<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 06/10/15 09:50, Stian Thorgersen
wrote:<br>
</div>
<blockquote
cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com"
type="cite">
<div dir="ltr">We've have someone from the community that wants to
use mobile number as the username, as well as verify mobile
number by sending a code via SMS. See "Login by mobile number"
thread in user mailing list for more details. They are also
willing to contribute this back to the community.
<div><br>
</div>
<div>That made me think it may be nice to be able to configure
the behavior of the username "field" for a realm. We could
have a simple drop-down in the admin console to configure
username mode, with the following options:</div>
<div><br>
</div>
<div>* Username/email - default behavior where a user provides
both a username and email, and the user can login with either.
In this mode email has to be unique.</div>
<div>* Username - a user can only login with a username. In this
mode we could relax the requirement that email has to be
unique (that may be difficult though as it would require not
using a database constraint, which may make it rather
difficult to guarantee uniqueness in other modes)</div>
</div>
</blockquote>
Even if we add the option, I wouldn't remove email uniqueness. Admin
can decide to change the mode back to "Username" to "Email" and then
some users won't be able to login due to many users with same email.
Also is there usecase when there are 2 different users in realm with
same email?<br>
<blockquote
cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>* Email - in this mode only email can be used to login. In
this mode username field would not be displayed on the
registration form or account management console. In the token
the username would be set to email. In this mode verify email
address should be enabled by default.</div>
<div>* Mobile - user logs in with a mobile number. We can either
just add mobile number to the username field or add a new
mobile field and require uniqueness on that field. In this
mode verify mobile number should be enabled by default.</div>
</div>
</blockquote>
For the "Mobile" support, isn't an option to remove default
username/password Authenticator and add new Authenticator based on
mobile number? Also registration screen can be customized and
account management as well. Also user can already use protocol
mapper to map "mobile_number" attribute to "preferred_username" or
whatever he wants into access token.<br>
<br>
TBH advantages of introducing new option are bit unclear to me. It
looks like adding another complexity, which is not needed as
authentication with mobile can be done with the SPIs we have now
IMO.<br>
<br>
Marek<br>
<blockquote
cite="mid:CAJgngAf101tzR93OKd-tp3rbachmpbZ_XACCF8R9=z-a9ePz7A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>With regards to implementation I think it would be easier
to make the existing username/password authenticator,
registration form and account management adopt to the mode
rather than have separate authenticators, etc.. for each mode.</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>