[DX-2014] docs: add Keycloak worked example for issuing OAuth tokens via TIB - #2774
Open
sharadregoti wants to merge 10 commits into
Open
[DX-2014] docs: add Keycloak worked example for issuing OAuth tokens via TIB#2774sharadregoti wants to merge 10 commits into
sharadregoti wants to merge 10 commits into
probelabs / Visor: technical-accuracy
failed
Aug 27, 2026 in 36s
🚨 Check Failed
technical-accuracy check failed because fail_if condition was met.
Details
📊 Summary
- Total Issues: 4
- Error Issues: 2
- Warning Issues: 2
🔍 Failure Condition Results
Failed Conditions
- global_fail_if: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')
- Severity: ❌ error
Issues by Category
Security (1)
⚠️ api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx:190 - The example configuration for Keycloak integration useshttp://for sensitive redirect and callback URLs (lines 190, 202, 203, 230). This is insecure as it transmits data, potentially including authorization codes, in cleartext. It can also lead to redirect mismatch errors in environments with TLS termination.
Documentation (2)
- ❌ api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx:235 - The documentation for testing the Keycloak flow states that a successful login redirects with an
access_tokenin the URL fragment. This is only true ifIdentityHandlerConfig.OAuth.ResponseTypeis set totoken. Ifauthorization_codeis used, the redirect will contain a code, not a token. The example does not specify which response type to use, making the verification step misleading. ⚠️ api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx:223 - The note aboutNoRedirectadvises setting it explicitly but doesn't guide the user on what value to use for the current example. The test steps assume a browser redirect (NoRedirect: false), but a user could set it totruebased on the note, which would break the described test flow.
Logic (1)
- ❌ system:0 - Global failure condition met: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
probelabs / Visor: technical-accuracy
security Issue
The example configuration for Keycloak integration uses `http://` for sensitive redirect and callback URLs (lines 190, 202, 203, 230). This is insecure as it transmits data, potentially including authorization codes, in cleartext. It can also lead to redirect mismatch errors in environments with TLS termination.
Raw output
All example URLs that would be user-facing or involve authentication redirects should use `https://` to promote secure best practices. For example, change `http://{tib-host}` to `https://{tib-host}`.
probelabs / Visor: technical-accuracy
documentation Issue
The documentation for testing the Keycloak flow states that a successful login redirects with an `access_token` in the URL fragment. This is only true if `IdentityHandlerConfig.OAuth.ResponseType` is set to `token`. If `authorization_code` is used, the redirect will contain a code, not a token. The example does not specify which response type to use, making the verification step misleading.
Raw output
Clarify that the described outcome is for `ResponseType: token`. Either explicitly state that this example requires `ResponseType: token`, or document the alternative outcome for `ResponseType: authorization_code`. For example: "If `IdentityHandlerConfig.OAuth.ResponseType` is set to `token`, TIB redirects... with the Tyk access token... If you use `ResponseType: authorization_code`, the redirect will contain an authorization code that must be exchanged for a token."
probelabs / Visor: technical-accuracy
documentation Issue
The note about `NoRedirect` advises setting it explicitly but doesn't guide the user on what value to use for the current example. The test steps assume a browser redirect (`NoRedirect: false`), but a user could set it to `true` based on the note, which would break the described test flow.
Raw output
Update the note to explicitly recommend `NoRedirect: false` for this browser-based example, while still explaining the effect of setting it to `true`. For example: "For the browser-based flow in this example, set `IdentityHandlerConfig.OAuth.NoRedirect` to `false`. If you set it to `true`, TIB will return the token as JSON in the response body instead of redirecting. You should always set this field explicitly, as omitting it can cause TIB to fail to process the request."
Loading