Mobile app: authentication handover into the webview #21630

speechkey · 2023-07-12T10:55:46Z

speechkey
Jul 12, 2023

Hi folks,

There is a website (client1), mobile app (client2) and keycloak. A user opens a mobile app which sends them to keycloak for authentication. After successful authentication the mobile app becomes an offline token and the user stays logged in in the mobile app for a very long time.

Requirement: an authenticated mobile app user which opens the website (client1) in the mobile apps webview should be automatically logged in in the website, because he is already authenticated in the mobile app.

Is it possible? I would be very appreciated for pointing me to the right direction.

Thanks in advance.

WieFel · 2026-06-23T16:21:41Z

WieFel
Jun 23, 2026

I have the exact same use case. The problem is that an offline session is not allowed to get a new refresh token when using token exchange.
So, I don't know what would be the way to go here!?

0 replies

ahus1 · 2026-06-29T17:37:20Z

ahus1
Jun 29, 2026
Collaborator

One way to do this: You can use your mobile app with regular sessions, and not offline sessions. Then this should work as expected.

If you still want to use offline tokens: @mkunz-it created an extension here to allow for that scenario: https://github.com/mkunz-it/keycloak-token-auth
When evaluating it, please read the warning that comes with it: OpenID Connect and Keycloak usually have a one-way-street for security reasons from the browser and its cookie, to the application. An application scoped token would in this world never allow access to a different application, or back to the user session. This extension allows exactly that, and adds some security restrictions to it to make this as safe as possible (though everyone should evaluate those trade-offs for themselves).

0 replies

Navigation Menu

Repository navigation

Mobile app: authentication handover into the webview #21630

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Mobile app: authentication handover into the webview #21630

Uh oh!

Uh oh!

speechkey Jul 12, 2023

Replies: 2 comments

Uh oh!

WieFel Jun 23, 2026

Uh oh!

Uh oh!

ahus1 Jun 29, 2026 Collaborator

speechkey
Jul 12, 2023

WieFel
Jun 23, 2026

ahus1
Jun 29, 2026
Collaborator