Keycloak configured with Azure as IDP and MSAL on Android

Getting advice
1

I’m currently developing an Android application and I’m trying to introduce MSAL with my current Keycloak / Azure authentication flow. However, my backend is set up to validate by Keycloak tokens and I need to maintain this setup.

Here’s the flow I’m trying to achieve:

  • Authenticate users with Keycloak + Azure AD using MSAL.
  • After successful Azure AD authentication, redirect to Keycloak.
  • Keycloak redirect to APP.

I’m looking for guidance on how to implement this flow. Specifically, I’m not sure how to configure Keycloak as IDP from MSAL / Authenticator.

If this is not possible, are there any workarounds or alternative approaches to achieve this?

Sequence diagram of wanted flow:

Screenshot 2024-02-13 at 09.25.44
Screenshot 2024-02-13 at 09.25.441930×1402 155 KB

I have tried to configure MSAL to use Keycloak but couldn’t find any way to do that.

I have also looked into B2C which should support other authentication mechanisms but it seemed to be impossible in MSAL for Android, was present in MSAL js.

The authentication flow with keycloak and Azure configured as an identity provider is working perfect, but just need to add MSAL into the picture to achieve SSO. As keycloak will redirect to Azure at login we should be able to reuse the same Azure session if it already has been established by another APP/Browser on the Android mobile phone.

Any help would be greatly appreciated.

2

Short answer: In your case, you want to implement OIDC in a native app. Therefore, you MUST use an OIDC library that supports this and follows best practices. I recommend using AppAuth [1], which opens a Browser or Custom tabs (not a WebView, as it is not recommended for security reasons [2]). Then, you can implement the Authorization Code + PKCE flow, as it is the recommended flow for public clients [3]. Lastly, your API will act as an OAuth Resource Server following the OAuth 2.0 standard, meaning that it will receive the access token in the Authorization Header with the format Bearer {access-token-value}

[1] GitHub - openid/AppAuth-Android: Android client SDK for communicating with OAuth 2.0 and OpenID Connect providers.
[2] RFC 8252 - OAuth 2.0 for Native Apps
[3] RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
[4] RFC 6749 - The OAuth 2.0 Authorization Framework

1 Like