Repository navigation
Replies: 1 comment 8 replies
|
Have you tried implementing a OIDC Protocol Mapper? That would've been our approach but we're currently blocked by other issues. |
|
Yeah, I will try to open source this but will have to discuss this internally where and how this is gonna happen. |
|
Working PoC https://gist.github.com/kodebach/f00fcb8652a08c497ebf93164c1e6ac6 (only tested with Keycloak 26.4.2 for now, we haven't yet deployed 26.5 anywhere I could connect ID Austria) Not sure, if overriding Token exchange is disabled, but might work with additional/different overrides to fix the ID in other places. |
|
Thanks! I'll test this tomorrow on 26.5 :) |
|
Quick update: Works on 26.5.2, I'm currently writing integrations tests for this using a keycloak testcontainer. |
|
@simonnepomuk Any news on a shared open source implementation? |
Uh oh!
There was an error while loading. Please reload this page.
We need to integrate an OIDC identity provider that doesn't provide a stable
subclaim. Specifically we're talking about ID Austria the Austrian node of the EU's eIDAS system.The
subclaim they provide is a transient ID and changes with every authentication. The stable user ID is instead provided asurn:pvpgvat:oidc.bpk. Assuming they never reuse asub(*) this changing ID would still fulfil the OIDC spec requirement:(*) seems plausible, they use 32 character strings that look like base32, which would be 160 bits, so it cloud just be a new random ID every time
If we create an OIDC identity provider, every authentication will be treated as a first login, because the
subclaim doesn't match any existing value.With a OAuth 2.0 identity provider we could configure the ID claim, but ID Austria also doesn't provide a User Info Endpoint, so that's also no good.
Is there any way to achieve this in the current version of Keycloak?
If not, would it be possible to make the ID claim for OIDC providers configurable? Or alternatively to allow OAuth 2.0 identity providers using
id_tokens instead of a User Info Endpoint?All reactions