Client Initiated Account Linking: API Call #44334

Excel1 · 2025-11-19T14:35:17Z

Excel1
Nov 19, 2025

I want to create a new account console based on vue.

The last feature i want to add is client initiated account linking.

https://www.keycloak.org/docs/latest/server_development/#client-initiated-account-linking

I read the documentation and build this function:

const  => {
  const baseUrl = import.meta.env.VITE_BASE_URL;
  const realm = import.meta.env.VITE_REALM;
  const clientId = import.meta.env.VITE_CLIENT_ID;
  const redirectUri = window.location.origin + '/linked-accounts';

  const url = new URL(`${baseUrl}/realms/${realm}/protocol/openid-connect/auth`);
  url.searchParams.set('client_id', clientId);
  url.searchParams.set('redirect_uri', redirectUri);
  url.searchParams.set('response_mode', 'query');
  url.searchParams.set('response_type', 'code');
  url.searchParams.set('scope', 'openid');
  url.searchParams.set('kc_action', 'idp_link:google');

  window.open(url.toString(), '_self');
};

But this doesnt work. Keycloak throws.
2025-11-19 14:16:50,500 WARN [org.keycloak.services.managers.AuthenticationManager] (executor-thread-52) Could not find configuration for Required Action idp_link, did you forget to register it?

I checked realm > authentication > required actions and yes, this option doesnt exists. Is this a bug? Do i need to add it manually and how?

On the other Hand the current account-console uses the legacy adapter but this doesnt work either:

const base64UrlEncode = (arrayBuffer: Uint8Array) => {
  let str = '';
  for (const byte of arrayBuffer) {
    str += String.fromCharCode(byte);
  }
  return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
};

const  (provider: string) => {
  const baseUrl = import.meta.env.VITE_BASE_URL;
  const realm = import.meta.env.VITE_REALM;
  const clientId = import.meta.env.VITE_CLIENT_ID;
  
  const authService = useAuthService();
  const token = await authService.getUserSession();
  const sessionState = token.session_state;
  const issuedFor = clientId;

  const nonce = uuidv4();
  
  const hashInput = nonce + sessionState + issuedFor + provider;
  const hashBuffer = await crypto.subtle.digest(
    "SHA-256",
    new TextEncoder().encode(hashInput)
  );
  const hashArray = new Uint8Array(hashBuffer);
  const hash = base64UrlEncode(hashArray);

  const redirectUri = `${window.location.origin}/account/linked`;

  const url = new URL(`${baseUrl}/realms/${realm}/broker/${provider}/link`);
  url.searchParams.set('client_id', clientId);
  url.searchParams.set('redirect_uri', redirectUri);
  url.searchParams.set('nonce', nonce);
  url.searchParams.set('hash', hash);
  
  window.location.assign(url.toString());
};

also legacy is not what i want to use.

Answered by Excel1

Nov 19, 2025

In Keycloak 26 it exists.

View full answer

Excel1 · 2025-11-19T16:16:19Z

Excel1
Nov 19, 2025
Author

In Keycloak 26 it exists.

0 replies

Navigation Menu

Repository navigation

Client Initiated Account Linking: API Call #44334

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Client Initiated Account Linking: API Call #44334

Uh oh!

Excel1 Nov 19, 2025

Replies: 1 comment

Uh oh!

Excel1 Nov 19, 2025 Author

Excel1
Nov 19, 2025

Excel1
Nov 19, 2025
Author