<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">This is possible. If you select "Store
tokens" flag for Google identity provider in keycloak admin
console, the Google access token will be stored in Keycloak
database (in your step 5).<br>
<br>
Then you can send request from your application to special
Keycloak REST endpoint, which will return you Google access token
and you can use it in your application. You need to secure this
REST request with the Keycloak access token returned to your app.
We even have the example for that, but it's not part of the
example distribution. See:
<a class="moz-txt-link-freetext" href="https://github.com/keycloak/keycloak/tree/master/examples/broker/google-authentication">https://github.com/keycloak/keycloak/tree/master/examples/broker/google-authentication</a><br>
<br>
There is also some docs for that:
<a class="moz-txt-link-freetext" href="http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#d4e2177">http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#d4e2177</a><br>
<br>
Marek<br>
<br>
On 25/01/16 20:40, Reed Lewis wrote:<br>
</div>
<blockquote
cite="mid:74FA1AA4-E928-4DF8-864B-4CEA0E081252@carbonite.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>First: Thanks for a great well designed solution. Keycloak
looks like is going to do exactly what we need. </div>
<div><br>
</div>
<div>I do have a question though. If we use Google as an identity
provider, is there a way to “piggyback” on that authentication
to be able to retrieve a token for accessing google drive
contents for example without having the user to have to log in
again?</div>
<div><br>
</div>
<div>Here is my workflow:</div>
<ol>
<li>User goes to our webserver.</li>
<li>User is presented a login page from Keycloak</li>
<li>User clicks Google</li>
<li>User logs into Google</li>
<li>User is redirected back to Keycloak’s webpage</li>
<li>User is redirected back to our webserver.</li>
</ol>
<div>Now what we also want to do is use the workflow documented
here: <a moz-do-not-send="true"
href="https://developers.google.com/identity/protocols/OAuth2WebServer?hl=en">https://developers.google.com/identity/protocols/OAuth2WebServer?hl=en</a> to
get a token for google drive access. </div>
<div><br>
</div>
<div>Is this possible? Or am I doing something wrong? Or am I
going about this the wrong way? We need to authenticate the
user in our Keycloak, but we also want to let the user’s
application directly access the user’s Google Drive data.</div>
<div><br>
</div>
<div>Thank you.</div>
<div><br>
</div>
<div>Reed Lewis</div>
<div><br>
</div>
<div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>