OIDC protocol has implicit flow and we support that in Keycloak. However
we don't support that for our Identity providers. I see that
AbstractOAuth2IdentityProvider.createAuthorizationUrl has hardcoded
"response_type" to "code" . So you would need to create your own impl
Identity Provider and override that method. Probably some other methods
would need to be overriden too (eg. for logout).
I would rather try to setup SSL and make Keycloak servers communicate
with each other . We have truststore SPI, which is documented and
hopefully can simplify it.
On 26/07/17 16:07, May Marcus, Bedag wrote:
I'm looking into using Keycloak as a Broker in my SAAS platform to federate with
foreign IdPs which aren't in my control.
So my scenario is that:
1. Customer navigates to his SP in my SAAS platform
2. SP redirects him to my Keycloak in my SAAS platform
3. Customer choses to login in with his IdP
4. Keycloak redirects Customer to the login page of his IdP
5. Customer accomplishes login to his IdP
6. IdP redirects the Customer to my Keycloak
7. My Keycloak provisions the user
8. My Keycloak redirects the user to his SP in my SAAS platform
9. SP accepts the login
For a proof of concept I tried to implement this scenario with two Keycloak instances,
which aren't and shouldn't be able to communicate with each other. The only thing
that should communicate with both Keycloak instances is the user agent, because I
don't want the hassle that I have to establish a for example two-way-ssl connection
between my SAAS Keycloak and foreign IdP.
My first attempt was using OpenID Connect, but then my SAAS Keycloak tried to get an
access_token from the other Keycloak in step 7. That didn't work (as I expected and
intended). So my question is: Is there a way to use an OIDC IdP without any backchannel
My second attempt was using SAML 2.0 Web Browser SSO with HTTP-Post Binding. That did
keycloak-user mailing list