Hoi, I had the same idea initially but then I thought that simply tagging a client as "default" would be more flexible since you have all the client metadata, role support etc. Cheers, Thomas 2016-02-05 14:55 GMT+01:00 Thomas Raehalme <thomas.raehalme(a)aitiofinland.com

Hello Stian, Hello Thomas, yes I understand that - and I agree that falling back to the default client in case of a missing client is not a good idea. However I think I would be very helpful to be able to initiate a redirect from one client to another client (that is just known by client_id) for the use case I outlined above -> e.g. redirecting to a "launchpad" app. E.g.: https://keycloak-server:8080/auth/realms/my-realm/redirect?client_id=my-d... -> would redirect to the my-default-client base url. https://keycloak-server:8080/auth/realms/my-realm/redirect -> would redirect to the client marked as "default" @Thomas Initially I also thought about having a default redirect url per realm but then I thought that simply refering to a client_id and let keycloak redirect the user appropriatly would be more flexible, especially because you can then also leverage all the client metadata that is available for a client (name, description etc.). Cheers, Thomas 2016-02-05 15:03 GMT+01:00 Stian Thorgersen <sthorger(a)redhat.com&gt;:

Hello, 2016-02-05 15:22 GMT+01:00 Thomas Raehalme <thomas.raehalme(a)aitiofinland.com with a redirect facility as outlined above - one could render a link to the "$KEYCLOAK_BASE_URL/redirect" or lookup the "default" client in order to render the client base url link with a proper label (client name). Cheers, Thomas

Hello, any ideas regarding this? We need to link to a default application from several applications and it would be helpful if keycloak would provide said redirect mechanism, such that each application would only need to know the clientId of the default client application and keycloak performs the proper redirect to the actual target application. The example posted earlier works like a charm. This could even be extended to the point that in case no clientId is given keycloak can decide which client to redirect to. Cheers, Thomas 2016-02-05 19:05 GMT+01:00 Thomas Darimont <thomas.darimont(a)googlemail.com&gt;:

Thanks for your input :) The redirect would only work after a successful authentication, so unauthenticated users couldn't "probe" the realm for clients / target urls. But I see your point that an authenticated "malicious" user could probe all clients if he knew all clientIds (potentially via the new API). Perhaps one could offer a way to define some kind of grouping concept to describe which clients that can see each other (client group?) - so only clients from within the same group would be eligible for such a redirect. Btw. I adapted your suggestion regarding the endpoint path (which is now: {realm}/clients/{client_id}/redirect) and created a JIRA issue [0] and PR [1] with my current impl as a base for further discussion. point. including icons and links to the clients. applications they can login to This would be really helpful - is this supposed to replace the applications section in the account page? and provide a link boxes icon) This would also be very helpful, currently I pull the information with the keycloak admin client in order to render such a page. A dedicated endpoint that returns clients metadata in JSON format would be neat. Are you planning to just build a dedicated page of all apps or also a html/js widget like the 9 square app selector? [0] https://issues.jboss.org/browse/KEYCLOAK-2469 [1] https://github.com/keycloak/keycloak/pull/2202 2016-02-09 12:18 GMT+01:00 Stian Thorgersen <sthorger(a)redhat.com&gt;: > One concern with including this is if there's some potential way it can be > a vulnerability. > > The only thing I can think of is that it allows figuring out the base url > for a client. That could then be used to figure out valid redirect uris for > a client. Don't think that's a huge deal though. > > point. We'd like to be able to have a SSO page that lists all clients, > including icons and links to the clients. This would have two use-cases: > 1. As a landing page on SSO server, and as a way for users to find all > applications they can login to > and provide a link to other applications in the realm (like Google does > with the square boxes icon) > > With that in mind it would be better if the URL for client redirect was > "{realm}/clients/{client-id}/redirect" as that would allows us to use > "{realm}/clients" in the future for the above feature. "{realm}/clients" is > already used by ClientRegistrationService, but I think we can move that to > "{realm}/clients/registration" as there's probably not that many people > that are using the client registration service yet. > > On 9 February 2016 at 12:02, Thomas Darimont < > thomas.darimont(a)googlemail.com&gt; wrote: > >> Hello, >> >> any ideas regarding this? >> >> We need to link to a default application from several applications and it >> would be helpful if keycloak would provide said redirect mechanism, such >> that >> each application would only need to know the clientId of the default >> client application and keycloak performs the proper redirect to the actual >> target application. >> >> The example posted earlier works like a charm. This could even be >> extended to the point that in case no clientId is given keycloak can decide >> which client to redirect to. >> >> Cheers, >> Thomas >> >> 2016-02-05 19:05 GMT+01:00 Thomas Darimont < >> thomas.darimont(a)googlemail.com&gt;: >> >>> Quick update - I did some further experiments with this... >>> >>> I added /redirect path to the a >>> org.keycloak.services.resources.RealmsResource >>> like: @Path("{realm}/{client-id}/redirect") >>> see code fragment below. >>> >>> This allows keycloak to initiate a redirect to the browser with the >>> actual >>> target url of the client. Other clients now only need to now the realm >>> and clientId >>> to generate a link that eventually redirects to the target application. >>> >>> Usage: >>> GET http://localhost:8081/auth/realms/master/launchpad/redirect -> 302 >>> response with location: http://apps.corp.local/launchpad >>> >>> Any chance to get this in as a PR? >>> >>> Cheers, >>> Thomas >>> >>> @GET >>> @Path("{realm}/{client-id}/redirect") >>> public Response getRedirect(final @PathParam("realm") String >>> realmName, final @PathParam("client-id") String clientId) throws Exception{ >>> >>> RealmModel realm = init(realmName); >>> >>> if (realm == null){ >>> return null; >>> } >>> >>> ClientModel client = realm.getClientByClientId(clientId); >>> >>> if (client == null){ >>> return null; >>> } >>> >>> if (client.getRootUrl() == null){ >>> return >>> Response.temporaryRedirect(uriInfo.getAbsolutePathBuilder().replacePath(client.getBaseUrl()).build()).build(); >>> } >>> >>> return Response.temporaryRedirect(URI.create(client.getRootUrl() >>> + client.getBaseUrl())).build(); >>> } >>> >>> 2016-02-05 16:23 GMT+01:00 Thomas Darimont < >>> thomas.darimont(a)googlemail.com&gt;: >>> >>>> Hello, >>>> >>>> 2016-02-05 15:22 GMT+01:00 Thomas Raehalme < >>>> thomas.raehalme(a)aitiofinland.com&gt;: >>>> >>>>> I understand this as well, but it has not been uncommon to encounter a >>>>> situation where the user needs to know where to go next, because Keycloak >>>>> doesn't have a link available. >>>> >>>> >>>> with a redirect facility as outlined above - one could render a link to >>>> the "$KEYCLOAK_BASE_URL/redirect" or >>>> lookup the "default" client in order to render the client base url link >>>> with a proper label (client name). >>>> >>>> Cheers, >>>> Thomas >>>> >>>> >>>> >>> >> >

Missing client_id or redirect_uri are errors and should not just be masked by redirecting the user to a random location. You can customize the error page though to make it more friendly to your users, as well as including a link to your apps page. FIY We actually want to eventually have a clients page like https://www.google.de/intl/de/about/products/ which lists all clients available in the realm. On 5 February 2016 at 14:48, Thomas Darimont <thomas.darimont(a)googlemail.com