<![CDATA[Regional government digital services face critical challenges in centralized identity management, including authentication inefficiency across multiple devices, lack of institutionally branded interfaces, and the absence of a self-service account management dashboard for civil servants. This study develops PemdaSSO, a Keycloak-based Single Sign-On system, by integrating a password less QR Code authentication feature via a custom Service Provider Interface extension, combined with the OpenID Connect Authorization Code Flow protocol secured with Proof Key for Code Exchange on a React JS Single Page Application dashboard, deployed at the Department of Communication and Information Technology of the Special Region of Yogyakarta. Methods: The system employs a three-tier architecture deployed via Docker Compose, comprising Keycloak as the Identity Provider, React JS as the Single Page Application frontend, Node.js as the backend API, PostgreSQL as the database, and MinIO as object storage. Black Box Testing was conducted on 59 test scenarios across 11 functional categories in accordance with ISO/IEC 25010 functional suitability criteria. The testing yielded a 100% pass rate. The implemented single-use token mechanism with a 30-second expiration directly mitigates the Reusable QrId and Unbound SessionId vulnerabilities identified in prior literature, while Proof Key for Code Exchange protects the Single Page Application from authorization code interception attacks. Compared to national-scale e-government Single Sign-On implementations relying on physical X.509 certificates, this approach is lighter, hardware-independent, and better suited to the mobility requirements of regional government personnel, thereby addressing a gap in the literature on modern Single Sign-On security implementation at the local government level.]]>
Copyrights © 2026
