Repository navigation
Handling redirect when DigiD login is cancelled #10
Description
Hi,
I have a question regarding the Extended SAML IDP plugin when used with DigiD.
Is it currently possible to configure a redirect URL for the scenario where a user cancels the login process in DigiD?
In other words:
The user is redirected to DigiD
The user clicks “cancel”
Can we control where the user is redirected afterwards?
If this functionality is already available, I was unable to find how to configure it in the current documentation. Could you point me in the right direction?
If it is not yet supported, this would be a valuable feature for our use case, as it is required by Logius.
Thanks in advance!
As an additional note: I have already created a proof of concept plugin that implements this functionality on our side.
This solution would need to be integrated into the Extended SAML IDP plugin to make it generally available.
If helpful, I’d be happy to share the code or discuss the approach.
Activity
at-first8 commentedon Apr 9, 2026
Hi Dpragt,
Thank you for your question. Our short answer is:
No, it is currently not possible to configure a custom redirect URL when a user cancels the login at DigiD.
The limited cancel options that exist are handled at the broker level, not inside the plugin or Keycloak core.
Your use case (required by Logius) is clear and valuable.
We'd be happy to integrate your proof-of-concept. Could you share the code or open a feature request with the details? A clean configuration option for the cancel redirect would be a welcome addition.
Looking forward to your PoC or PR.
First8#10 Handling redirect when DigiD login is cancelled
Dpragt commentedon Apr 13, 2026
Hi @at-first8 ,
I’ve prepared a PR. #11
One of the unit tests is currently failing, which I suspect is related to the latest version update.
Happy to get your feedback on the PR.
For our use case, the solution is already working as expected.
Best regards,
Daniël Pragt
at-first8 commentedon Apr 16, 2026
Hi Daniël,
Thank you for submitting your PR, here is a brief intermediary update. We have taken a brief look at it and a first scan of the code is very positive. The code is neat, looks safe, has safeguards and if it works it is of real value for everyone who uses DigiD.
Something we would love to add is the ability to influence the HTTP Method for the redirect. But we currently believe that is infeasible, because it is handled at a level in keycloak that is not pluggable.
We will do a proper review soon.
0314R commentedon May 27, 2026
Hello @Dpragt ,
I wonder: Did you have a particular reason that the callback URL needs to be a relative path from the Keycloak host? What Keycloak endpoint do you think makes sense here?
I would think that a client endpoint would be preferable, but the client often doesn't have the same host as Keycloak. So it would be preferable to set the entire URL for your new variables, not just a relative path.
Dpragt commentedon May 29, 2026
Hi @0314R ,
The main reason I chose a relative path is that I was under the impression that for DigiD, the Keycloak host and the client would need to run under the same base URL. That is also how I implemented and tested it for our use case.
If it is also valid to use a completely separate callback URL, I agree that supporting a full URL would be useful. In that case, I would suggest adding it as a separate configuration option, for example:
cancelledCallbackUrlThis would make the distinction clear between a relative redirect path and an absolute external/client callback URL.
Happy to adjust the PR in that direction if that fits the intended design better.
0314R commentedon Jun 1, 2026
Hi @Dpragt, glad you agree. I think you described a good alternative, it would be nice if you could make that adjustment.
0314R commentedon Jul 22, 2026
Thank you @Dpragt , it looks really good now so I merged the PR.
I'll be making a different PR for the frontend changes myself, I'll let you know here when it's done.
0314R commentedon Jul 23, 2026
@Dpragt the frontend now allows changing your new fields:
If the toggle is turned off, the two fields below it are hidden.
I'll close the issue soon, thanks again for the nifty feature.