2:45 p.m.
TL;DR; How do I shove this :
https://developers.google.com/identity/sign-in/web/backend-auth into
KeyCloak.
I've been reading up on how to extend the KeyCloak service and I want to
write a (SPI? module? extension?) that let's me sign into my server
services using a Google ID Token. This will let me use the Google account
on my Android phone without ever having to open a web page. In fact if I
only have one Google account on my phone I can automatically log my user
into my app without ever having to prompt them.
However, I'm not really sure where to start. I've cloned the keycloak
repository and have been reviewing the code there and cross referencing
with the docs, but I think I need a little more "push" in the right
direction.
For reference, I've implemented this flow in both Node.js and Java before
without much trouble so I should be able to get a PoC up in an afternoon or
two once I know where to put the code.
Node.js :
https://github.com/secondsun/FH-Google-mBaas-Auth/blob/master/lib/auth.js...
Java :
https://github.com/secondsun/devnexus-site/blob/master/src/main/java/com/...
Thanks,
Summers
5:25 a.m.
Interesting, but maybe not that straightforward to do.
Depends on what flow you'd like to use. The ideal would be to use the web
redirect flow (authorization code flow). Using the web redirect flow you
can still display forms if needed. For instance if the ID token isn't valid
and you want to ask for username/password instead, the user needs to update
their profile, etc..
Alternative is to use the direct grant (aka resource owner credential
grant) flow to simply exchange the ID token retrieved from Google with
tokens from Keycloak.
In either case this can be done with custom authentication flow and
authenticator. Take a look at the server developer guide and our examples
for some inspiration there. It may also better fit in with identity
brokering, but that would probably require code changes on the Keycloak
side rather than just an extension.
On 12 September 2017 at 05:45, Summers Pittman <supittma(a)redhat.com> wrote:
TL;DR; How do I shove this :
https://developers.google.com/identity/sign-in/web/backend-auth into
KeyCloak.
I've been reading up on how to extend the KeyCloak service and I want to
write a (SPI? module? extension?) that let's me sign into my server
services using a Google ID Token. This will let me use the Google account
on my Android phone without ever having to open a web page. In fact if I
only have one Google account on my phone I can automatically log my user
into my app without ever having to prompt them.
However, I'm not really sure where to start. I've cloned the keycloak
repository and have been reviewing the code there and cross referencing
with the docs, but I think I need a little more "push" in the right
direction.
For reference, I've implemented this flow in both Node.js and Java before
without much trouble so I should be able to get a PoC up in an afternoon or
two once I know where to put the code.
Node.js :
https://github.com/secondsun/FH-Google-mBaas-Auth/blob/
master/lib/auth.js#L47
Java :
https://github.com/secondsun/devnexus-site/blob/master/src/
main/java/com/devnexus/ting/web/controller/AndroidLoginController.java#
L100
Thanks,
Summers
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
2670
days inactive
2671
days old
1 comments
2 participants
participants (2)
-
Stian Thorgersen -
Summers Pittman