless login with a code instead of a link". Covers authoring the flow (none ships auto-created), the load-bearing identifier-step choice that decides whether the realm leaks which addresses have accounts, realm SM...ai-agentsrustgoVotes: 0GitHub stars: 4
IdpFederationLoginMcpABroker a partner company's own OIDC identity provider into a Phase Two hosted Keycloak realm as a plain "log in with <partner>" button - driven through the Keycloak MCP server. Use this whenever someone asks to "let our partner's staff log in with their own account", "add a login-with-X button", "federate a partner's identity provider", or "broker an external OIDC provider" - with NO organization membership requirement and NO domain-based auto-routing attached. Covers createOidcIdp, mapping c...ai-agentsrustapiVotes: 0GitHub stars: 4
IdpFederationLoginRestABroker a partner company's own OIDC identity provider into a self-managed Keycloak realm as a plain "log in with <partner>" button, using the Admin REST API only (no MCP server involved). Use this whenever someone asks to "let our partner's staff log in with their own account", "add a login-with-X button", "federate a partner's identity provider", or "broker an external OIDC provider" - with NO organization membership requirement and NO domain-based auto-routing attached. Covers POST identity...ai-agentspythonrustVotes: 0GitHub stars: 4
IdpInitiatedSsoMcpAWire IdP-initiated SSO ("portal tiles") from an already-federated SAML identity provider such as Okta or Microsoft Entra ID into ONE specific Keycloak client, when the Keycloak MCP server is available. Use this whenever someone asks for an Okta dashboard tile or an Entra "My Apps" tile that drops the user straight inside a particular application already logged in, for an app-embed link, or for "IdP-initiated SSO" / "unsolicited SAML response" into a named client. Covers which MCP tools help (...ai-agentsrustgoVotes: 0GitHub stars: 4
IdpInitiatedSsoRestAWire IdP-initiated SSO ("portal tiles") from an already-federated SAML identity provider such as Okta or Microsoft Entra ID into ONE specific Keycloak client, using the Admin REST API only (no MCP server involved). Use this whenever someone asks for an Okta dashboard tile or an Entra "My Apps" tile that drops the user straight inside a particular application already logged in, for an app-embed link, or for "IdP-initiated SSO" / "unsolicited SAML response" into a named client. Covers the broke...ai-agentsrustgoVotes: 0GitHub stars: 4
IdentityProviderOrgRestrictLoginMcpARestrict FEDERATED (external identity provider) login to members of one organization on a Phase Two hosted Keycloak - the user authenticates at their own company's IdP and only gets in when they belong to the organization the application named in account_hint - driven through the Keycloak MCP server. Use this whenever someone asks for "corporate organization restriction", "restrict SSO login to a team/tenant", "only let this customer's staff into their own org", "organization-restricted corpo...ai-agentsrustgitVotes: 0GitHub stars: 4
IdentityProviderOrgRestrictLoginRestARestrict FEDERATED (external identity provider) login to members of one organization on a self-managed Keycloak - the user authenticates at their own company's IdP and only gets in when they belong to the organization the application named in account_hint - using the Admin REST API only (no MCP server involved). Use this whenever someone asks for "corporate organization restriction", "restrict SSO login to a team/tenant", "only let this customer's staff into their own org", "organization-rest...ai-agentspythonrustVotes: 0GitHub stars: 4
PasswordlessMagicLinkLoginBTurn on passwordless login by emailed link ("magic link") in Keycloak, using the real p2-inc keycloak-magic-link provider. Use this whenever someone wants "passwordless login", "log in with a magic link", "email people a login link instead of a password", or "let users sign in without a password" — even if they only say "passwordless". Covers the built-in "magic link" flow the provider auto-creates on every realm (no custom flow authoring needed, only binding it), the realm SMTP settings it d...ai-agentspythonrustVotes: 0GitHub stars: 4
PasswordlessMagicLinkLoginMcpATurn on passwordless login by emailed link ("magic link") in a Phase Two hosted Keycloak deployment, using the real p2-inc keycloak-magic-link provider — driven entirely through the Keycloak MCP server's tools rather than raw REST calls. Use this whenever someone wants "passwordless login", "log in with a magic link", "email people a login link instead of a password", or "let users sign in without a password" and the MCP server is the available integration surface — even if they only say "pas...ai-agentsrustgoVotes: 0GitHub stars: 4
MagicLinkOrgRestrictLoginMcpARestrict passwordless magic-link login so only members of a specific organization ever receive the login link, on a Phase Two hosted Keycloak, using the Keycloak MCP server. Use this whenever someone wants "magic link login restricted to org X", "passwordless login gated by organization membership", "only email the login link to people on this team", or describes a user logging in via magic link where whether they get in depends on their organization membership (as signalled by account_hint)....ai-agentsrustgoVotes: 0GitHub stars: 4
