Repository navigation
Conditional Trust Email for OIDC, Google and GitLab Identity Provider #8622
Replies: 5 comments 2 replies
|
This is a perfectly valid use-case, so discussion is more around how to implement it, which we can talk about through the PR. |
|
I see that you have closed jira issue for this needed extension for emailVerified. Based on your and @mposolda comment in the PR, I have extended Attribute mappers ( OIDC, SAML , Social) for supporting emailVerified user field in this branch. I propose to write a more suitable github issue based on new implementation( emailVerified enhancement in SAML, OIDC, Social Attribe mapper) and create a new PR keeping relation with old jira issue and old PR. @stianst @mposolda do you agree? Could you review the new PR whenever possible? |
|
This should really be supported |
|
Any updates on this? Would be great to hear an opinion from the project maintainers. I see this as a big shortcoming when dealing with many idp dynamically. |
|
I also want to enable the logic, where keycloak email check is skipped only if IdP says email_verified: true. I see that the discussion on adding "Conditional skip email verification" option, ended with no conclusion. Does anyone know if there's currently a workaround for this? Maybe some custom SPI code? |
|
Ended up putting together a custom mapper because the discord social IDP plugin was only going to let me import/hardcode attributes. From what I can see it shouldn't require too much to have the functionality moved into either the social IDP plugin itself or the generic OIDC. |
|
I might actually as an LLM to just write the whole project based on some other simple plugins from github. |
Uh oh!
There was an error while loading. Please reload this page.
Keycloak already supports skipping email verification for all users registering from a specific IdP by enabling the "Trust email" configuration option for that IdP. However, there is no support for conditionally skipping email verification for a given IdP based on the email information released during registration. Specifically, it should be possible to skip the verification process if the user's authenticating IdP releases an already verified email address. In the case of OpenID Connect Providers , Google and GitLab this can be determined based on the availability of the email claim combined with an email_verified claim set to true (defined in the standard OIDC claims). Maybe other Social Identity Providers have the same - or similar- functionality.
Could you review the related PR in order to add these functionality to Keycloak?
More information can be found to related jira issue.
All reactions