Repository navigation
Grafana integrating keycloak, is it possible to skip login page completely? #19049
Replies: 1 comment 8 replies
|
The first answer for the stackoverflow question appears to be pretty pertinent. If you trust Application1 enough, you could create a client inside keycloak that has the Direct Access Grant (aka resource owner password flow) enabled, which entrusts the application with the user's username and password. The application can authenticate the user normally and then simply send a POST request as described in the answer, that then creates the user's session in Keycloak. However, a significant issue is that even if you can achieve this, it is likely impossible to not redirect the user through the Keycloak login page - or at least perform the authentication steps (POST request) inside the browser. This is because Keycloak must have something to authenticate the user when subsequent requests arrive. If you look at the default browser flows, that something is either username and password (for interactive logins) or something like a cookie that must be saved in the browser. You could probably also use Kerberos, but that is likely out of scope. The reason single sign-on platforms were created is because cookies (and thus user sessions) can only be accessed on the domain that they were created on. Since |
|
Does the javascript library that you use to send the POST request not also provide cookie access for the request? I would expect it to have the possibility to save cookies in a jar, that you can use later, and then you could simply save the cookies Keycloak had sent. |
|
yes. I have full access reading and writing the cookie. To which endpoint should I send the POST request? Right now I am sending to |
|
Ah, your issue is that the token endpoint does not generate a cookie... That makes it quite a bit more difficult. You will probably have to perform a full authentication using the implicit flow (the more secure "code" flow may also work). This basically means that you would have to emulate the browser going to the regular login page, parse the This is something you need to experiment with, since I have not done this (like this) before - I have done something similar for load testing, but a proper third party client was configured, and I simply had to fetch the responses from it and Keycloak and go follow the redirects. The only manual step was fetching the login form's |
|
Thank you for the reply. Really appreciated it. I just manually parsed it with my eye. Is it something like the following? Also I am just a bit surprised and confused now why for sso from keycloak to trust "I have logged in somewhere else", which I understand is a very strong statement, the user has to explicitly login via the keycloak frontend? Why login through api is not considered a reasonable way to login? |
|
That URL appears to have the correct format. I think that you could probably send an authentication request to it using a POST that contains the username and password, and the server should return an error or valid code / user token. For the last part, the |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I am asking almost the same question as described here https://stackoverflow.com/questions/48220504/login-to-keycloak-using-api
Only that application2 is grafana. I want to login to application1 without keycloak and call some API of keycloak behind the scene so that when user goes to grafana, he/she doesn't need to go through any login page again. Would that be possible?
PS. Application1 is our legacy application and we decide to not develop anymore on the legacy backend.
All reactions