A self-hosted, multi-tenant identity platform — Flutter + NestJS + Keycloak — demonstrating OIDC with PKCE, per-realm JWT validation, SAML federation and role-based access, end to end. Below is a 2:15 walkthrough of the architecture.
Four moving parts do the interesting work — password-safe login, multi-tenant token validation, enterprise federation, and near-zero-config tenant onboarding.
Sign-in generates a random verifier and its SHA-256 challenge, redirects the browser straight to Keycloak, then swaps a one-time code plus the original verifier for tokens. Web uses a hand-rolled flow (pkce_service_web.dart); mobile uses flutter_appauth. Tokens land in flutter_secure_storage — Keystore / Keychain.
The NestJS guard decodes the token's issuer, parses the realm, checks it against a KEYCLOAK_REALMS allowlist, then verifies RS256 + expiry with a JwksClient cached per realm. RolesGuard authorizes on the union of realm-level and client-level roles — raw passport-jwt + jwks-rsa, no Keycloak adapter.
tenant-b brokers to a simulated enterprise SAML IdP (ADFS/Okta-style). On first login, broker mappers create or link the user in tenant-b and assign the viewer role. Flutter and the API never know SAML was involved — they only ever see a standard Keycloak JWT.
A tenant is a fully isolated realm. Copy a realm JSON, add its name to KEYCLOAK_REALMS and the Flutter tenant switcher, restart the stack — no code changes. Tokens are realm-scoped: a tenant-a token is rejected by tenant-b.
The choices that make the platform production-shaped rather than a toy demo.