Feature Request: Add PKCE to Keycloak

[frenzeldk]

As Keycloak supports PKCE using S256, it would be nice, if the feature could be added to the plugin.

[Jefferson49]

Thank you for reporting the issue. Since version v1.1.7, PKCE is supported. Do you use the current version v1.1.9?

The PKCE configuration is decribed in the PKCE chapter of the Readme.

However, I have not yet tested with Keycloak. You should include the following configuration and test if it is working:

Keycloak_pkceMethod='S256'

[frenzeldk]

I have added the line to my config.ini.php which now looks like this:

; <?php return; ?> DO NOT DELETE THIS LINE
dbtype="mysql"
dbhost="REDACTED"
dbport="3306"
dbuser="REDACTED"
dbpass="REDACTED"
dbname="webtrees"
tblpfx="wt_"
base_url="REDACTED"
rewrite_urls="1"
trusted_header_authenticated_user="Remote-User"
Keycloak_clientId='REDACTED'
Keycloak_clientSecret='REDACTED'
Keycloak_authServerUrl='https://REDACTED'
Keycloak_realm='REDACTED'
Keycloak_signInButtonLabel='REDACTED'
Keycloak_pkceMethod='S256'

but when I set my Keycloak instance to force pkce I get the following error (redirect URI redacted):

The above indicates that even though I have set the Keycloak_pkceMethod='S256' parameter it isn't sent to Keycloak

[Jefferson49]

Ok. I checked the code for Keyclock and it shows that it cannot be configured for PKCE at the moment.

I think it needs some additional code, which is not included at the moment. You can try to replace the following file by the attached patch:
\modules_v4\oauth2_client\vendor\stevenmaguire\oauth2-keycloak\src\Provider\Keycloak.php

Keycloak.php

[frenzeldk]

Sorry for not getting back faster. Applying that file did the trick.

For context my Keycloak settings for the client are:

and my config.php.ini is unchanged from above.

[Jefferson49]

Happy to hear that it is working!

I will have to think if I want to create a fork with this patch and substitute the Keycloak Oauth2 library with the patched version. At the moment, I am not sure whether to move in this direction.