Add VS Code GitHub Copilot integration docs for Keycloak OAuth

- Add "Use Keycloak OAuth MCP server with GitHub Copilot" section to README
- Add step-by-step instructions for connecting VS Code to deployed MCP server
- Include screenshots for authentication flow (allow access, sign-in, redirect)
- Add Spanish translation of the new section to spanish/README.md
- Configure VS Code redirect URIs in Keycloak realm for DCR support
- Update infra and keycloak configs for VS Code OAuth redirect handling

Author: madebygps

.vscode/mcp.json

@@ -28,8 +28,8 @@
 				"servers/basic_mcp_stdio.py"
 			]
 		},
-		"my-mcp-server-e53825c5": {
-			"url": "http://localhost:8000/mcp",
+		"my-mcp-server-60626805": {
+			"url": "https://mcproutes.whitetree-5dc0246f.eastus2.azurecontainerapps.io/mcp",
 			"type": "http"
 		}
 	},

README.md

@@ -393,6 +393,46 @@ This project supports deploying with OAuth 2.0 authentication using Keycloak as
 
    The agent automatically detects `KEYCLOAK_REALM_URL` in the environment and authenticates via DCR + client credentials. On success, it will add an expense and print the result.
 
+### Use Keycloak OAuth MCP server with GitHub Copilot
+
+The Keycloak deployment supports Dynamic Client Registration (DCR), which allows VS Code to automatically register as an OAuth client. VS Code redirect URIs are pre-configured in the Keycloak realm.
+
+To use the deployed MCP server with GitHub Copilot Chat:
+
+1. To avoid conflicts, stop the MCP servers from `mcp.json` and disable the expense MCP servers in GitHub Copilot Chat tools.
+2. Select "MCP: Add Server" from the VS Code Command Palette
+3. Select "HTTP" as the server type
+4. Enter the URL of the MCP server from `azd env get-value MCP_SERVER_URL`
+5. You should see a Keycloak authentication screen open in your browser. Select "Allow access":
+
+   ![Keycloak allow access screen](screenshots/kc-allow-1.jpg)
+
+6. Sign in with a Keycloak user (e.g., `testuser` / `testpass` for the pre-configured demo user):
+
+   ![Keycloak sign-in screen](screenshots/kc-signin-2.jpg)
+
+7. After authentication, the browser will redirect back to VS Code:
+
+   ![VS Code redirect after Keycloak sign-in](screenshots/kc-redirect-3.jpg)
+
+8. Enable the MCP server in GitHub Copilot Chat tools:
+
+   ![Select MCP tools in GitHub Copilot](screenshots/kc-select-tools-4.jpg)
+
+9. Test it with an expense tracking query:
+
+   ```text
+   Log expense for 75 dollars of office supplies on my visa last Friday
+   ```
+
+   ![Example GitHub Copilot Chat with Keycloak auth](screenshots/kc-chat-5.jpg)
+
+10. Verify the expense was added by checking the Cosmos DB `user-expenses` container in the Azure Portal or by asking GitHub Copilot Chat:
+
+    ```text
+    Show me my expenses from last week
+    ```
+
 ### Known limitations (demo trade-offs)
 
 | Item | Current | Production Recommendation | Why |

agents/agentframework_http.py

@@ -1,5 +1,3 @@
-from __future__ import annotations
-
 import asyncio
 import logging
 import os
@@ -13,24 +11,18 @@
 from rich import print
 from rich.logging import RichHandler
 
-try:
-    from keycloak_auth import get_auth_headers
-except ImportError:
-    from agents.keycloak_auth import get_auth_headers
-
 # Configure logging
 logging.basicConfig(level=logging.WARNING, format="%(message)s", datefmt="[%X]", handlers=[RichHandler()])
 logger = logging.getLogger("agentframework_mcp_http")
+logger.setLevel(logging.INFO)
 
-# Load environment variables
-load_dotenv(override=True)
-
-# Constants
+# Configure constants and client based on environment
 RUNNING_IN_PRODUCTION = os.getenv("RUNNING_IN_PRODUCTION", "false").lower() == "true"
-MCP_SERVER_URL = os.getenv("MCP_SERVER_URL", "http://localhost:8000/mcp/")
 
