Repository navigation
Replies: 1 comment 1 reply
|
Perhaps with sufficient mappers in the identity broker, I can populate all the necessary attributes from the external IdP, or even from the record I'll need to have already in the application database, and adjust the flow to not allow the user to modify the results. |
1 reply
|
Or not. That's something that lives in the Keycloak SAML adapter, which I'm not using -- unless Keycloak uses it internally when it brokers identities with SAML IdPs... |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
In my scenario, Keycloak acts as an identity broker for users from several different organizations, with several different authentication systems. Users select the proper authenticator on keycloak's login page, as expected. The first time a user logs in, Keycloak goes through the "first broker login" flow, which prompts the user to enter email address and first and last name, and shows in a read-only text box a new random string generated by keycloak to refer to this user.
These boxes for email address, and first and last name, are empty, even though Keycloak already knows that information from the authenticator the user selected. Moreover, the user can actually put whatever he or she wants in those boxes. Worse, my application, which talks to Keycloak with OpenID Connect, needs the email address given by Keycloak to correspond to the authenticated user, so since a first-time user can enter whatever email address he or she wants, it's possible for this user to impersonate any other user by entering that other user's email address in the "first broker login" box.
I'm confident I'm doing something wrong, but I'm not sure what it is. All help is appreciated.
All reactions