Generate ID Token from access token to allow for in browser IDP linking 19.0.3 #16285

ynfle · 2023-01-06T05:40:57Z

ynfle
Jan 6, 2023

I am looking for a way to allow a user to link an IDP to a preexisting Keycloak account from an app.
The app is logged in with an access token to a 3rd party app that uses our Keycloak for SSO. We want the user to be able to click on a button from within the app and be redirected to the browser to authorize the IDP linking to their account on our Keycloak. The user should not have to log in on the browser as they are already logged in on the app.
Keycloak already provides an endpoint (realms/{realm}/broker/{provider}/link as outlined here https://www.keycloak.org/docs/latest/server_development/#client-initiated-account-linking) to link a user to an IDP if they are already logged in to the browser with OIDC (judging from the source code, this means there is a cookie with the name KEYCLOAK_IDENTITY with a value which is JWT with typ Serialized-ID.
The token that is held by the application has typ Bearer and therefore can't just simply be placed in the cookies of the browser to make it appear as if the user is logged in with OIDC.
The solution that we came up with, was to have a custom endpoint on Keycloak to be able to generate an ID token which is placed in the cookies based on the user's session and information in the access token which is passed in as a query param and then redirect to the Keycloak provided IDP linking endpoint.
The issue comes that after the linking is performed the access token has to be refreshed as the information will be out of date (we provide the IDP username and id in the access token) but if that session has used a refreshed token to refresh and this is the second time (at least) that the app has refreshed (perhaps linking to 2 IDPs in one session) an error is returned upon refreshing with the message stale token. This error is triggered from this line. This issue only arises after the first refresh of the session because during the first refresh of the session clientSession.getRefreshToken() is null, while during the second refresh (after the IDP linking) the aforementioned value isn't null get the refresh token passed in has a different ID as the aforementioned refresh token gotten from the client session and the refresh token that was passed in by the client was issued from clientSession.getTimeStamp().

The code that we use to generate the ID token from the access token is

final RealmModel realm = keycloakSession.getContext().getRealm();
final UriInfo uriInfo = keycloakSession.getContext().getUri();
final ClientConnection clientConnection = keycloakSession.getContext().getConnection();

final UserModel user = keycloakSession.users().getUserById(token.getSubject(), realm);

final UserSessionModel userSession = keycloakSession.sessions().getUserSession(token.getSessionState(), realm);

AuthenticationManager.createLoginCookie(keycloakSession, realm, user, userSession, uriInfo, clientConnection);

gotten from this StackOverflow answer.

Solutions that perhaps may work:

Generating a new user session on our custom endpoint for the ID token (not ideal, because a user session will be created whenever an IDP linking flow is initiated)
Force the user to either login on the browser or login again on the app after linking to an IDP (not ideal)

Any an all suggestions are very much appreciated. There is likely something that we are doing wrong when generating the ID token

Navigation Menu

Repository navigation

Generate ID Token from access token to allow for in browser IDP linking 19.0.3 #16285

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Generate ID Token from access token to allow for in browser IDP linking 19.0.3 #16285

Uh oh!

Uh oh!

ynfle Jan 6, 2023

Replies: 0 comments

ynfle
Jan 6, 2023