Hi everyone,
I'm working on an OutSystems Developer Cloud (ODC) mobile application that uses Keycloak as the external Identity Provider.
Our application authenticates users through ODC's GetExternalLoginUrl() flow. However, we also need to obtain a Keycloak access token for calling downstream APIs. Since ODC currently consumes the authorization code and does not expose the external IdP token, we are exploring the possibility of performing a separate authentication flow directly against Keycloak.
On iOS, we understand that ASWebAuthenticationSession is the recommended approach for OAuth/OIDC authentication because it can reuse browser sessions and properly handle callback URLs.
I have a few questions:
Any implementation examples, plugin recommendations, or lessons learned would be greatly appreciated.
Thank you!
Some time ago I wrote an article and Forge component for a IdP Proxy to intercept id and access tokens. See here https://without.systems/entra-id-proxy-for-outsystems-developer-cloud
It covers Entra, but it should be quite easy to adapt it to your Keycloak instance.
Hi @Stefan Weber , thank you for your advice. I tried implementing this with Keycloak and it's working fine. However, there's one thing I'm concerned about regarding security: the interception of the authorization code or access token in transit between the app, the proxy, and Keycloak (e.g., custom URL scheme hijacking, MITM).
Is there a solution to address this and other related security issues?
Technically the principle of the proxy service is the same like the many available oauth proxy solutions (like e.g. https://github.com/oauth2-proxy/oauth2-proxy). I would not consider this setup as unsecure or even less secure. But that is just my own opinion.