Repository navigation
Replies: 1 comment
|
If the authorization server is from a different organization/domain than the resource server then those endpoints should be public. On the other hand, nothing prevent you from keeping those endpoints behind a secured firewall if only your backend call those endpoints. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
When get
https://keycloak:8443/realms/staff/.well-known/uma2-configuration, the values forresource_registration_endpoint,permission_endpointandpolicy_endpointhave the public URL.I see that the URLs are built in
UmaConfiguration.javawithUriBuilder uriBuilder = session.getContext().getUri().getBaseUriBuilder();.My undertstanding is that is explicitly requesting frontend URLs for these values.
My expectation is that these endpoints should be accessed locally if possible in most situations if we've retrieved the config locally.
In many cases it would make sense to restrict access to these endpoints if that is practical. Also it would make sense to resolve locally for smaller environments to reduce latency and network usage.
That is what I would expect, but given that the code is explicitly requesting frontend URLs I figured there's a reason for it?
All reactions