Repository navigation
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
<
8000
div itemscope itemtype="http://schema.org/SoftwareSourceCode" class="">
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji
reacted with thumbs down emoji
reacted with laugh emoji
reacted with hooray emoji
reacted with confused emoji
reacted with heart emoji
reacted with rocket emoji
reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi there,
This affects Keycloak 16, not sure whether newer versions still have this problem.
I am trying to implement a forgot password flow through OIDC and I am having the following issue:
If a user loses their credentials due to cache reset or reinstallation of the app and they try to reset their password they get a "You are already logged in." Error message after clicking the password reset link in the email. At that point the user cannot do anything to progress with setting a new password and logging in.
Reproduction:
https://{DOM}/auth/realms/{REALM}/protocol/openid-connect/forgot-credentials?client_id={CLIENT}&redirect_uri={REDIR_URI}&response_type=code&scope=openid&login_hint={USERNAME}https://{DOM}/auth/realms/{REALM}/protocol/openid-connect/forgot-credentials?client_id={CLIENT}&redirect_uri={REDIR_URI}&response_type=code&scope=openid&login_hint={USERNAME}Now, one thing that I noticed is that Keycloak seems to create a client session with the user immediately after the password reset, even though the authorization code has not yet been exchanged for a token. If you delete that session in the admin console the "You are logged in" message disappears and you can proceed to reset your password for a second time. But still, I cannot seem to understand (and couldn't find anything in the docs) related to this limitation of having only one session going.
How can this behavior be changed? I am aware that Keycloak allows multiple sessions with the same client so this shouldn't be an issue. Right?
Also, is Keycloak correct in starting a session after the PW reset even though the authorization code has not been exchanged yet?
Kind regards,
Kiriakos
All reactions