Repository navigation
Replies: 2 comments 9 replies
|
Hey @mshanah by any chance did you find to accomplish this? I'm about to dive into the code/docs but it is cheaper to ask :bad poker face: |
|
@jossemarGT am sorry i cant find a way to do it till now, please if you find any way to help please |
|
No worries @mshanah . I found the "Authentication SPI" section[0] in the documentation and this custom authentication SPI example[1]. So, I think those resources can come handy to implement what we both need. I cannot promise anything but if I manage to create something in my spare time, I'll surely let you know. Happy hacking! [0] https://www.keycloak.org/docs/latest/server_development/#_auth_spi |
|
i can help i create some spi but i could not no which one to use , if you can check which one we should use that will execute after successfully authenticated . |
|
Hmm... This example class[0] might be what you are looking for. However, I still don't have a good understanding on what other Classes must be implemented to fulfill to get a minimal SPI, neither how to compile them. In other words. I still think the example+docs is a better guide than me, since there's plenty experimentation rounds on my end. |
|
Hi, i have faced with such problem. @Override
public AccessToken transformAccessToken(
AccessToken token,
ProtocolMapperModel mappingModel,
KeycloakSession keycloakSession,
UserSessionModel userSession,
ClientSessionContext clientSessionCtx) {
// 1. Do http request to your legacy application
// 2. Extract cookies from response
// 3. Attach those cookies to keycloak response
HttpResponse originalResponse = ResteasyProviderFactory.getInstance().getContextData(HttpResponse.class);
originalResponse.addNewCookie(new NewCookie(
"YOUR COOKIE KEY",
"YOUR COOKIE VALUE",
"/",
null,
null,
NewCookie.DEFAULT_MAX_AGE,
false,
true));
setClaim(token, mappingModel, userSession, keycloakSession, clientSessionCtx);
return token;
} |
|
Hey! That's good to know, thanks for sharing @vplemyannik ! |
|
Another workaround is - implement your own Authenticator. It more suitable place for these changes because you want only attach cookies, but OIDC mapper is more about token transformation rather than http modification. public class CustomAuthenticator extends UsernamePasswordForm {
@Override
public void authenticate(AuthenticationFlowContext context) {
// 1. Do http request to your legacy application
// 2. Extract cookies from response
// 3. Attach those cookies to keycloak response
HttpResponse originalResponse = ResteasyProviderFactory.getInstance().getContextData(HttpResponse.class);
originalResponse.addNewCookie(new NewCookie(
"YOUR COOKIE KEY",
"YOUR COOKIE VALUE",
"/",
null,
null,
NewCookie.DEFAULT_MAX_AGE,
false,
true));
super.authenticate(context);
}
} |
|
i build Authenticator and added the custom cookie there, but if i have flow where after authentication i have OTP then the cookie will be set even when the OTP is not yet completed. |
|
@mshanah as i remember there is sorting for flow. I mean you can put your authenticator in the bottom of the flow list. In this way your authenticator will be executed only if all previous flows are finished successfully If you don't want to configure auth flow i suggest to your implement cookies attachment through OIDC mapper, because it will be automatically invoked for all flows and only when all auth actions have passed successfully |
|
yes , thanks. |
Uh oh!
There was an error while loading. Please reload this page.
we have legacy Application that authenticate by validating specific cookie to table storing all the cookies with there expired time , how can i achieve same using keycloak? can i write custom code so after the user successfully logged in i set this cookie when the keycloak send the redirect URL?
All reactions