CODEWITHSUNDEEP
authenticationoauth-2.0keycloakopenid
minglyu
minglyu

Reputation: 3327

keycloak, why does backend channels need a redirect url

I try to integrate my Python app(backend client) into the Keycloak system using openid connect, why do I have to fill the Valid Redirect URIs field? From my understanding for OAuth 2.0, the backend channel just need to exchange the code for id and access tokens in the Authorization Code Flow process

Why do we need a redirect URL here, shouldn't it only filled in the front end client?

Any Ideas?

enter image description here

Upvotes: 1

Views: 2927

Answers (2)

Michal Trojanowski
Michal Trojanowski

Reputation: 12322

The client which receives the authorization code and the one which exchanges the code for tokens must be the same client - at least from the Authorization Server's point of view. Theoretically you can have separate applications which handle parts of the OAuth flow, but they must be using the same client ID.

Ideally, the redirect URI points to an endpoint exposed by your Python backend. After Keycloak (or any Authorization Server) finishes authentication and authorization, it will redirect the user to that endpoint together with the authorization code. This way the authorization code will go straight to the backend client, the frontend app will never have to handle it. By registering the URL you want to make sure that no one performs authorization using your client ID, but asks to send the code to another application.

Upvotes: 0

Tore Nestenius
Tore Nestenius

Reputation: 19921

We need it to restrict to what URL we are allowed to redirect to after a successful login. We do this to improve the security for your users, because it would be a big security problem if the provider could redirect to any URL after login.

Upvotes: 1

Related Questions