Handling redirect when DigiD login is cancelled

[Dpragt]

Hi,

I have a question regarding the Extended SAML IDP plugin when used with DigiD.

Is it currently possible to configure a redirect URL for the scenario where a user cancels the login process in DigiD?

In other words:

The user is redirected to DigiD
The user clicks “cancel”
Can we control where the user is redirected afterwards?

If this functionality is already available, I was unable to find how to configure it in the current documentation. Could you point me in the right direction?

If it is not yet supported, this would be a valuable feature for our use case, as it is required by Logius.

Thanks in advance!

As an additional note: I have already created a proof of concept plugin that implements this functionality on our side.

This solution would need to be integrated into the Extended SAML IDP plugin to make it generally available.

If helpful, I’d be happy to share the code or discuss the approach.

[at-first8]

Hi Dpragt,

Thank you for your question. Our short answer is:
No, it is currently not possible to configure a custom redirect URL when a user cancels the login at DigiD.
The limited cancel options that exist are handled at the broker level, not inside the plugin or Keycloak core.

Your use case (required by Logius) is clear and valuable.
We'd be happy to integrate your proof-of-concept. Could you share the code or open a feature request with the details? A clean configuration option for the cancel redirect would be a welcome addition.
Looking forward to your PoC or PR.

[Dpragt]

Hi @at-first8 ,

I’ve prepared a PR. #11
One of the unit tests is currently failing, which I suspect is related to the latest version update.
Happy to get your feedback on the PR.
For our use case, the solution is already working as expected.

Best regards,
Daniël Pragt

[at-first8]

Hi Daniël,

Thank you for submitting your PR, here is a brief intermediary update. We have taken a brief look at it and a first scan of the code is very positive. The code is neat, looks safe, has safeguards and if it works it is of real value for everyone who uses DigiD.

Something we would love to add is the ability to influence the HTTP Method for the redirect. But we currently believe that is infeasible, because it is handled at a level in keycloak that is not pluggable.

We will do a proper review soon.

[0314R]

Hello @Dpragt ,
I wonder: Did you have a particular reason that the callback URL needs to be a relative path from the Keycloak host? What Keycloak endpoint do you think makes sense here?

I would think that a client endpoint would be preferable, but the client often doesn't have the same host as Keycloak. So it would be preferable to set the entire URL for your new variables, not just a relative path.

[Dpragt]

Hi @0314R ,

The main reason I chose a relative path is that I was under the impression that for DigiD, the Keycloak host and the client would need to run under the same base URL. That is also how I implemented and tested it for our use case.

If it is also valid to use a completely separate callback URL, I agree that supporting a full URL would be useful. In that case, I would suggest adding it as a separate configuration option, for example:

cancelledCallbackUrl

This would make the distinction clear between a relative redirect path and an absolute external/client callback URL.

Happy to adjust the PR in that direction if that fits the intended design better.

[0314R]

Hi @Dpragt, glad you agree. I think you described a good alternative, it would be nice if you could make that adjustment.