[keycloak-user] Authentication from embedded webpage

[Marek Posolda]

Do you have the "control" under the application? Is it possible to 
propagate security contexts from application to embedded IE or viceversa?

In theory what can work is either:
- You will skip step1 and don't popup username/password box. Instead you 
will just authenticate in step2 inside IE and then propagate the context 
( token ) to step1. This is possible just if application is able to 
access the javascript state from embedded IE.

- If you can propagate just from desktop to IE, then in step1 you wwill 
configure your application to send the request for username/password 
authentication to Keycloak via direct access grant (instead of sending 
username+password directly to AD/LDAP). Once you receive token from 
direct access grant, you can use it inside IE in step2 ( keycloak.js has 
possibility to be initialized with token. You just need to pass the 
token and refreshToken as arguments to keycloak.init . Then keycloak.js 
won't redirect you to login screen )

Marek

On 06/04/16 11:24, Subhrajyoti Moitra wrote:
> Hello Team,
>
> I have a standalone windows desktop application, that authenticates 
> against an AD/LDAP server. The application popups a username/password 
> box, and submits it to the LDAP for authentication.
> The same AD/LDAP server is also synced with a Keycloak installation.
>
> The windows application embeds the IE browser control and shows a jsp 
> page.
> This jsp page is protected using keycloak js adapter. Obviously the 
> user is re-directed to the keycloak login page. So the user has to 
> login twice, once using the application popup and other in the 
> embedded jsp, after getting redirected to the keycloak login page.
>
> I dont want to re-prompt the user for relogin, since he has already 
> authenticated against the AD server.
> Is there a way to not re-prompt the user, when the embedded IE 
> requests the secure JSP?
>
> Please help, as we are not able to come up with a solution for the same.
> Any pointers how we can avoid the 2nd authentication.
>
> Thanks,
> Subhro.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160406/a270005c/attachment.html