Here's my thoughts on device mgmt, both UI and protocol:

Scenario:

An iOS device as a "Brokerage App" installed.  The app needs to do REST
invocations to be able to trade stocks, etc.  Devices must be registered
in order to obtain permission.  Flow would look like this:

* User installs app on iPad.
* User hits login button on app.
* User is redirected to browser with a Keycloak server URL
* User enters in credentials
* User is redirected to "Device Registration" page.  Keycloak asks user
if it authorizes access to the device.
* Keycloak registers the device under the user and generates a device token
* User is redirected back to iPad ap
* iPad app gets auth code from redirect URL
* iPad makes REST request to obtain auth token *AND* a device token.
* iPad app stores the device token.

Next login is the same, except there is no "grant" page displayed. The
iPad app uses the "device token" as a credential to turn an access code
into an access token.  These are all extensions we'll need to make to
the current OAuth protocol.

UI work:

The User Account Service will need a way to list registered devices so
the user can see it and manage it (i.e. remove a registered device).

Admin Console should have a way to define a "Device Type".  The name,
description and scope of the device type is defined.  "name" is used in
the initial OAuth grant as a client_id identifier so that Keycloak knows
what to display as a description in the


--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev