Pass URL parameters from the application to Keycloak during initial authentication

UAA
1

We are using additional hooks inside Keycloak that force the user to select a value from a list of values that is part of the user profile inside Keycloak.

So when UAA/A12 redirects to the Keycloak login form, an additional form will be presented to the end user during the authentication flow in Keycloak.

We now have the requirement to allow pre-selecting a value by providing a URL parameter that is passed to the our application. So, our application will be called with e.g. http://our.host/index.html?foo=bar the foo/bar pair needs to be passed on to the Keycloak authentication flow during the redirect by A12/UAA

The only way I found in Keycloak is to append this parameter to the login-redirect-relative

I verified that this parameter is preserved and accessible in the Keycloak authenticator we are using, by hard coding a value in my application properties, e.g.:

mgmtp.a12.uaa.authentication.client.rest.authentication-configuration.oidc.public-client.login-redirect-relative.url=index.html?foo=bar

Of course hard-coding this in the application properties is not possible, as this needs to be dynamic.

So my question is: can we (or UAA or A12 in general) extract the original URL parameter before the UAA redirect and then change the redirect URL for keycloak inside our application (frontend or backend doesn’t really matter).

Or is there any other way to pass a customer parameter to Keycloak that is usable during the authentication flow?

Reading the Keycloak documentation, it seems possible to pass custom parameters directly by using the prefix client_request_param_ - but I did not find any way to manipulate the URL that UAA is using (which contains the redirect_uri which I can manipulate)

2

Hello @thomas-soft-grove,

You can override the UAA config on the client as well with something like

# appsetup.ts in case of project template based source
const clientConfiguration: UaaClientConfiguration = {
        serverURL: "/api",
        automaticallyLogin: true,
        store: config.store,
        overrideClientConfigures: {
            oidc: {
                redirect_uri: `as original url from ${window.location.href} or whatever dynamical`
            }
        }
    };

Not sure it’d work, but hopefully, it’s a good hint.

Cheers,

3

Thanks, that works. I had do add a cast though:

overrideClientConfigures: {
    oidc: {
        redirect_uri: `${window.location.origin}/index.html?foo=bar`
    }  as any
}
4

hi @thomas-soft-grove please aware dynamic url redirect you configure require Keycloak redirect pattern configuration to avoid open redirect security issue. No matter which URL you redirect this url must understand response from IDP which require state (generated from first request).

In the end, as long as you trust the url based on configuration in IDP (keycloak) + your url can parse state from IDP then it’s good.

5

How can I verify that?

6

Hi @thomas-soft-grove ,

login in your realm in Keycloak then have a look at Clients tab on the left side. Find the client which you connected with, scroll down to Redirect Url configuration and see if the redirect URL is configured there.

If you use different IDP than Keycloak, you need to ask your IDP manager to configure the redirect URL correctly. This will make sure the direct urls are under control.

Cheers,
Tuan Do