I'm trying to get a relative (i.e. path only with no host) redirect URI for a Keycloak client to work. My client works with full host and path, but if I remove the host part I get an illegal parameter error. The inline help bubble has the following sentence: "Relative path can be specified too, i.e. /my/relative/path/*." So as far as I can tell, it should work according to the help message. As I was trying to find out more about this I came across Jira issue KEYCLOAK-8[1], where a comment pointed to section 3.2.1[2] of the OAuth 2.0 spec. If I'm reading the spec correctly the redirect *must* be absolute to be conformant with the spec. Is the inline help wrong, or is it something here that I don't get? Håvard [1] https://issues.jboss.org/browse/KEYCLOAK-8 [2] https://tools.ietf.org/html/rfc6749#section-3.1.2 _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

I'm not sure that I'm asking the right question yet, so I'll try again. We have Keycloak installed on keycloak.my.lan. We're running development on several developer PCs, which we access by their public IP because we test on several devices against our local development environment. So my application is hosted on 192.168.1.2 at the moment, my colleague is running her version of the same application at 192.168.1.4, and our IPs may change the next day. If I configure the client "myclient" in the "Clients" section in Keycloak admin console with a "Valid redirect URI" of "http://192.168.1.2:3000/app/login" then login works. If I change this to only "/app/login" then I am presented with the error "We're sorry... Invalid parameter: redirect_uri" from Keycloak before I get a chance to enter my credentials. The URL from my application in both cases is the URL below, so the redirect URI as sent from the application is always absolute: https://keycloak.my.lan/auth/realms/myrealm/protocol/openid-connect/auth?... I left out the last relevant part of the help message (for brevity) in my first mail. In addition to "Relative path can be specified too, i.e. /my/relative/path/*" it also says "Relative paths will generate a redirect URI using the request's host and port". My reading of those two sentences together lead me to believe that I could leave out the So my real question is: Is it possible to set a single "Valid redirect URI" in Keycloak console for my app that will work when the app is served from either http://192.168.1.2/app or http://192.168.1.4/app and possibly many similar URIs? Or do I have to specify every possible URI that my app could be served from under "Valid redirect URIs"? Håvard Den 23. nov. 2015 20:19, skrev Bill Burke: > A relative URI *will not* be accepted if it is passed as a query > parameter when a client is requesting a code. An absolute URI *MUST BE* > sent via the redirect_uri query parameter. For admin console config, if > you put in relative path in your valid redirect URIs, it uses the > host/port of the auth server. A bunch of the demos work that way. So, > if you host the auth server on mydomain.com, > https://localhost/my/relative/path will match and > https://mydomain.com/my/relative/path will work too. Make sense? > > > > On 11/23/2015 2:00 PM, Håvard Wigtil wrote: >> I'm trying to get a relative (i.e. path only with no host) redirect URI >> for a Keycloak client to work. My client works with full host and path, >> but if I remove the host part I get an illegal parameter error. >> >> The inline help bubble has the following sentence: "Relative path can be >> specified too, i.e. /my/relative/path/*." >> So as far as I can tell, it should work according to the help message. >> As I was trying to find out more about this I came across Jira issue >> KEYCLOAK-8[1], where a comment pointed to section 3.2.1[2] of the OAuth >> 2.0 spec. If I'm reading the spec correctly the redirect *must* be >> absolute to be conformant with the spec. >> >> Is the inline help wrong, or is it something here that I don't get? >> >> Håvard >> >> >> [1] https://issues.jboss.org/browse/KEYCLOAK-8 >> [2] https://tools.ietf.org/html/rfc6749#section-3.1.2 >> >> >> >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> -- Håvard Wigtil arkitekt og utvikler, Kantega AS tlf. +47 9384 6468 _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user