Successfully migrated the login to my Forgejo Git-Forge from an outdated installation of Authentik to a containerized Keycloak 26 with Passkey (WebAuthN) authentication 🥳
Getting the users from my FreeIPA LDAP via a secured Wireguard tunnel that only allows port 636 to the IPA replica server in my DMZ.
Works like a charm. Once the handful of users on my instance have linked their new Keycloak identity with their Forgejo account, I can disable the old OIDC with Authentik 🙂







