Repository navigation
Replies: 1 comment 2 replies
|
One step closer: By setting It seems that passive authentication is only supported for OIDC->OIDC, ie. when a OIDC client authenticates through an OIDC IDP. As soon as SAML gets in the mix (either as a client or IDP) passive authentication is no longer forwarded. I'd argue that this is because the concept of passive authentication is not abstracted in Keycloak. Instead, code is currently tightly coupled with the OIDC "prompt" concept:
I can't easily modify this in my deployment of Keycloak (in a custom IDP implementation) without copy/pasting the entire "performLogin" method from SAMLIdentityProvider into a subclass thereof. So a tiny bit of refactoring of "performLogin" would be nice, too. |
|
A bit of testing reveals that if I modify the SAMLIdentityProvider to forward the authentication request as passive, an existing session with the IDP will be picked up correctly and the user is signed in. However, the handleLoginResponse of SAMLEndpoint.Binding class does not check for NoPassive errors and thus does not provide an error message that allows for correct handling further out, if user is not logged in at the IDP. Specifically, IdentityBrokerService expects error message to be one of "interaction_required" or "login_required". If that's the case, it will respond to the OIDC client correctly, I think. Currently, the Keycloak login page (HTML page containing an error message) is returned to the OIDC client (ie. the iframe that performs the silent login) which naturally is not understood by the client library (e.g. oidc-client-ts). |
|
Relevant: #41531 |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
(Keycloak version 26.3.2)
During a prompt=none OIDC auth request, I'd like Keycloak to redirect to a SAML IDP with an IsPassive=true AuthnRequest to check whether user has an active session with the IDP.
This does not seem to be supported, and I'm trying to figure out how to implement it without too much effort.
In KEYCLOAK-8043 this was implemented for OIDC IDPs it seems, but not for SAML.
Currently, IdentityProviderAuthenticator notices the prompt=none request, and logs a message saying that it will redirect to the SAML IDP - this does not happen, however, which is misleading.
Also IdentityProviderAuthenticator checks for ACCEPTS_PROMPT_NONE ("acceptsPromptNoneForwardFromClient") which, as far as I can tell, is not configurable anywhere and thus the FORWARDED_PASSIVE_LOGIN auth note is never set.
Any ideas where would be the best place to start tinkering?
By the way, I think it would be ideal if Keycloak supported this out of the box.
I may post this as a feature request later, but in the short term, I'd like to see if I can fix it locally.Edit: I moved this discussion to "Ideas" since this should be fairly simple to implement.All reactions