Search code examples
oauth-2.0openidopenid-connectkeycloakkeycloak-services

OAuth2 authorization interface using KeyCloak

I'm trying to use KeyCloak as identity provider service for 3rd party applications support. The idea is to register the client application in KeyCloak, trusted clients will not require this authorization approval, but there should be "untrusted" client flow, e.g. display user authorization interface as specified in OAuth 2.0 specification.

OAuth2 authorization interface

From what I see in the docs, they have pretty good fine-grained authorization mechanisms which can be used for that on the backend. However I don't see any way to provide authorization screen for /authorize endpoint as shown above.

Maybe this can be custom created SPI or something else which can be used for implementing this to move further. Any ideas of how this can be implemented in KeyCloak? Are there any built-in features which can be reused or custom way implementation?

Solution

  • In Keycloak you can turn on the Consent Required switch per client (see client settings in admin console).
    After successful authentication this will bring up a confirmation page similar to your example.