From 91f7586b22362cd46cef15e57f3016ed3d0d62ed Mon Sep 17 00:00:00 2001 From: Jaap-Jan de Wit | DodoTech Date: Wed, 26 Aug 2026 13:28:20 +0200 Subject: [PATCH] Let the Android head finish signing in against the development realm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The head redirects to dev.dodotech.dodossh:/callback — a private-use scheme, RFC 8252 §7.1, matching the intent filter on MainActivity — and this realm listed only the desktop's loopback. So a sign-in started from a phone reached Keycloak and was refused there, with invalid_redirect_uri and nothing wrong on the phone at all. The realm simply had never been told the second head exists. Found by running the head against a local stack rather than by reading it: the desktop's own sign-in has always worked here, which is exactly why this went unnoticed. Note for anyone picking the change up: --import-realm skips a realm that already exists, so a restart does nothing and the old configuration goes on being served. The container has to be recreated. The steps are in the comment on the keycloak service in docker-compose.dev.yml. --- deploy/keycloak/realm-dodossh.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/deploy/keycloak/realm-dodossh.json b/deploy/keycloak/realm-dodossh.json index 33b2495..11d8806 100644 --- a/deploy/keycloak/realm-dodossh.json +++ b/deploy/keycloak/realm-dodossh.json @@ -26,7 +26,8 @@ "post.logout.redirect.uris": "http://127.0.0.1/*" }, "redirectUris": [ - "http://127.0.0.1/callback" + "http://127.0.0.1/callback", + "dev.dodotech.dodossh:/callback" ], "webOrigins": [], "protocolMappers": [