Bonjour,
I have a question about tokens. I have connected my application to the Keycloak of my company with identity provider, and it's working fine.
In my company, we have an API , and I would like to use it. The API is protected with Keycloak as well, and calls need a token.
Is it possible to get the current refresh token use by ODC so I can access Keycloak to call the API?
How to get the token with Keycloak:
Later, if I need to call my API, I use the refresh token to obtain a new access token.
Hey Vincent, question, how does the custom page receive the token? Just add the input for the screen?
Hi Luis,
Yes, I had a code input with parameters.
Vincent
Thanks!I tried this but didn't work for me. Maybe it simply doesn't work with entra?Can you run me through what you did?
I'm doing the usual
The redirect URL is this Request_AbsoluteURL("/MyModule/LandingPage")
And then the redirect page is this:Do I need to had the?code= to the redirect URL?
Cheers,
LuÃs
I have a Keycloak template under review in the forge.
Is your landing page called by the Keycloak redirect URL?
I'm using OpenId Connect to Entra\Azure ADMaybe that one works differently.
LuÃs Matos
Hey @Vincent Massieye ,
For getting the refresh token you have to use system event handler OnApplicationResume.
where you can write a code to get a new fresh token.
Kind regards Aayush Shrivastava
Thank you for the answer, but it's not really what I'm looking for. I probably didn't explain my problem very well. However, I discovered this feature thanks to you.
Hi Vincent,
the short answer is no (sorry). The original identity and access tokens from your keycloak instance are only used to authenticate a user with the odc identity management solution. The latter then issues its own identity and access token and there is no way to retrieve the brokered ones.
Stefan
Thanks, I finally made a custom connection before the ODC connection where I get a token and store the refresh token in a database.
hi @Vincent Massieye , can you clarify more what you did. Because I believe the authorization code will be consumed by OIDC in order to create a user's session so there will be no code return to callback screen. Thank you.
Hi,
The process I use has two steps.
First, I use the OutSystems External Logic to connect to the SSO (Keycloak).
Then, I check whether a refresh token is already stored in a database. If not, I redirect the user to the SSO to request a token. The SSO returns the token as a parameter, I store it in the database, and then redirect the user back to the application.