<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Hey guys,</div>
<div class=""><br class="">
</div>
<div class="">Just a remark on the idea of relaxing the email uniqueness requirement since Marek asked if there was a good use case. In my organization, we are using Active Directory as the federation provider and there is no easy way to enforce email uniqueness
natively in AD. For various reasons, we have some users being created directly in AD by another team within our organization and they routinely create users that have the same email address. Our customers apparently want some generic organization accounts
with generic organization email addresses. It has actually been one of the biggest pain points for us and our use of Keycloak since we have to manually resolve the issue when it happens. I personally strongly prefer that the emails are unique because it makes
things simpler throughout our internal application, but not having the option to relax this requirement has been a bit of a hassle for us with Active Directory and account registrations that occur outside of Keycloak. </div>
<br class="">
<div apple-content-edited="true" class="">
<div class="">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 13px;" class="">
Cory Snyder</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 11px; color: rgb(153, 153, 153);" class="">
software engineer</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 11px;" class="">
<span style="font-weight: bold; color: rgb(11, 164, 232);" class="">USA</span> <span style="color: rgb(153, 153, 153);" class="">+1.419.731.3479 </span><span style="font-weight: bold; color: rgb(11, 164, 232);" class=""> UK </span><span style="color: rgb(153, 153, 153);" class="">+44.20.7096.0149 </span>
<a href="http://www.iland.com/" style="font-weight: bold; color: rgb(11, 164, 232); text-decoration: none;" class="">iland.com</a> </div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 9px; color: rgb(153, 153, 153); line-height: 11px;" class="">
<br class="">
</div>
</div>
</div>
<div>
<blockquote type="cite" class="">
<div class="">On Oct 7, 2015, at 7:28 AM, Marek Posolda <<a href="mailto:mposolda@redhat.com" class="">mposolda@redhat.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div text="#000000" bgcolor="#FFFFFF" class="">
<div class="moz-cite-prefix">On 06/10/15 09:50, Stian Thorgersen wrote:<br class="">
</div>
<blockquote cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com" type="cite" class="">
<div dir="ltr" class="">We've have someone from the community that wants to use mobile number as the username, as well as verify mobile number by sending a code via SMS. See "Login by mobile number" thread in user mailing list for more details. They are also
willing to contribute this back to the community.
<div class=""><br class="">
</div>
<div class="">That made me think it may be nice to be able to configure the behavior of the username "field" for a realm. We could have a simple drop-down in the admin console to configure username mode, with the following options:</div>
<div class=""><br class="">
</div>
<div class="">* Username/email - default behavior where a user provides both a username and email, and the user can login with either. In this mode email has to be unique.</div>
<div class="">* Username - a user can only login with a username. In this mode we could relax the requirement that email has to be unique (that may be difficult though as it would require not using a database constraint, which may make it rather difficult to
guarantee uniqueness in other modes)</div>
</div>
</blockquote>
Even if we add the option, I wouldn't remove email uniqueness. Admin can decide to change the mode back to "Username" to "Email" and then some users won't be able to login due to many users with same email. Also is there usecase when there are 2 different users
in realm with same email?<br class="">
<blockquote cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com" type="cite" class="">
<div dir="ltr" class="">
<div class="">* Email - in this mode only email can be used to login. In this mode username field would not be displayed on the registration form or account management console. In the token the username would be set to email. In this mode verify email address
should be enabled by default.</div>
<div class="">* Mobile - user logs in with a mobile number. We can either just add mobile number to the username field or add a new mobile field and require uniqueness on that field. In this mode verify mobile number should be enabled by default.</div>
</div>
</blockquote>
For the "Mobile" support, isn't an option to remove default username/password Authenticator and add new Authenticator based on mobile number? Also registration screen can be customized and account management as well. Also user can already use protocol mapper
to map "mobile_number" attribute to "preferred_username" or whatever he wants into access token.<br class="">
<br class="">
TBH advantages of introducing new option are bit unclear to me. It looks like adding another complexity, which is not needed as authentication with mobile can be done with the SPIs we have now IMO.<br class="">
<br class="">
Marek<br class="">
<blockquote cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com" type="cite" class="">
<div dir="ltr" class="">
<div class=""><br class="">
</div>
<div class="">With regards to implementation I think it would be easier to make the existing username/password authenticator, registration form and account management adopt to the mode rather than have separate authenticators, etc.. for each mode.</div>
</div>
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset> <br class="">
<pre wrap="" class="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br class="">
</div>
_______________________________________________<br class="">
keycloak-dev mailing list<br class="">
<a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a><br class="">
https://lists.jboss.org/mailman/listinfo/keycloak-dev</div>
</blockquote>
</div>
<br class="">
</body>
</html>