Repository navigation
Move the Device Flow Support behind a dedicated feature flag #23700
Replies: 1 comment 5 replies
|
After giving this idea a bit more thought, I still think it would be helpful to be able the device flow feature for the whole server. However, I also think that it would be helpful to be able to explicitly enable / disable features like device-flow per realm. |
This process has 2 steps. Step2 is to be able to set enable / disable device flow per realm. Therefore, first, I want to implement stpe1. |
|
Thanks for your comment. I think it is a good idea to do this incrementally. Step1 sounds reasonable to me. If we would implement a new Also think Step2 (Realm-Level Feature Toggles) needs more planning as this will probably be a bigger feature, as we need a new way to handle features (Server-Level, Realm-Level) including admin ui extensions and feature toggle storage. I'll create a draft PR for step1 and then we can go from there. |
|
I created the issue #23891 for step1 |
|
@Michito-Okai I created a draft PR here: #23892 Would be great if you could take a look :) I'll add a tests for the following Keycloak with the device_flow feature disabled:
|
|
I added some admin-ui screenshots with the device-flow feature disabled: #23892 (comment) |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
The OAuth Device Flow capability has been shipped with Keycloak 13.0 and has since been enabled by default.
To use the Device Flow, one needs to create a client with the device flow enabled. Only with such a client device flow can it be used.
However, the device flow capability is always advertised via the ./well-known/openid-configuration document.
Although Keycloak supports ways to customize the response of the openid-configuration endpoint, the endpoints to handle device-flow authentication are still exposed. Of course, those endpoints can be explicitly blocked with an external reverse proxy.
In most of our customer projects, we learned that customers would prefer to turn off device-flow support if they don't want to support it explicitly. Otherwise it gives their (3rd party) clients the wrong impression that certain functionality is supported when it is in fact not.
Therefore, I propose to put the support for OAuth2 Device Flow behind a dedicated feature flag like (DEVICE_FLOW). This flag could be enabled by default for a few versions and then turned off to give users time to adapt.
In addition, in some environments, moving this feature flag from a global flag to a realm-level flag might make sense, e.g., for SaaS scenarios where a realm is used as the unit of multi-tenancy.
The DEVICE_FLOW feature flag should be considered in the following places:
What do you think about that?
All reactions