Repository navigation
Authorization with CIBA flow #42133
Before reporting an issue
Arealogin/ui Describe the bugI implemented CIBA flow in my app. I created a client in console, added flags in the config and methods. And it's ok. It works well and finally I get access , refresh and id tokens. But how can i use these tokens to login in keycloack account (default I tried to do it with keycloak-js but it doesn't work Is there an ability to login in keycloak account only with tokens? There is no description of it anywhere. Version26.3.3 Regression
Expected behaviorI thought, i'd add the tokens in keycloak-js .init and it works Actual behaviori added tokens in keycloak-js .init the tokens and it doesn't work. There is no information about this in docs or other sources. Is it possible? How to Reproduce?Try to login without entering login and password. Only with tokens. Anything else?No response |
Replies: 3 comments 3 replies
|
No, it's not possible with tokens. The idea of having SSO following open standards such as OIDC between apps is thanks to the Keycloak (Identity Provider) cookie. This means that the app performs an authentication redirection to the IdP, and if the IdP's cookie is valid (and you include the cookie step in the flow), a session is automatically created, which then issues tokens. You always have the option to customize Keycloak with extensions, but the standard way is through the SSO cookie. In some scenarios, usually more related to the backend / API cases, you can also use the token exchange protocol that allows a client to exchange one token for another. |
|
Thank you for the answer. I think OIDC specification doesn't have any word about cookies. I guess CIBA flow is part of OIDC. Yes, the main problem is lack of cookies in this case. But it's Keycloak's limitation, not OIDC. |
|
It’s all about the IdP’s cookie for enabling SSO. It works the same for OIDC or SAML in any IdP (Auth0, Ping, ForgeRock, Gluu, Entra, etc). Keycloak implements open standards such as OIDC, OAuth, and SAML. Therefore, the issue is not related to Keycloak. |
|
Thanks. |
|
@Fristail27 We have this problem in the Flutter app and want to open web apps logged in in the webview. Have you found the solution? |
|
I don't know about your case, but I couldn't handle mine. I had to create new profile page, with custom requests in keycloak for changing user information. |
No, it's not possible with tokens. The idea of having SSO following open standards such as OIDC between apps is thanks to the Keycloak (Identity Provider) cookie. This means that the app performs an authentication redirection to the IdP, and if the IdP's cookie is valid (and you include the cookie step in the flow), a session is automatically created, which then issues tokens.
You always have the option to customize Keycloak with extensions, but the standard way is through the SSO cookie. In some scenarios, usually more related to the backend / API cases, you can also use the token exchange protocol that allows a client to exchange one token for another.