Repository navigation
Replies: 2 comments 2 replies
|
For anyone finding this question we ended up storing the "bankid" state in the actionTokens cache. This seems to work as expected but it feels like there should be a better solution. |
|
The best place to store the server-side state depends on your case. For browser-based flows, the authentication session should be more appropriate. However, the flow you described reads very similar to OAuth2 Device Grant. I mean, although your implementation is very specific to a use case, we are using a similar implementation for this grant type. |
|
Thanks for your reply. I agree with you and my first attempt was also to use the authentication session. However I banged my head into this and I was unable to get the same authentication session during the poll requests the browser does while waiting for the BankID interaction to finish. As I described in the original post I can initially get the authentication session by using the "state" query parameter. I can then store the information I need to keep in the authentication session. However at any subsequent request using the same state value I get an exception when trying to look up the authentication session. So the problem I have is finding the authentication session :-/ |
|
The authentication session should expire accordingly to your realm settings. Perhaps during the polling, the session expires and is no longer available? The authentication session is also destroyed once the authentication finishes and a user session is created. Not sure if that might be happening too. |
Uh oh!
There was an error while loading. Please reload this page.
We are updating the BankID "idp provider" for keycloak to work with Keycloak 20.x (21.x support is blocked by /issues/15344)
Since BankID implements it's own authentication protocol we need to store some state on the Keycloak server before the user is fully authenticated. Previously, in Wildfly, we could inject a javax.servlet.HttpRequest and store the state using javax.servelet session, see the master-19.x branch. However this does not seem to be an option in the newer Quarkus/Vert.x based server. If it is please give me a hint on how to achieve this :-)
I've tried to use the authenticationSessions however from my tests it seems that it might be to early for this session to exist. I most admit I do not fully understand the mechanics around this session. I can, using the "state" query parameter, get a authenticationSessions in the first callback. But even if I then set that session on the KeycloackSessions context I still get a
nullwhen trying to get the authenticationSessions from the KeycloakContext in subsequent calls, before callingcallback.authenticated(...).Any hints on how to store state on the server side before the user has authenticated ?
TLDR Some more info about the BankID authentication protocol
In the BankID authentication protocol keycloak will initiate an authentication request with BankID server and get back a orderref and a autostarttoken.
The orderref should be kept on the server side and is used to poll the BankID server for status of the login, when the login has completed successfully information about the user is returned to the server.
The autostarttoken is presented to the end user, either in a QR code or in a special "bankid://" url.
The end user starts a external "BankID application" and authenticates with the BankID server using the autostarttoken.
During this out-of-band login sequence the webpage presented by keycloak will poll keycloak for updated information and then finally login the user once the authentication with the BankID application is complete.
For more complete information about BankID see their guide. https://www.bankid.com/utvecklare/guider
All reactions