Repository navigation
IDP-only login #27254
Replies: 1 comment 11 replies
|
take a look at how to configure the default IDP https://www.keycloak.org/docs/latest/server_admin/#default_identity_provider basically, open the settings for "identity provider redirector" and put the id of the configured identity provider. |
|
Thanks for your reply @weltonrodrigo . So, customizing keycloak is the only option even if just using single IDP? |
|
@rapatel9 as long as I know, yes. You can either have a form (username only or username + password) with a button to login with IDP, or have automatic IDP redirect. You can customize a theme to have only a button to IDP. But, it's much simpler to configure the IDP redirection (ie: no form) and just change the login action in your app to "Sign-in with google". For the user, all it knows is that you send her to google, no keycloak involved. |
|
Thanks @weltonrodrigo. |
|
but this make logout impossible if we configure IDP redirection with default IDP in the vrowser flow... |
Uh oh!
There was an error while loading. Please reload this page.
Hello, I'm trying to configure Keycloak v23.0.6 to work with only IDP providers, which are already configured and tested. I've turned off manual registration, set first-login-broker flows for IDPs, turned of "Email as username" etc.
However, it appears problematic to set up the login page correctly.
I've tried many variations of those settings for browser flow:
But the result is exactly the same, instead of login page there's an error:
Additionally, I've tried with custom registration flow like this:
Docker logs ("invalid_user_credentials"):
2024-02-23 02:55:19,634 WARN [org.keycloak.events] (executor-thread-437) type="LOGIN_ERROR", realmId="592fe5ed-ff7a-4f62-8063-c8f917efa564", clientId="clientId", userId="null", ipAddress="172.17.0.1", error="invalid_user_credentials", auth_method="openid-connect", auth_type="code", response_type="code", redirect_uri="http://127.0.0.1:4200/", code_id="bb4b28cc-8e56-42a1-a4d3-5892266a3cbd", response_mode="fragment"2024-02-23 03:06:02,720 WARN [org.keycloak.services] (executor-thread-437) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException
at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1036)
at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:885)
at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:153)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:337)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:202)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:113)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint$quarkusrestinvoker$buildGet_4b690b27439f19dd29733dc5fd4004f24de0adb6.invoke(Unknown Source)
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:840)
2024-02-23 03:06:02,723 WARN [org.keycloak.events] (executor-thread-437) type="LOGIN_ERROR", realmId="592fe5ed-ff7a-4f62-8063-c8f917efa564", clientId="clientId", userId="null", ipAddress="172.17.0.1", error="invalid_user_credentials", auth_method="openid-connect", auth_type="code", response_type="code", redirect_uri="http://127.0.0.1:4200/", code_id="bb4b28cc-8e56-42a1-a4d3-5892266a3cbd", response_mode="fragment"
2024-02-23 04:25:46,698 WARN [org.keycloak.events] (executor-thread-445) type="REFRESH_TOKEN_ERROR", realmId="e0c9b37e-df81-45db-82ab-0158aed6d624", clientId="security-admin-console", userId="null", ipAddress="172.17.0.1", error="invalid_token", grant_type="refresh_token", client_auth_method="client-secret"
I don't quite understand how this error comes up, no username or password were previously posted after all. Not a single login option appears. I've searched the web for similar issues and tried many configurations, but it's not even clear if I'm moving towards the goal or in the opposite direction, since result is always the same :(
How to approach it correctly?
Thanks in advance for any tips!
All reactions