-# Optional: Keycloak authentication (set KEYCLOAK_REALM_URL to enable)
-KEYCLOAK_REALM_URL = os.getenv("KEYCLOAK_REALM_URL")
+if not RUNNING_IN_PRODUCTION:
+    load_dotenv(override=True)
+
+MCP_SERVER_URL = os.getenv("MCP_SERVER_URL", "http://localhost:8000/mcp/")
 
 # Configure chat client based on API_HOST
 API_HOST = os.getenv("API_HOST", "github")
@@ -61,24 +53,9 @@
 
 
 # --- Main Agent Logic ---
-
-
 async def http_mcp_example() -> None:
-    """
-    Demonstrate MCP integration with the Expenses MCP server.
-
-    If KEYCLOAK_REALM_URL is set, authenticates via OAuth (DCR + client credentials).
-    Otherwise, connects without authentication.
-    """
-    # Get auth headers if Keycloak is configured
-    headers = await get_auth_headers(KEYCLOAK_REALM_URL, client_name_prefix="agentframework")
-    if headers:
-        logger.info(f"🔐 Auth enabled - connecting to {MCP_SERVER_URL} with Bearer token")
-    else:
-        logger.info(f"📡 No auth - connecting to {MCP_SERVER_URL}")
-
     async with (
-        MCPStreamableHTTPTool(name="Expenses MCP Server", url=MCP_SERVER_URL, headers=headers) as mcp_server,
+        MCPStreamableHTTPTool(name="Expenses MCP Server", url=MCP_SERVER_URL) as mcp_server,
         ChatAgent(
             chat_client=client,
             name="Expenses Agent",
@@ -96,4 +73,4 @@ async def http_mcp_example() -> None:
 
 
 if __name__ == "__main__":
-    asyncio.run(http_mcp_example())
+    asyncio.run(http_mcp_example())

agents/keycloak_auth.py

@@ -27,6 +27,7 @@ async def register_client_via_dcr(keycloak_realm_url: str, client_name_prefix: s
 
     Args:
         keycloak_realm_url: The Keycloak realm URL (e.g., http://localhost:8080/realms/myrealm)
+        Make sure to use direct container URL, not route.
         client_name_prefix: Prefix for the generated client name
 
     Returns:

infra/http-routes.bicep

@@ -29,7 +29,7 @@ resource httpRouteConfig 'Microsoft.App/managedEnvironments/httpRouteConfigs@202
   parent: containerEnv
   properties: {
     rules: [
-      // Route /auth/* to Keycloak (strip /auth prefix since Keycloak serves at root)
+      // Route /auth/* to Keycloak (Keycloak is configured with --http-relative-path=/auth)
       // Using pathSeparatedPrefix ensures /auth doesn't match /authentication
       {
         description: 'Keycloak Authentication Server'
@@ -38,9 +38,7 @@ resource httpRouteConfig 'Microsoft.App/managedEnvironments/httpRouteConfigs@202
             match: {
               pathSeparatedPrefix: '/auth'
             }
-            action: {
-              prefixRewrite: '/'
-            }
+            action: {}
           }
         ]
         targets: [

infra/main.bicep

@@ -749,8 +749,8 @@ module server 'server.bicep' = {
     applicationInsightsConnectionString: useMonitoring ? applicationInsights!.outputs.connectionString : ''
     exists: serverExists
     // Keycloak authentication configuration (only when enabled)
-    keycloakRealmUrl: useKeycloak ? '${keycloak!.outputs.uri}/realms/${keycloakRealmName}' : ''
-    keycloakTokenIssuer: useKeycloak ? '${keycloakMcpServerBaseUrl}/realms/${keycloakRealmName}' : ''
+    keycloakRealmUrl: useKeycloak ? '${keycloak!.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
+    keycloakTokenIssuer: useKeycloak ? '${keycloakMcpServerBaseUrl}/auth/realms/${keycloakRealmName}' : ''
     keycloakMcpServerBaseUrl: useKeycloak ? keycloakMcpServerBaseUrl : ''
     keycloakMcpServerAudience: keycloakMcpServerAudience
     // Azure/Entra ID OAuth Proxy authentication configuration (only when enabled)
@@ -776,7 +776,7 @@ module agent 'agent.bicep' = {
     openAiDeploymentName: openAiDeploymentName
     openAiEndpoint: openAi.outputs.endpoint
     mcpServerUrl: useKeycloak ? 'https://mcproutes.${containerApps.outputs.defaultDomain}/mcp' : '${server.outputs.uri}/mcp'
-    keycloakRealmUrl: useKeycloak ? '${keycloak.outputs.uri}/realms/${keycloakRealmName}' : ''
+    keycloakRealmUrl: useKeycloak ? '${keycloak.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
     exists: agentExists
   }
 }
@@ -912,9 +912,10 @@ output KEYCLOAK_MCP_SERVER_BASE_URL string = useKeycloak ? keycloakMcpServerBase
 
