When hitting the account client with the referrer parameter ,the AccountConsole doesn't support the relative Client URLs

[iingawal]

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest release

Area

account/api

Describe the bug

When referrer parameter is used on the Account client (e.g. http:///auth/realms//account/?referrer=), the generated 'Back to XXX' link does not contain actual relative url which is used in base url of client.

e.g- hit below url , the "Back to Admin Console" does not show the actual redirect url of Test client ,if we added the relative url in "Base URL " of Test client .

http://localhost:8080/auth/realms/testrealm/account/?referrer=Test#/

Version

18

Expected behavior

• It should show the , "https://www.google.com" when hover on "Back to Admin Console" .

Actual behavior

• It shows, "http://locahost:8080" when hover on "Back to Admin Console" .

How to Reproduce?

• Create "Test" client .
• Add "https://www.google.com" in root url and valid redirect URI and add "/" relative url in Base URL .
• hit account client with parameter "referrer" .
  http://localhost:8080/auth/realms/master/account/?referrer=Test#/
• We don't see , "https://www.google.com" when hover on "Back to Admin Console" .

Anything else?

No response

[iingawal]

Any update on this ?

[mposolda]

When looking at this, I've ended up sending PR with fixing this :-) Hopefully we can include this in Keycloak 22.

[Lunkwill-Fook]

I suppose the problem is in line 226 of AccountConsole.java
https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/resources/account/AccountConsole.java

ClientModel referrerClient = realm.getClientByClientId(referrer); if (referrerClient != null) { if (referrerUri != null) { referrerUri = RedirectUtils.verifyRedirectUri(session, referrerUri, referrerClient); } else { referrerUri = ResolveRelative.resolveRelativeUri(session, client.getRootUrl(), referrerClient.getBaseUrl()); }

[mposolda]

@Lunkwill-Fook yes, see the linked PR for the details #17338