Re: [keycloak-user] Reset password - direct URL

Hi. About month ago i also investigated this issue, and came to following solution: I explored keycloak-github repo, for implementation of sending email with reset-password link. Then i slightly modified founded code: private String generateResetPasswordLink(UserModel user) { // Set params for redirecting after password updating // User will be redirected to his Keycloak Account application String clientId = Constants.ACCOUNT_MANAGEMENT_CLIENT_ID; ClientModel client = realm.getClientByClientId(clientId); String redirectUri = client.getBaseUrl(); // Create user session and set that he have to set password ClientSessionModel clientSession = createClientSession(user, redirectUri, clientId); clientSession.addRequiredAction(ClientSessionModel.Action.UPDATE_PASSWORD.name()); if (redirectUri != null) { clientSession.setNote(AuthenticationManager.SET_REDIRECT_URI_AFTER_REQUIRED_ACTIONS, "true"); } // Generate token which will be appended to link and will refer to created session for changing password ClientSessionCode accessCode = new ClientSessionCode(session, realm, clientSession); accessCode.setAction(ClientSessionModel.Action.EXECUTE_ACTIONS.name()); return Urls.executeActionsBuilder(uriInfo.getBaseUri()) .queryParam("key", accessCode.getCode()) .build(realm.getName()) .toString(); } private ClientSessionModel createClientSession(UserModel user, String redirectUri, String clientId) { if (!user.isEnabled()) { throw new WebApplicationException( ErrorResponse.error("User is disabled", Response.Status.BAD_REQUEST)); } if (redirectUri != null && clientId == null) { throw new WebApplicationException( ErrorResponse.error("Client id missing", Response.Status.BAD_REQUEST)); } if (clientId == null) { clientId = Constants.ACCOUNT_MANAGEMENT_CLIENT_ID; } ClientModel client = realm.getClientByClientId(clientId); if (client == null || !client.isEnabled()) { throw new WebApplicationException( ErrorResponse.error(clientId + " not enabled", Response.Status.BAD_REQUEST)); } String redirect = null; if (redirectUri != null) { redirect = RedirectUtils.verifyRedirectUri(uriInfo, redirectUri, realm, client); if (redirect == null) { throw new WebApplicationException( ErrorResponse.error("Invalid redirect uri.", Response.Status.BAD_REQUEST)); } } UserSessionModel userSession = session.sessions().createUserSession( realm, user, user.getUsername(), clientConnection.getRemoteAddr(), "form", false, null, null ); userSession.setState(UserSessionModel.State.LOGGED_IN); ClientSessionModel clientSession = session.sessions().createClientSession(realm, client); clientSession.setAuthMethod(OIDCLoginProtocol.LOGIN_PROTOCOL); clientSession.setRedirectUri(redirect); clientSession.setUserSession(userSession); return clientSession; } If you follow by link returned from generateResetPasswordLink() you will be prompted to type new password. But after you set you new password, you will not be redirected directly to account (note that we used ACCOUNT_CLIENT as redirectUri while constructing link). You'll see a link below password form that will lead you to account, but you'll have to type you updated credentials (i.e. you will be redirected to login page and only then to account page). But we also interested if there is better solution for password setting. In general we interested in flow where after setting new password user would be automatically redirected to any specified client bypassing login page. Hope it will help you, and hope my English is not so ugly) On 11.04.2017 23:38, Mariusz Chruscielewski - Info.nl wrote: