You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Mobile app: authentication handover into the webview
#21630
There is a website (client1), mobile app (client2) and keycloak. A user opens a mobile app which sends them to keycloak for authentication. After successful authentication the mobile app becomes an offline token and the user stays logged in in the mobile app for a very long time.
Requirement: an authenticated mobile app user which opens the website (client1) in the mobile apps webview should be automatically logged in in the website, because he is already authenticated in the mobile app.
Is it possible? I would be very appreciated for pointing me to the right direction.
I have the exact same use case. The problem is that an offline session is not allowed to get a new refresh token when using token exchange.
So, I don't know what would be the way to go here!?
One way to do this: You can use your mobile app with regular sessions, and not offline sessions. Then this should work as expected.
If you still want to use offline tokens: @mkunz-it created an extension here to allow for that scenario: https://github.com/mkunz-it/keycloak-token-auth
When evaluating it, please read the warning that comes with it: OpenID Connect and Keycloak usually have a one-way-street for security reasons from the browser and its cookie, to the application. An application scoped token would in this world never allow access to a different application, or back to the user session. This extension allows exactly that, and adds some security restrictions to it to make this as safe as possible (though everyone should evaluate those trade-offs for themselves).
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi folks,
There is a website (client1), mobile app (client2) and keycloak. A user opens a mobile app which sends them to keycloak for authentication. After successful authentication the mobile app becomes an offline token and the user stays logged in in the mobile app for a very long time.
Requirement: an authenticated mobile app user which opens the website (client1) in the mobile apps webview should be automatically logged in in the website, because he is already authenticated in the mobile app.
Is it possible? I would be very appreciated for pointing me to the right direction.
Thanks in advance.
All reactions
Replies: 2 comments
Uh oh!
There was an error while loading. Please reload this page.
I have the exact same use case. The problem is that an offline session is not allowed to get a new refresh token when using token exchange.
So, I don't know what would be the way to go here!?
All reactions
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
One way to do this: You can use your mobile app with regular sessions, and not offline sessions. Then this should work as expected.
If you still want to use offline tokens: @mkunz-it created an extension here to allow for that scenario: https://github.com/mkunz-it/keycloak-token-auth
When evaluating it, please read the warning that comes with it: OpenID Connect and Keycloak usually have a one-way-street for security reasons from the browser and its cookie, to the application. An application scoped token would in this world never allow access to a different application, or back to the user session. This extension allows exactly that, and adds some security restrictions to it to make this as safe as possible (though everyone should evaluate those trade-offs for themselves).
All reactions