You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Our realm brokers for a few different external identity providers. Each provider returns at minimum the user's email address, and I'd like to use that as an identifier for the user, in the applications I'm protecting. If I understand correctly what's going on, when a user from one of these providers logs in for the first time, Keycloak sends them through its "first broker login" authentication flow, prompting the user to enter things like first name, last name, and email address for the account Keycloak will create and link with that identity on that external provider. Here, the user has the opportunity to enter whatever email address they want, including that of some wholly different user. I know I can use mappers for each identity provider to map the attributes they provide to attributes in the Keycloak linked account, but I'd like to prevent the user from being able to modify their email address from what the original identity provider gives.
So what's the right way to do this? I'm pretty sure I can use a custom authentication flow, that doesn't give the user the opportunity to update their linked account, and I imagine there's some way I can query Keycloak from my application to fetch user details and find the original email there. The former seems far easier than the latter, but is there some better option I'm not seeing? Have I gotten a completely wrong idea of how this should work?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Our realm brokers for a few different external identity providers. Each provider returns at minimum the user's email address, and I'd like to use that as an identifier for the user, in the applications I'm protecting. If I understand correctly what's going on, when a user from one of these providers logs in for the first time, Keycloak sends them through its "first broker login" authentication flow, prompting the user to enter things like first name, last name, and email address for the account Keycloak will create and link with that identity on that external provider. Here, the user has the opportunity to enter whatever email address they want, including that of some wholly different user. I know I can use mappers for each identity provider to map the attributes they provide to attributes in the Keycloak linked account, but I'd like to prevent the user from being able to modify their email address from what the original identity provider gives.
So what's the right way to do this? I'm pretty sure I can use a custom authentication flow, that doesn't give the user the opportunity to update their linked account, and I imagine there's some way I can query Keycloak from my application to fetch user details and find the original email there. The former seems far easier than the latter, but is there some better option I'm not seeing? Have I gotten a completely wrong idea of how this should work?
All reactions