Hello, We are currently developing the integration of Keycloak within our native mobile applications. In the documentation we can see a section regarding Cordova apps, but not native. Is it properly supported ? Saying that, we are able to login with an already registered user without a problem ; the problem comes with Registration workflow and especially Email Validation. To make it work, we are using custom scheme for redirectURI but we are not able to do it for baseURL and rootURL (Invalid URL error in the admin console). Why is that ? Regarding the email validation: When the user clicks on the email validation link from his mobile and he uses the same browser than the mobile app ; everything works fine. How does it work by the way ? The redirect uri doesn’t seem to be propagated on the validation link? However, if he uses a different browser or validates his account from another device, on the app, the user is blocked on the “validate your email” page; and if he does refresh the page, there isn’t the “back to application” link (probably because baseURL is not set). How is it supposed to work ? Thanks for your advice.

Hello, I would really appreciate some help please… We have managed to set http://localhost.com.eh.app in order to be redirected to the app . That’s good. The problem is that the response does not contains the authorisation code ! So we can’t continue the login process. Thank you so much for any help.

I have read in details the documentation you are pointing me to and I am actually using the AppAuth Android Library. The problem I am having is very specific to email validation and redirect URL after validating the email in a different browser than the one I used to initialize the registration. When I refresh the “please verify your email” page in my app browser, I get a page that say that I am connected. The back to Application link points to be to my baseURL instead of the redirectURL with the authorisation code. How is it supposed to work please ?

After working all day on it , it seems : 1/ if we are using custom scheme in the redirect URI, after refreshing the “please verify your email” page in my app browser, I get a “back to application” link pointing to BASE URL without authorisation code. Moreover, Base URL cannot use custom scheme. 2/ if we are using https redirect URI instead of custom scheme, after refreshing the “please verify your email” page in my app browser, I get redirected directly with the correct redirect URI (with parameters) but it doesn’t open the app (but browser). It works fine when we do a normal login however. Where is the code that is called when I refresh the page ? how do you handle the redirect ? And also : is custom scheme supported ? It is the recommanded method in the openid documentation. Thanks

We ended up setting a redirect url to a website that redirect to the mobile app with custom scheme… it is not very elegant but it works. So my guess is that custom scheme is not supported ?

What do you mean with supported? A custom protocol and scheme for a native app is on the OS level and has nothing to do with Keycloak. Your native app should intercept a call made to that custom scheme. Take a look at https://blog.pedrofelix.org/2016/02/15/oauth-2-0-and-pkce/ and especially the PKCE parts and https://blog.pedrofelix.org/2017/10/

As you mentioned, the native app should intercept a call made to the custom scheme ; based on the fact that the redirectURI should point to that custom scheme. It works fine with Keycloak in cases like : log in with existing user or validating email with mobile device with the same browser. It doesn’t work if you register a new user with email validation + you open the email validation on a different device than the mobile (for example from your computer). If redirect url is set to a scheme custom (i.e different from HTTP/HTTPS), info.ftl will not have pageRedirectUri and it will be redirected to baseUrl (which cannot use a custom scheme either) . If redirect url is set to HTTP scheme, the redirection works fine. That’s why we found the (durty) workaround to set in our mobile app “redirectURI” to a HTTPS webpage that redirect us to our custom scheme page… Is it a bug or something I am not doing correctly ?

If I may ask, I have added the html file to my custom theme, under a html folder. I can access it via https://my.company/auth/resources/i3cfu/login/myrealm/html/redirect.html Could you tell me what i3cfu refers to ? Is it subject to change ? Thanks

What version of Keycloak are you working with? I have no idea what i3cfu is, neither does the keycloak source code.

I am working with the latest version 9.0.2.

Custom scheme for native mobile apps

Securing applications

zonaut March 24, 2020, 3:26pm 3

Mabe this helps -> How to secure mobile apps? or https://www.keycloak.org/docs/latest/securing_apps/#android

Topic		Replies	Views
Email confirmation redirect on iOS Getting advice	1	533	November 21, 2024
Custom Login Page with social login (not the one from Keycloak) Securing applications authentication , identity-brokering	17	14559	November 30, 2021
Keycloak v.15.0.0 + React \| Invalid parameter : redirect uri Configuring the server	2	2474	August 19, 2021
Suddenly You are already Logged In Error is coming for REDIRECT URI Scheme Miscellanaeous	0	558	December 22, 2021
Keycloak + Angular + SpringBoot - different redirect urls for login and registration Securing applications	0	1132	March 30, 2021

Custom scheme for native mobile apps

Related topics