notandClaude Opus 4.8
25b593ec3e
CI / frontend (pull_request) Successful in 2m37s
CI / lint (pull_request) Successful in 1m17s
CI / build (pull_request) Successful in 59s
CI / unit (pull_request) Successful in 1m13s
CI / mutation (pull_request) Successful in 5m50s
CI / verify-stack (pull_request) Successful in 11m50s
Resume-on-load (S-26) restores any open registration for the logged-in bsn, so on the shared verify stack the specs can no longer share jan-burger: verify-domain submits as jan-burger (123456782) before the e2e, and that open registration was being resumed on login. Each self-service spec now uses its own citizen — registration→emma-burger, resume→sanne-burger, withdrawal→lars-burger — none touched by the verify-* checks or each other. jan-burger stays the documented citizen for the API-level verify checks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Synthetic data
All credentials here are dev-only synthetic test data — never real personal data, never used outside local development.
Keycloak realms (S-02)
Keycloak runs at http://localhost:8180 (admin console: admin / admin). Four realms
are imported at boot from infra/keycloak/realms/. Each has a public OIDC client
big-portal (standard flow + direct access grants enabled, redirect URIs * for dev).
All test users share the password test123.
| Realm | Mimics | User | Identifying claim |
|---|---|---|---|
digid |
DigiD (burgers) | jan-burger |
bsn = 123456782 |
digid |
DigiD (burgers) | sanne-burger |
bsn = 231477813 (S-26 resume e2e — its own user so it can leave an open registration) |
eherkenning |
eHerkenning (bedrijven) | acme-ondernemer |
kvk = 12345678 |
eidas |
eIDAS (EU) | pierre-dupont |
eidas_id = FR/NL/AB-1234-5678 |
medewerker |
Internal staff | merel-behandelaar |
role behandelaar |
medewerker |
Internal staff | tom-teamlead |
roles behandelaar, teamlead |
The identifying claims are injected via OIDC protocol mappers on big-portal
(user-attribute → token claim); medewerker roles appear in realm_access.roles.
Get a token (for testing)
curl -s -X POST \
http://localhost:8180/realms/digid/protocol/openid-connect/token \
-d grant_type=password -d client_id=big-portal \
-d username=jan-burger -d password=test123 -d scope=openid | jq -r .access_token
Decode the JWT payload to see the bsn claim. make keycloak-smoke checks every realm
automatically.