[keycloak-dev] external token exchange - feedback needed
Bill Burke
bburke at redhat.com
Fri Sep 22 10:47:42 EDT 2017
Was thinking about this more... I'll have a switch "Allow Token Exchange"
I'll also define an import policy:
* EXISTING-ONLY - must match existing account. No link created. No import.
* IMPORT - may match existing account. Link is created/updated
* IMPORT-ONLY - must not match existing account unless previously
linked. Link is created/updated.
* UNIQUE_IMPORT - must not match existing account unless previously
imported. must create a username that is specific to the provider.
Link is created/updated.
For all above policies, realm duplicate email policy applies.
On Thu, Sep 21, 2017 at 4:05 PM, Bill Burke <bburke at redhat.com> wrote:
> I'm almost done implementing external token exchange where you can
> provide an external OIDC token and exchange it for a Keycloak one.
> Need some feedback though.
>
> * first broker flow and post broker flows won't be executed. Can't,
> its a non-browser flow.
> * mappers are run.
> * logout will not logout broker session
> * If duplicate emails exist, abort, 403
> * If duplicate username exists, abort, 403.
>
> The feedback I need is on duplicates. We might have the case where
> username is unique across different realms. Should I have a switch
> that will use existing user? Maybe an additional switch to not create
> a link? Maybe I should have an exchange flow?
>
>
> --
> Bill Burke
> Red Hat
--
Bill Burke
Red Hat
More information about the keycloak-dev
mailing list