Repository navigation
Replies: 5 comments 3 replies
|
Hello everyone, I'm trying to achieve the same thing, ie: disable local login for users who have an identity linked to their account but continue to allow local users (who have no identity linked) to login with a username/password. Is there a simple way to do it for now ? |
|
One way to achive this is to use an "Identifer First" Login Flow, where you ask your users for their username/email in a first step. If you want to support multiple Identity providers, you need a mechanism to determine the "home" realm for a user or present an narrowed down IdP selection. The home IdP could be derived from metadata added to the IdP, e.g. an regex of allowed email domains. Some extension examples which might help you: |
|
Thank you, I will take a look ASAP ! |
|
Hi @drbng, I finally managed to realize this, here’s how I did it:
Note that I also tried the keycloak-home-idp-discovery plugin (which is quite great) as @thomasdarimont suggested, but I will not use it as the solution above suits well for my use case and I don't want to bother with third-party extensions. |
|
With this approach, isn't it still possible for a user to unlink the IdP from the account (via the account management), and set a password. That way, a user can 'convert' the IdP based account to a local KeyCloak account. |
|
Yes, a user can unlink an identity from his account via the console, and then use a username/password couple. |
|
Hello,
Thank you very much, it is really helpful !
I will do the same
Le ven. 1 mars 2024 à 09:46, vhash ***@***.***> a écrit :
… Hi @drbng <https://github.com/drbng>, I finally managed to realize this,
here’s how I did it:
-
I created a realm_role named "brokered_identity", it will be assigned
to each user who linked his account to an external identity
-
I created an Identity Provider Mapper that assigns this role :
image.png (view on web)
<https://github.com/keycloak/keycloak/assets/29121316/7d52d457-3cd8-4739-961c-ec75f189bb77>
-
I modified the authentication flow by browser to check that a user
connecting via the login/password form does not have this role :
image.png (view on web)
<https://github.com/keycloak/keycloak/assets/29121316/dec83de9-1cd4-4572-acda-92202b437a94>
------------------------------
Note that I also tried the keycloak-home-idp-discovery
<https://github.com/sventorben/keycloak-home-idp-discovery> plugin (which
is quite great) as @thomasdarimont <https://github.com/thomasdarimont>
suggested, but I will not use it as the solution above suits well for my
use case and I don't want to bother with third-party extensions.
—
Reply to this email directly, view it on GitHub
<#24229 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A3SLP4Z45FCE5T2Y4WQ73TTYWCPF5AVCNFSM6AAAAAA6MRETDCVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DMNBUG4YDK>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
What seems to have been an acceptable work around here by blocking sign in with a password still leaves some edge case issues for me. I put more information on #27152 but tldr is that letting the user set a password can override the automatic redirect specified on an organization idp, and without allowing the idp to be shown on the login page, the user has no way to login. |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I would like to know how can I disabled the standard authentication (login/password) for all users that are linked to an Identity Provider
example:
In the filed Identity provider links:
These kind of users have to be authenticated through Single Sign On method and I wish to disable the login/Password authentication on my keycloak 21 version. With the old keycloak version, I was allowed to disable the credential method example:
With the new version I can't see the disable option example:
Thank you,
All reactions