<div dir="ltr">This is just going to be your first headache trying to reproduce everything Keycloak does in a native Android UI. I'd highly recommend you use a webview with a custom theme instead.<div><br></div><div>Examples of flows that you are not going to be able to do:</div><div><br></div><div>* OTP</div><div>* Required actions</div><div>* Registration</div><div>* Social logins</div><div>* Recover password</div><div>* ...</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 11 December 2015 at 05:11, Fabricio Milone <span dir="ltr"><<a href="mailto:fabricio.milone@shinetech.com" target="_blank">fabricio.milone@shinetech.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<p><span></span>Hi all,</p>
<p><span>I’ve been working on adding custom endpoints under the realm level to perform some new functions like user registration and send password reset email without going through the keycloak’s default web view. I’ve read the discussion regarding add custom REST paths, but I wouldn’t like to go off topic there. </span></p>
<p><span>Why I am doing this? </span></p>
<p><span>This is needed because I have to hit the keycloak server directly from the native Android UI, without going through the Keycloak default login/reset creds screen and get an user registered or an email to reset the password (among other possible future use cases).</span></p>
<p><span>What I got so far?</span></p>
<p><span>I’ve added a custom endpoint class (ForgotPasswordEndpoint) to org.keycloak.protocol.oidc.endpoints package in order to add a new path /auth/realms/{realm}/forgotten-password-email that sends an email to the specified user in a form attribute without going through the web view. I am also generating a key to be able to execute a client session required action of UPDATE_PASSWORD, so when the user clicks the link it will be asked to update its password.</span></p>
<p><span></span><br></p>
<p><span>What I’m not sure is about the approach I used to get this done. Let’s clear that up:</span></p>
<ul>
<li><span>Created a new endpoint class similar to TokenEndpoint.java which sends an email with a link to update the user password.</span></li>
<li><span>The link is generated using the UriBuilder for the base path and the ClientSessionCode class for the access code, using the given realm, session and any other necessary data.</span></li>
<li><span>I am adding a required action to the clientSession (ClientSessionModel, created with the given UserModel) of the type UserModel.RequiredAction.UPDATE_PASSWORD.</span></li>
<li><span>Once the user clicks on the link, the normal updated account starts, without any modification.</span></li></ul>
<p><span>That’s the less invasive way I’ve found so far. However, today I have been trying to implement an SPI to achieve this (still trying to understand how to do that)</span></p>
<p><span>Is there a clean/proper way to generate a valid code/execution id as it is generated on the normal forgotten password email?</span></p>
<p><span>What is the right way to make a direct call to get a reset password email?</span></p><p><span><br></span></p><p><span>Thank you in advance.</span></p>
<p>Regards,</p><p>Fabricio</p></div>
<br>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>