<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 08/01/16 13:05, Stian Thorgersen
wrote:<br>
</div>
<blockquote
cite="mid:CAJgngAey+xuO=gf9u96L7e5-zuJf6nAZdPE1XEKGymLadr2-YA@mail.gmail.com"
type="cite">
<div dir="ltr">It's to make it less likely that the username is
already in use. We could use email for the username in those
cases, but email is not always available. In the past we didn't
have a way to allow the user to change the username if there was
a conflict and instead the first login would just fail. With the
introduction of first time social flows we could improve on
this.
<div><br>
</div>
<div>We could allow selecting the strategy to use. Then allow
the user to change if there's a conflict. We already allow
users to change email if there's a conflict so can do the same
for username.</div>
</div>
</blockquote>
We already detect conflicts in both email and username. So user can
either use different username or link the account corresponding to
existing username. Also as Kamal mentioned, we already have the
IdentityProviderMapper, which allows to configure how is username
generated ( <span style="background-color:#e4e4ff;">UsernameTemplateMapper
). We don't need any other strategy IMO as the mapper is flexible
enough.<br>
<br>
Maybe we can improve how is username generated if mapper is not
used? Currently the username is generated based on algorithm like
this:<br>
1) If there is IdentityProviderMapper which sets username, it has
priority<br>
2) Otherwise if realm.isRegistrationEmailAsUsername, then email
from social provider is used as username<br>
3) Otherwise if username from Identity provider is set, we
generate the keycloak username like "<IDP alias>.<IDP
username>" (For example "facebook.mposolda" )<br>
4) Otherwise if username from identity provider is null, we
generate the keycloak username like </span><span
style="background-color:#e4e4ff;">"<IDP alias>.<IDP
ID>" (For example "facebook.12345" )<br>
<br>
IMO the one thing, which can be improved is removing the IDP
prefix in step 3 and use just the username "mposolda" . If there
is conflict, it can be easily resolved thanks to first broker
login flow. I would likely keep the IDP alias in step 4 as having
just username "12345" is a bit confusing IMO.<br>
<br>
WDYT?<br>
Marek<br>
</span>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<blockquote
cite="mid:CAJgngAey+xuO=gf9u96L7e5-zuJf6nAZdPE1XEKGymLadr2-YA@mail.gmail.com"
type="cite">
<div class="gmail_extra"><br>
<div class="gmail_quote">On 8 January 2016 at 12:32, Thomas
Raehalme <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:thomas.raehalme@aitiofinland.com"
target="_blank">thomas.raehalme@aitiofinland.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi,
<div><br>
</div>
<div>If I login to Keycloak using a federated identity
such as Google, Keycloak inserts a prefix "google." to
my username. </div>
<div><br>
</div>
<div>Maybe I'm missing something, but isn't this kind of
unnecessary when the email address is already a unique
property?</div>
<div><br>
</div>
<div>Best regards,</div>
<div>Thomas</div>
</div>
<br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a moz-do-not-send="true"
href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a moz-do-not-send="true"
href="https://lists.jboss.org/mailman/listinfo/keycloak-dev"
rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>