feat(keycloak): redirect to keycloak instance depending on hostname

[billhimmelsbach]

We're taking Kenneth's good work, making it work for more domains, and trying to get it into master so it doesn't have to get deployed separately.

Changes

• redirects to the correct keycloak instance for a given hostname (see the logic diagrams on the enterprise wiki for Keycloak Redirect Logic as of October 8th 2025)

• changes checkLoginIframe to false due to CORS issues now related to trying to access an iframe from another domain...
  

  ... and probably future problems with it as cookies get more locked down based on some of my digging through keycloak docs and issues. Take a look at issue 23872 on the keycloak repo (avoiding a direct link to the issue so we're not linked into it) for more info on browser incompatibilities.

  There are some downsides to not having it, particularly if someone logs off in another tab then it might not auto-detect the log out. Having said that, Kenneth's PR that implements it has been on hmda beta side for almost a year without complaints. I still made an issue to follow up and investigate re-enabling it or ameliorating any issues, if we feel like we need to down the line.

Testing

1. Does it work on all the environments?

Local

Dev

Dev Beta

Prod Beta

Prod

(will wait till release)

Alto environments

(will need to wait to see on those)

Notes

• Although we're moving Kenneth's PR into master, I don't need to replicate update prod-beta-config.json like Kenneth did, because those changes were already merged into master earlier.

[contolini]

Yaaaas it enters main