Repository navigation
Enable use of kc_idp_hint in Pushed Authorization Requests. - #47244
Conversation
The client can select which Identity Provider to use for user authentication by including an Identity Provider alias in a "kc_idp_hint" parameter in a Pushed Authorization Request. Closes keycloak#47229 Signed-off-by: Laurids Møller Jepsen <laurids.jepsen@cryptomathic.com>
|
Can the @keycloak/core-clients team please have a look? |
There was a problem hiding this comment.
Tested branch locally with google idp and worked as expected. More in comments on issue.
|
Thanks for putting this together, @laurids! It worked well. I pulled down this branch and ran a full end-to-end manual test locally, and it works exactly as described. The kc_idp_hint successfully bypasses the Keycloak login screen when passed through the PAR back-channel. LGTM! Testing Details Setup: Local build of issue-47229, configured a test realm, a confidential client, and an external Google Identity Provider (IdP) with the alias google. Action: Pushed an authorization request to the /ext/par/request endpoint containing kc_idp_hint=google, retrieved the request_uri, and navigated to the /auth endpoint in a clean browser session. Result: Successfully bypassed the standard Keycloak authentication selection screen and was routed directly to the Google IdP login page. Following external authentication, successfully redirected back to the target application URI as an authenticated user. |
There was a problem hiding this comment.
@laurids @msdaly200 Thanks for the PR and additional review!
Closes keycloak#49255 Based on keycloak#47244 Signed-off-by: Vilmos Nagy <me@vnagy.eu>
The client can select which Identity Provider to use for user authentication by including an Identity Provider alias in a "kc_idp_hint" parameter in a Pushed Authorization Request.
Closes #47229