You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Should login_hint work with a SAML authorize request?
#49907
In Keycloak's SAML flow, a plain login_hint query parameter beside SAMLRequest is not what fills the username field.
The confusing bit is that the name is shared with OIDC behavior. In the OIDC authorization endpoint, login_hint is parsed as an authorization request parameter and copied into the authentication session. The SAML path is different: Keycloak decodes the SAMLRequest and builds the SAML auth session from that request. The comparable login-hint note appears to be set from a Subject/NameID inside the SAML AuthnRequest, not from the outer URL qu
8000
ery string in the same way as OIDC.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I'm currently running on 26.3.0 and I'm trying to pre-populate the username field when making a SAML authorization request e.g.
I'm having passport append the
login_hintquery parameter but the username box stays empty.The docs only mention
login_hintin the openID section so is this not something supported when acting as a SAML endpoint?Have I missed something in the config or is this fixed in a later release?
All reactions
Replies: 1 comment
Uh oh!
There was an error while loading. Please reload this page.
In Keycloak's SAML flow, a plain
login_hintquery parameter besideSAMLRequestis not what fills the username field.The confusing bit is that the name is shared with OIDC behavior. In the OIDC authorization endpoint,
login_hintis parsed as an authorization request parameter and copied into the authentication session. The SAML path is different: Keycloak decodes theSAMLRequestand builds the SAML auth session from that request. The comparable login-hint note appears to be set from aSubject/NameIDinside the SAMLAuthnRequest, not from the outer URL qu 8000 ery string in the same way as OIDC.So with a URL like:
I would not expect Keycloak 26.3.0 to pre-fill the username field from that last parameter.
The practical choices are:
AuthnRequestsubject/name ID;login_hintquery-parameter behavior is required, use an OIDC client for this login path;kc_idp_hintis separate: it hints which identity provider to use, but it should not be expected to pre-populate the username field.If that matches your test result, selecting an answer here would make the SAML/OIDC distinction easier to find later.
All reactions