<div dir="ltr">As I commented in the original thread I don't think this is a good idea. Users that have configured their browser has to set a specific domain to enable Kerberos as well as be logged-in using Kerberos to their desktop. With that in mind 99% of users will want to log in with Kerberos 99% of the time. So requiring and extra step in the flow is not nice.<div><br></div><div>Let's please return this conversation to the original thread though, rather than start another thread.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 2 October 2015 at 17:23, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I would like to take the Account Chooser approach to the Kerberos bypass<br>
situation. The Flow would be:<br>
<br>
1. Cookie - ALTERNATIVE<br>
2. Chooser Flow - ALTERNATIVE<br>
a. Kerberos - OPTIONAL<br>
b. Account Chooser - ALTERNATIVE<br>
c. Forms ALTERNATIVE<br>
i. Username/Password - REQUIRED<br>
ii. OTP - OPTIONAL<br>
<br>
<br>
* An "accounts used" cookie needs to be optionally set depending on<br>
"remember me" switch. This should be a persistent cookie.<br>
* Account Chooser page is always shown unless the "account used" cookie<br>
is empty and no ClientSessionModel.getAuthenticatedUser is set.<br>
* If selected user == current ClientSessionModel.getAuthenticatedUser<br>
then return SUCCESSFUL<br>
* If selected user != NULL set ClientSessionModel.getAuthenticatedUser,<br>
return ATTEMPTED<br>
* If selected user == NULL clear<br>
ClientSessionModel.getAuthenticatedUser, return ATTEMPTED<br>
<br>
* Username/Password Form Authenticator does not display username,<br>
registration, and broker links if getAuthenticatedUser is already set<br>
* An improvement can be made to also perform OTP input on<br>
Username/Password page if a UserModel is already chosen.<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</font></span></blockquote></div><br></div>