Android Login Flow

Securing applications
,
1

Hello,

in our mobile application, we have 2 different logins:

  1. Internal login ( username & password )
  2. Identity provider login ( google & facebook )

In Internal login we use Rest client with grant_type=password for requesting token from Keycloak, in Identity provider flow we use AppAuth.

There are a few things that bother me:

  1. Within internal flow, we have Forgot password option where the user in a mobile app enters his email, that is sent to a back-end and back-end request password reset action.

In this flow I have a few extra steps: in the email it stands that admin request update account action, when user clicks on the link it shows the steps within required actions ( even only one required ), and after successful update password, the user is not automatically redirected to an redirect_uri.

Is there any way to do password reset as Forgot password flow on Keycloak login page?

  1. What with AppAuth flow, when the user choose Login via Google: redirect from Mobile App to Keycloak, from Keycloak to Google, successful login on Google, redirect to Keycloak and at this stage the user is Disabled.

Here we have message in browser: User is Disabled, and the flow stops here, it doesn’t redirect to a Mobile App with error.

Thanks in advance!