 // Keycloak and MCP Server routing outputs (only populated when mcpAuthProvider is keycloak)
 output KEYCLOAK_REALM_URL string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/realms/${keycloakRealmName}' : ''
-output KEYCLOAK_ADMIN_CONSOLE string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/admin' : ''
+output KEYCLOAK_ADMIN_CONSOLE string = useKeycloak ? '${httpRoutes!.outputs.routeConfigUrl}/auth/admin/master/console' : ''
 output KEYCLOAK_DIRECT_URL string = keycloak.outputs.uri
-output KEYCLOAK_TOKEN_ISSUER string = useKeycloak ? '${keycloakMcpServerBaseUrl}/realms/${keycloakRealmName}' : ''
+output KEYCLOAK_TOKEN_ISSUER string = useKeycloak ? '${keycloakMcpServerBaseUrl}/auth/realms/${keycloakRealmName}' : ''
+output KEYCLOAK_AGENT_REALM_URL string = useKeycloak ? '${keycloak!.outputs.uri}/auth/realms/${keycloakRealmName}' : ''
 
 // Auth provider for env scripts
 output MCP_AUTH_PROVIDER string = mcpAuthProvider

infra/write_env.ps1

@@ -47,6 +47,7 @@ $KEYCLOAK_REALM_URL = Get-AzdValue KEYCLOAK_REALM_URL
 if ($KEYCLOAK_REALM_URL -and $KEYCLOAK_REALM_URL -ne "") {
     Add-Content -Path $ENV_FILE_PATH -Value "KEYCLOAK_REALM_URL=$KEYCLOAK_REALM_URL"
     Write-EnvIfSet KEYCLOAK_TOKEN_ISSUER
+    Write-EnvIfSet KEYCLOAK_AGENT_REALM_URL
 }
 
 # Entra proxy env vars (only if ENTRA_PROXY_AZURE_CLIENT_ID is set)

infra/write_env.sh

@@ -53,6 +53,7 @@ KEYCLOAK_REALM_URL=$(get_azd_value KEYCLOAK_REALM_URL)
 if [ -n "$KEYCLOAK_REALM_URL" ]; then
   echo "KEYCLOAK_REALM_URL=${KEYCLOAK_REALM_URL}" >> "$ENV_FILE_PATH"
   write_env_if_set KEYCLOAK_TOKEN_ISSUER
+  write_env_if_set KEYCLOAK_AGENT_REALM_URL
 fi
 
 # Entra proxy env vars (only if ENTRA_PROXY_AZURE_CLIENT_ID is set)

keycloak/Dockerfile

@@ -22,5 +22,6 @@ ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
 # Start in dev mode with H2 database (still uses pre-built themes)
 # --proxy-headers=xforwarded tells Keycloak it's behind a reverse proxy that sets X-Forwarded-* headers
 # --hostname-strict=false allows dynamic hostname resolution from proxy headers
+# --http-relative-path=/auth sets the base path so Keycloak serves all content under /auth/*
 # --import-realm imports the MCP realm on startup
-CMD ["start-dev", "--http-port=8080", "--proxy-headers=xforwarded", "--hostname-strict=false", "--import-realm"]
+CMD ["start-dev", "--http-port=8080", "--proxy-headers=xforwarded", "--hostname-strict=false", "--http-relative-path=/auth", "--import-realm"]

keycloak/realm.json

@@ -60,14 +60,14 @@
           "host-sending-registration-request-must-match": ["false"],
           "client-uris-must-match": ["true"],
           "trusted-hosts": [
-            "localhost",
-            "127.0.0.1",
-            "172.17.0.1",
-            "host.docker.internal",
-            "vscode.dev",
-            "insiders.vscode.dev",
-            "code.visualstudio.com"
-          ]
+  "localhost",
+  "127.0.0.1",
+  "172.17.0.1",
+  "host.docker.internal",
+  "vscode.dev",
+  "insiders.vscode.dev",
+  "code.visualstudio.com"
+]
         }
       },
       {