8:28 p.m.
Hello,
I was hoping to duplicate this functionality with Keycloak:
https://auth0.com/docs/libraries/lock/v10/ui-customization#primarycolor-s.... (I want a
single-page app ideally where the user can register without being forwarded to a separate
page.)
Auth0 has a nice API for both logging in **and** registering users so everything can be
done from a single page app on the client side. Login seems to be supported fully and
easily from an API with Keycloak using frontend only code but registering users doesn’t
seem to be so simple.
In order to do this with Keycloak, it seem that I have a few options.
(1) Embed the Keycloak login/register page in an iframe and theme the login/registration
page. (I’m certain there are vulnerabilities I’m introducing by taking this route,
CSRF?)(2) Create another separate backend API that has an admin token for registering
users. Then you post a JSON describing to the user to a ‘/register’ endpoint. (Secure I
think but wasteful of resources… Also introduces an additional failure point).(3) Capture
the required fields and POST them using the same format as a client would when using the
regular Keycloak registration page. (Seems like I have to do some interesting fetching in
order to get an authorization token for the login here as well, at least according to the
pcap I generated. Would really like to avoid doing this if possible.)(4) Create a limited
admin user (or client?) that can only create users and nothing more. Pass login
information for this user through the frontend and use that user on the frontend to make
the admin API calls for registering users. (Difficult to make secure? Seems strange that I
would be exposing an admin/client secret to the frontend but as long as it is possible to
lock it down enough that the user can’t be used for anything else then I think the is
roughly equivalent to how the key cloak page works anyway. Unless I’m missing something
important? )(5) Variant of (2), create a new plugin for key cloak that has the required
‘/register’ api without authenticating users. (Seems like this would already exist if it
was possible to do securely.)(6) Have keycloak resolve to a subdomain on my main server,
that way even though it isn’t seamless users won’t be redirected to a different domain
entirely. (If possible I would like to avoid this since auth0 seems to have solved it.)
Is there something better than any of these? If not, which options are still secure and
which would you recommend?
At the end of the day I would like something similar to the login/registration page for
Buffer: https://www.buxfer.com[1]. A modal window opens with a create account option, my
ideal login/registration flow would be similar.
Any word on this would be greatly appreciated.
Links:
1. https://www.buxfer.com/