Repository navigation
Extensions for verification_uri of Device Authorization Request #15004
Replies: 2 comments 4 replies
|
The client application could also shorten the URI on their own by replacing {server_url}/realms/{realmname}/device with {shortener_service_url/device. Regarding the QR code idea: isn't a QR code meant to be created by the client on their own? Do you suggest Keycloak should have a resource which provides a QR code for "verification_uri_complete", so that the client depends on this service instead of a library? |
|
How can client redirect {server_url}/realms/{realmname}/device? It is a Keycloak web service returned from Keycloak web service and need to copy paste on browser. |
|
The device gets an authorization response with the URI to be displayed. (see RFC8628, section-3.2). If the device knows how to shorten the URI it can do it and display the shortened URI instead. The user enters this shortened URI in their browser and it will be redirected to the original URI which was in the Keycloak response. User will enter the user_code on this page. Only drawback is, that the client can't just display the URI from the authorization response. It needs to shorten it before it is displayed. |
|
We have over 150 clients (most of them using device authorization) in production. It is crazy to do this in each client insted of doing it centralized in keycloak configuration. Moreover, with this no need to change json response. |
|
Thank you, I see that providing a shortened URI directly in the response can improve usability without changing client software. You would need a realm level setting "Device Authorization Verification URI" which is used instead of the Verification URI in the response. Using this feature then requires a redirect service running at the configured URL. |
Uh oh!
There was an error while loading. Please reload this page.
Device Authorization Response documentation is written :
Microsoft for example does something like this with {{https://microsoft.com/devicelogin }}(forwards to https://login.microsoftonline.com/common/oauth2/deviceauth).
We are thinking for being able to configure optionally per realm a shorten url for showing in verification_uri. Redirection to Keycloak verification URI ({server_url}/realms/{realmname}/device) would be done outside Keycloak - fe in a proxy. Are you interested? Do you have another idea for shorten verification_uri?
Moreover, Non-Textual Verification URI Optimization
mention:
QR codes are widely used lately. Are you interested in adding QR code? I I am not wrong Keycloak uses a Java QR library already.
This could be configuration in client ( by default verification_uri as url). QR code will be return as Byte Array and client implementation would be responsible for showing it appropriately. What is your opinion?
All reactions