MagicLinkOrgRestrictLoginRestARestrict passwordless magic-link login so only members of a specific organization ever receive the login link, on a self-managed Keycloak running the p2-inc keycloak-orgs and keycloak-magic-link extensions, using the Admin REST API only (no MCP server involved). Use this whenever someone wants "magic link login restricted to org X", "passwordless login gated by organization membership", "only email the login link to people on this team", or describes a user logging in via magic link where whe...ai-agentsrustgoVotes: 0GitHub stars: 4
OrgRestrictLoginMcpARestrict login so only members of a specific organization can complete it, on a Phase Two hosted Keycloak, driven through the Keycloak MCP server. Use this whenever someone wants to "only let members of this org log in", "gate login by organization membership", or "restrict access to org X". Covers the p2-inc keycloak-orgs `ext-select-org` authenticator and its `match_by_org_name` setting (matching an organization by NAME vs by ID), authoring AND binding the flow in one call with `importAuthe...ai-agentsgogitVotes: 0GitHub stars: 4
OrgRestrictLoginRestARestrict login so only members of a specific organization can complete it, on a self-managed Keycloak running the p2-inc keycloak-orgs extension, using the Admin REST API only (no MCP server involved). Use this whenever someone wants to "only let members of this org log in", "gate login by organization membership", or "restrict access to org X". Covers creating the organization and adding members via the keycloak-orgs REST surface, the `ext-select-org` authenticator and its `match_by_org_name...ai-agentspythongoVotes: 0GitHub stars: 4
PasswordEmailOtpMfaMcpAHarden existing password login with a one-time code emailed as a SECOND factor, on a Phase Two hosted Keycloak, driven through the Keycloak MCP server. Use this for "2FA by email", "MFA by email", "require a code after the password", or "email-based two-factor". The password stays required and gates the code - a wrong password must never send mail. Not passwordless email OTP (a different flow that removes the password), and not WebAuthn or TOTP as a second factor.ai-agentsrustgoVotes: 0GitHub stars: 4
PasswordEmailOtpMfaRestAHarden existing password login with a one-time code emailed as a SECOND factor, on a self-managed Keycloak running the p2-inc keycloak-magic-link extension, using the Admin REST API only. Use this for "2FA by email", "MFA by email", "require a code after the password", or "email-based two-factor". The password stays required and gates the code - a wrong password must never send mail. Not passwordless email OTP (a different flow that removes the password), and not WebAuthn or TOTP as a second ...ai-agentsrustgoVotes: 0GitHub stars: 4
PasswordOrPasskeyLoginMcpAConfigure username/password OR a passkey as alternative first-factor methods on one Keycloak login page, via the Keycloak MCP server's tools. Use whenever someone wants "username and password with a passkeys option", "password or passkey", "keep passwords but add passkeys", or a login where either method alone signs the user in. Covers authoring and binding the flow with auth-username-password-form and webauthn-authenticator-passwordless as ALTERNATIVE siblings (and why a REQUIRED or conditio...ai-agentsjavascriptpythonVotes: 0GitHub stars: 4
PasswordOrPasskeyLoginRestBConfigure username/password OR a passkey as alternative first-factor methods on one Keycloak login page, via raw Admin REST. Use whenever someone wants "username and password with a passkeys option", "password or passkey", "keep passwords but add passkeys", or a login where either method alone signs the user in. Covers authoring and binding the flow with auth-username-password-form and webauthn-authenticator-passwordless as ALTERNATIVE siblings (and why a REQUIRED or conditional passkey step ...ai-agentsjavascriptpythonVotes: 0GitHub stars: 4
PasswordlessPasskeyLoginMcpATurn on PASSKEY-ONLY passwordless login (WebAuthn, no password field ever shown, no fallback) in a Phase Two hosted Keycloak deployment — driven through the Keycloak MCP server's tools where they exist, with the one genuine gap (Keycloak ships no built-in "passkey only" flow the way it ships a built-in magic-link flow) covered by a documented REST recipe. Use this whenever someone wants "passkey login", "no more passwords", "sign in with a passkey/security key/Face ID/Touch ID and nothing els...ai-agentsjavascriptgoVotes: 0GitHub stars: 4
PasswordlessPasskeyLoginRestATurn on PASSKEY-ONLY passwordless login (WebAuthn, no password field ever shown, no fallback) in a self-managed Keycloak deployment — driven entirely through the Admin REST API (no MCP server involved). Use this whenever someone wants "passkey login", "no more passwords", "sign in with a passkey/security key/Face ID/Touch ID and nothing else", or "remove password login entirely in favor of WebAuthn" — even if they only say "passkeys" or "passwordless with WebAuthn". Covers the realm's WebAuth...ai-agentsjavascriptrustVotes: 0GitHub stars: 4
