deploy

public/auth/callback/index.php

@@ -16,7 +16,9 @@ $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
 $accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
 $state = (string) ($_GET['state'] ?? '');
 $expectedState = (string) ($_SESSION['keycloak_oauth_state'] ?? '');
+$oauthMode = (string) ($_SESSION['keycloak_oauth_mode'] ?? 'interactive');
 $code = (string) ($_GET['code'] ?? '');
+$error = trim((string) ($_GET['error'] ?? ''));
 
 $title = 'Keycloak Callback';
 $message = 'Anmeldung wird verarbeitet.';
@@ -25,11 +27,21 @@ $redirectTarget = '/';
 if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $state)) {
     http_response_code(400);
     $message = 'State-Pruefung fehlgeschlagen. Bitte den Login erneut starten.';
+} elseif ($error !== '') {
+    unset($_SESSION['keycloak_oauth_state'], $_SESSION['keycloak_oauth_mode']);
+
+    if ($oauthMode === 'silent' && in_array($error, ['login_required', 'interaction_required', 'consent_required'], true)) {
+        header('Location: ' . $redirectTarget, true, 302);
+        exit;
+    }
+
+    http_response_code(400);
+    $message = 'Keycloak hat die Anmeldung abgelehnt: ' . $error . '.';
 } elseif ($code === '') {
     http_response_code(400);
     $message = 'Kein Authorization Code von Keycloak erhalten.';
 } else {
-    unset($_SESSION['keycloak_oauth_state']);
+    unset($_SESSION['keycloak_oauth_state'], $_SESSION['keycloak_oauth_mode']);
 
     $tokenExchange = $auth->exchangeAuthorizationCode($code);
 
@@ -67,6 +79,7 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
                     exit;
                 } else {
                     $auth->establishSession($tokenPayload, $userPayload);
+                    unset($_SESSION['desktop_silent_sso_attempted']);
                     header('Location: ' . $redirectTarget, true, 302);
                     exit;
                 }

public/auth/keycloak/index.php

@@ -11,7 +11,8 @@ session_start();
 
 $projectRoot = dirname(__DIR__, 3);
 $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
-$loginUrl = $auth->loginUrl();
+$mode = trim((string) ($_GET['mode'] ?? ''));
+$loginUrl = $auth->loginUrl($mode === 'silent' ? ['prompt' => 'none'] : []);
 
 if ($loginUrl === null) {
     http_response_code(503);

public/index.php

@@ -41,6 +41,16 @@ if ($auth->isAuthenticated()) {
     }
 }
 
+if (
+    !$auth->isAuthenticated()
+    && $auth->isConfigured()
+    && empty($_SESSION['desktop_silent_sso_attempted'])
+) {
+    $_SESSION['desktop_silent_sso_attempted'] = true;
+    header('Location: /auth/keycloak/?mode=silent', true, 302);
+    exit;
+}
+
 $app = new App($projectRoot);
 $desktopPayload = $app->desktopPayload();