You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Keycloak - browser login flow with step-up mechanism for external IDP users
#38071
We are using Keycloak 21.1 version. I'm struggling to implement the below use case,
User successfully logged in with external IDP (OpenID) and executed First Broker Login flow to link an existing Keycloak account. Client Application is having restriction some of the UI screen without higher permission. We have implemented browser login flow with step-up mechanism. Client application re-authenticate with Keycloak with acr_values as 2 - OTP Form.
If user is log-in with keycloak user name and password, its correctly re-direct to OTP form. But when the user is login with external IDP, its again route to login page instead of OTP form page.
I can see the below error in keycloak log,
2025-03-08 16:05:07,049 TRACE [org.keycloak.authentication.authenticators.conditional.ConditionalLoaAuthenticator] (executor-thread-21) Condition 'Level 1' evaluated to true due the user not yet reached any authentication level in this session, configuredLoa: 1, requestedLoa: 2
Client application is restricted only some of the UI screens. So User should configure OTP to access only those pages. User can login without OTP to verify remaining screens.
User is using keycloak user name and password, its working fine. But external IDP users - its not working.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
We are using Keycloak 21.1 version. I'm struggling to implement the below use case,
User successfully logged in with external IDP (OpenID) and executed First Broker Login flow to link an existing Keycloak account. Client Application is having restriction some of the UI screen without higher permission. We have implemented browser login flow with step-up mechanism. Client application re-authenticate with Keycloak with acr_values as 2 - OTP Form.
If user is log-in with keycloak user name and password, its correctly re-direct to OTP form. But when the user is login with external IDP, its again route to login page instead of OTP form page.
I can see the below error in keycloak log,
2025-03-08 16:05:07,049 TRACE [org.keycloak.authentication.authenticators.conditional.ConditionalLoaAuthenticator] (executor-thread-21) Condition 'Level 1' evaluated to true due the user not yet reached any authentication level in this session, configuredLoa: 1, requestedLoa: 2
Client application is restricted only some of the UI screens. So User should configure OTP to access only those pages. User can login without OTP to verify remaining screens.
User is using keycloak user name and password, its working fine. But external IDP users - its not working.
All reactions