SocialLoginMcpAAdd a built-in "Sign in with GitHub" (or Google/Microsoft/Facebook/...) social identity provider to a Phase Two hosted Keycloak realm, driven entirely through the Keycloak MCP server's tools. Use this whenever someone wants a plain consumer social login button - not a company's own enterprise IdP (that is admin:idp-federation). Covers createSocialIdp, why GitHub's own claim shape (login/name) is NOT the OIDC-standard shape (preferred_username/given_name/family_name), and why the generic OIDC ...ai-agentsrustgoVotes: 0GitHub stars: 4
SocialLoginRestBAdd a built-in "Sign in with GitHub" (or Google/Microsoft/Facebook/...) social identity provider to a Keycloak realm via raw Admin REST calls. Use this whenever someone wants a plain consumer social login button - not a company's own enterprise IdP. Covers POST /identity-provider/instances with providerId=github, why GitHub's own claim shape (login/name) is NOT the OIDC-standard shape (preferred_username/given_name/family_name), and the two mapper types GitHub actually needs (oidc-username-id...ai-agentsrustgoVotes: 0GitHub stars: 4
TotpSecondFactorMcpARequire TOTP from an authenticator app as a second factor after the password, for every user, via the Keycloak MCP server's tools. Use whenever someone wants "2FA with an authenticator app", "TOTP", "Google Authenticator codes after the password", or MFA that every account must use. Covers authoring and binding a flow whose forms sub-flow makes auth-username-password-form and auth-otp-form both REQUIRED (and why the stock browser flow's conditional OTP lets users without an authenticator in),...ai-agentsgogitVotes: 0GitHub stars: 4
TotpSecondFactorRestARequire TOTP from an authenticator app as a second factor after the password, for every user, via raw Admin REST. Use whenever someone wants "2FA with an authenticator app", "TOTP", "Google Authenticator codes after the password", or MFA that every account must use. Covers authoring and binding a flow whose forms sub-flow makes auth-username-password-form and auth-otp-form both REQUIRED (and why the stock browser flow's conditional OTP lets users without an authenticator in), the realm OTP po...ai-agentspythongoVotes: 0GitHub stars: 4
ZeroPasswordLoginMcpAConfigure a "0 password required login flow" in Keycloak — one browser flow offering BOTH a passkey (WebAuthn passwordless) and a magic link as alternatives, with no password authenticator anywhere in it. Use whenever someone wants "zero password login", "0 password required", "passkeys or magic link", "passwordless with a fallback that isn't a password", or a passwordless login that a brand-new credential-less user can still complete. Covers authoring and binding the flow (including why exec...ai-agentsjavascriptgoVotes: 0GitHub stars: 4
ZeroPasswordLoginRestBConfigure a "0 password required login flow" in Keycloak — one browser flow offering BOTH a passkey (WebAuthn passwordless) and a magic link as alternatives, with no password authenticator anywhere in it. Use whenever someone wants "zero password login", "0 password required", "passkeys or magic link", "passwordless with a fallback that isn't a password", or a passwordless login that a brand-new credential-less user can still complete. Covers authoring and binding the flow (including why exec...ai-agentsjavascriptpythonVotes: 0GitHub stars: 4
DocsAThis repo is an Agent Skills marketplace: `.claude-plugin/marketplace.json` lists one or more plugins, each under `plugins/<name>/`, each containing one or more skills under `plugins/<name>/skills/<skill-name>/`. Today there is one plugin (`phasetwo`) and one skill (`keycloak`) — a **router** that dispatches by intent + tooling to reference docs, rather than one skill per capability. Read this whole document before writing anything; it assumes that shape throughout.ai-agentsgojavaVotes: 0GitHub stars: 4
KeycloakAUse when doing Keycloak / Phase Two hosted Keycloak admin work. Passwordless login (magic link, email OTP, passkey WebAuthn, or passkey-or-magic-link "0 password required"); email OTP as a 2FA second factor; org-membership login restriction (password, federated, or magic-link); cluster/deployment provisioning; enrolling a credential (passkey/TOTP) onto users who already exist — and refusing cluster/deployment/realm DELETION. Also identity brokering: domain-routed corporate SSO; social login b...ai-agentsgodockerVotes: 0GitHub stars: 4
Securing AppsAUse when wiring Keycloak/OIDC login into your own app's source, or protecting an API with it. Browser login, logout and route protection for React, Angular, Vue, Next.js or a vanilla SPA (oidc-spa, keycloak-js, Auth.js); bearer-JWT validation in a Spring Boot, Express, FastAPI or Quarkus resource server (JWKS, issuer, audience); native login on Android, iOS or React Native (AppAuth, PKCE). Also registers or updates the app's OIDC client — redirect URIs, web origins, public vs confidential. Tr...developmentpythongoVotes: 0GitHub stars: 4