Public Access
jaap-jan
91f7586b22
The head redirects to dev.dodotech.dodossh:/callback — a private-use scheme, RFC 8252 §7.1, matching the intent filter on MainActivity — and this realm listed only the desktop's loopback. So a sign-in started from a phone reached Keycloak and was refused there, with invalid_redirect_uri and nothing wrong on the phone at all. The realm simply had never been told the second head exists. Found by running the head against a local stack rather than by reading it: the desktop's own sign-in has always worked here, which is exactly why this went unnoticed. Note for anyone picking the change up: --import-realm skips a realm that already exists, so a restart does nothing and the old configuration goes on being served. The container has to be recreated. The steps are in the comment on the keycloak service in docker-compose.dev.yml.
88 lines
2.0 KiB
JSON
88 lines
2.0 KiB
JSON
{
|
|
"realm": "dodossh",
|
|
"enabled": true,
|
|
"displayName": "DodoSSH (development)",
|
|
"sslRequired": "none",
|
|
"registrationAllowed": false,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"accessTokenLifespan": 900,
|
|
"ssoSessionIdleTimeout": 1800,
|
|
"ssoSessionMaxLifespan": 36000,
|
|
|
|
"clients": [
|
|
{
|
|
"clientId": "dodossh-desktop",
|
|
"name": "DodoSSH Desktop",
|
|
"enabled": true,
|
|
"protocol": "openid-connect",
|
|
"publicClient": true,
|
|
"standardFlowEnabled": true,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"implicitFlowEnabled": false,
|
|
"attributes": {
|
|
"pkce.code.challenge.method": "S256",
|
|
"post.logout.redirect.uris": "http://127.0.0.1/*"
|
|
},
|
|
"redirectUris": [
|
|
"http://127.0.0.1/callback",
|
|
"dev.dodotech.dodossh:/callback"
|
|
],
|
|
"webOrigins": [],
|
|
"protocolMappers": [
|
|
{
|
|
"name": "dodossh-api-audience",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"included.custom.audience": "dodossh-api",
|
|
"access.token.claim": "true",
|
|
"id.token.claim": "false"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
|
|
"users": [
|
|
{
|
|
"username": "alice",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"email": "alice@example.com",
|
|
"firstName": "Alice",
|
|
"lastName": "Example",
|
|
"realmRoles": [
|
|
"default-roles-dodossh"
|
|
],
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "alice",
|
|
"temporary": false
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"username": "bob",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"email": "bob@example.com",
|
|
"firstName": "Bob",
|
|
"lastName": "Example",
|
|
"realmRoles": [
|
|
"default-roles-dodossh"
|
|
],
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "bob",
|
|
"temporary": false
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|