Repository navigation
What is the recommended way to verify a user's brokered identity during step-up authentication? #52939
|
I am trying to understand how Keycloak is meant to handle step-up authentication using external IDPs. Specifically, I am looking at the following scenario:
My concern is that the standard IDP flow appears to establish only that a successful authentication took place at the external provider. What prevents a user from logging into Keycloak with a completely different password-based account, and then using that exact same brokered identity to fulfill the step-up requirement? Is there a native or recommended Keycloak mechanism to strictly enforce that the brokered identity matches the active Keycloak user's profile during this flow? |
Replies: 1 comment
|
Use an explicit federated-identity link, not profile-field comparison. Link the external account to the Keycloak user first (Account Console or client-initiated account linking). Keycloak then resolves the provider alias plus external subject to that local user. When authentication finishes into an existing session, Keycloak compares the newly authenticated user with the session user and rejects a mismatch with
For any extra policy, add a required Post Broker Login authenticator, but the identity check should still be based on the linked user ID, not mutable claims such as email. Mismatch check: https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1176-L1183 |
Use an explicit federated-identity link, not profile-field comparison. Link the external account to the Keycloak user first (Account Console or client-initiated account linking). Keycloak then resolves the provider alias plus external subject to that local user.
When authentication finishes into an existing session, Keycloak compares the newly authenticated user with the session user and rejects a mismatch with
DIFFERENT_USER_AUTHENTICATED. Therefore:For any ex…