Repository navigation
Problem: IdP account linking stuck with no error when the existing local account is disabled #51046
|
Context I use an external IdP for domain-based SSO (Organization, domain orga.com). The Keycloak login page is skipped entirely: we pass When a user logs in through this IdP and a local account already exists with the same email, the First Broker Login flow offers to link the two accounts by email (the Verify Existing Account by Email step). What works For an enabled account: everything works, the linking email is sent and the account is linked. The problem When the existing local account is disabled (
Note that because of the My questions
Environment
Thank you for your help |
Replies: 1 comment 1 reply
|
Refusing to link a disabled account is intended, but in the default First Broker Login flow it fails without telling the user. The logic is the same in 26.4.2 and 26.8:
So the page the user ends up on is most likely the re-authentication form rather than an error page. There is no stock authenticator or condition that checks the existing user's enabled flag (the conditional authenticators in 26.8 cover client scope, credential, LoA, role, sub-flow executed, user attribute and user configured). To show a clear message you would need a small custom authenticator as a required step in the "Handle Existing Account" subflow, ahead of "Account verification options". If it returns a failure challenge with the account-disabled message, the flow sends that page to the user, because challenges aren't consumed the way exceptions are. |
|
If this explains what you saw when linking with the disabled account, could you mark the answer as accepted? That helps others who hit the same silent failure find it. |
Refusing to link a disabled account is intended, but in the default First Broker Login flow it fails without telling the user. The logic is the same in 26.4.2 and 26.8:
IdpEmailVerificationAuthenticatorcallsAbstractIdpAuthenticator.getExistingUser(), which throws anAuthenticationFlowExceptionwithUSER_DISABLEDfor a disabled account. That happens before any mail is sent.DefaultAuthenticationFlowcatches exceptions thrown by ALTERNATIVE executions, marks the execution as attempted and moves on to the next alternative.IdpUsernameP…