Repository navigation
Add "User Session Note" idp mapper #14607
Replies: 4 comments 2 replies
|
@artur-baltabayev Sounds pretty reasonable to me. Just go ahead and file issue/PR. |
|
Could you explain the use-case here? In general Keycloak tries to avoid clients needing to understand the external IdPs, so a client only needs to be able to understand how to interact with Keycloak, not understand claims/etc coming from an external IdP. |
|
@stianst The use-case here is specifically about the acr/amr claims. Our customer has a application, that wants to know if the user used MFA (in the external IdP). So the idea here is to inject the claims into the client access token through mappers. |
|
It's a setup where the client application needs to ensure MFA on some operations for compliance reasons. Some users will use one IdP which has an MFA option for these users while other users will use another IdP withou MFA option. |
|
Another use case for this is storing user information from the IDP that should disappear with the user session, e.g. sensitive information that should only be stored as long as necessary in the broker (ie. must be removed as soon as the session expires). While this is likely something that can be implemented as a custom IdP mapper, it'd be good for Keycloak to support this scenario out of the box. |
Uh oh!
There was an error while loading. Please reload this page.
One of our customers wants to include a claim value from an external idp into their client access token.
Currently the only way to do this is via user attributes (i.e defining a "Attribute Importer" idp mapper and a "User Attribute" client mapper). However the preferred way of doing this would be through user session notes. We noticed that there already is a "User Session Note" client mapper and would like to include the same as a idp mapper.
What do you think about this ?
Any feedback is greatly appreciated.
All reactions