Account registration still depends on a Keycloak-only endpoint #108

New Issue

2026-09-21T07:18:32Z

cgalo5758 commented

2026-09-21 07:18:32 +00:00

What a person cannot do today

Run the console against an OpenID Connect provider other than Keycloak and offer a "create an account" link that works. Sign-in, sign-out and token revocation already use the endpoints the provider advertises in its discovery document, so they work with any provider. Registration does not: the console sends people to Keycloak's own registration path, which has no equivalent in the OpenID Connect standard.

What they should be able to do

Configure registration for whatever their provider offers: a provider-specific registration URL when one exists, or no registration link at all when the provider handles sign-up on its own login page.

Why it matters

The console is meant to run against any provider. Registration is the one remaining place where it only runs against one.

Where

internal/auth, the registration redirect.

Done when

The registration URL is a configuration value with no Keycloak default, the sign-in page shows the link only when it is set, and the identity-provider setup doc says so.

Migrated from status/issues.md at b7a0e15

## What a person cannot do today Run the console against an OpenID Connect provider other than Keycloak and offer a "create an account" link that works. Sign-in, sign-out and token revocation already use the endpoints the provider advertises in its discovery document, so they work with any provider. Registration does not: the console sends people to Keycloak's own registration path, which has no equivalent in the OpenID Connect standard. ## What they should be able to do Configure registration for whatever their provider offers: a provider-specific registration URL when one exists, or no registration link at all when the provider handles sign-up on its own login page. ## Why it matters The console is meant to run against any provider. Registration is the one remaining place where it only runs against one. ## Where [`internal/auth`](https://git.coopcloud.tech/wiki-cafe/member-console/src/commit/b7a0e15/internal/auth), the registration redirect. ## Done when The registration URL is a configuration value with no Keycloak default, the sign-in page shows the link only when it is set, and the identity-provider setup doc says so. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

enhancement

area/identity labels 2026-09-21 07:18:32 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#108