Universitatea (demo)

Secretariat

The student registry. It is the source of truth for who is a student; Keycloak only receives a copy of what it needs for login and tokens.

Log in with Keycloak

Staff: secretara. Students: use the invitation email (see Mailpit).

Registers users in the IdP

Creating a student here calls the Keycloak Admin REST API as the Secretariat's service account. The Keycloak admin console is just another client of the same API.

Invites, doesn't trust self-registration

Names and student IDs come from the registry and are read-only for students. The emailed link proves the student controls the address on record; then they set a password and an authenticator app.

Answers Biblioteca

GET /api/students/{id}/enrollment returns the current status, for callers holding a token with audience secretariat-api and role enrollment.read.