You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
The meaning of ALTERNATIVE requirement option for ValidatePassword
#39716
Hi everyone! I am trying to implement the following auth scheme:
sub-flow - alternative
|- step1 - required
_ step2 - required
sub-flow - alternative
|- step3 - required
_ step4 - required
I am using only POST /realms/{realm}/protocol/openid-connect/token endpoint to process auth and get token. so no UI on the client side. And researching the keycloak source code I see that the requirement option ALTERNATIVE almost does not have any sense, because if the authenticator/provider does not return attempted() status on failed attempt then no one following sub-flow will not execute because the keycloak return a failed response. the code in org.keycloak.authentication.DefaultAuthenticationFlow#processFlow():
if (requiredList.isEmpty()) {
//check if an alternative is already successful, in case we are returning in the flow after an action
if (alternativeList.stream().anyMatch(alternative -> processor.isSuccessful(alternative) || isSetupRequired(alternative))) {
return onFlowExecutionsSuccessful();
}
//handle alternative elements: the first alternative element to be satisfied is enough
for (AuthenticationExecutionModel alternative : alternativeList) {
try {
Response response = processSingleFlowExecutionModel(alternative, true);
if (response != null) {
return response;
}
if (processor.isSuccessful(alternative) || isSetupRequired(alternative)) {
return onFlowExecutionsSuccessful();
}
} catch (AuthenticationFlowException afe) {
//consuming the error is not good here from an administrative point of view, but the user, since he has alternatives, should be able to go to another alternative and continue
afeList.add(afe);
setExecutionStatus(alternative, AuthenticationSessionModel.ExecutionStatus.ATTEMPTED);
}
}
} else {
if (requiredElementsSuccessful) {
return onFlowExecutionsSuccessful();
}
}
so the question is: how exactly to use the ALTERNATIVE correctly to achieve behavior I want (I want keycloak goes sub-flow by sub-flow until any success). and why some built-in authenticators that do not support attempted(), like org.keycloak.authentication.authenticators.directgrant.ValidatePassword, have ALL requirement options, while org.keycloak.authentication.authenticators.directgrant.ValidateUsername has only REQUIRED (which is correct in fact).
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi everyone! I am trying to implement the following auth scheme:
sub-flow - alternative
|- step1 - required
_ step2 - required
sub-flow - alternative
|- step3 - required
_ step4 - required
I am using only POST /realms/{realm}/protocol/openid-connect/token endpoint to process auth and get token. so no UI on the client side. And researching the keycloak source code I see that the requirement option ALTERNATIVE almost does not have any sense, because if the authenticator/provider does not return attempted() status on failed attempt then no one following sub-flow will not execute because the keycloak return a failed response. the code in org.keycloak.authentication.DefaultAuthenticationFlow#processFlow():
so the question is: how exactly to use the ALTERNATIVE correctly to achieve behavior I want (I want keycloak goes sub-flow by sub-flow until any success). and why some built-in authenticators that do not support attempted(), like org.keycloak.authentication.authenticators.directgrant.ValidatePassword, have ALL requirement options, while org.keycloak.authentication.authenticators.directgrant.ValidateUsername has only REQUIRED (which is correct in fact).
All reactions