<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:13px"><pre id="yui_3_16_0_1_1436882400684_27356" class="" style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Hi Bill,<br> Thanks for the quick response. I meant the federated user to be as an user from External IDP.<br>There are two scenarios in our application which we plan to address using Keycloak<br><br>a) An user who interactively logs into the web client <br>b) An background process that acts behalf of the user(a) <br><br>In the case(a)every time the user logs into the system, he/she will be authenticated by external IDP. But in the case(b) because it is a background process only once the user logs in with his credential and uses the refresh token (which has very long time to live or never expires), in this scenario after the initial authentication there is no other interaction with external IDP.<br><br>There could be situations when the user in the external IDP could be fired/removed, hence Keycloak might have to know if the user is still valid to allow refresh of the tokens to happen. Just wondering if it is handled by any means before reissuing the refresh token? <br><br>In our current implementation, for this purpose SCIM protocol was used to listen any DELETE USER operations at the external IDP end and update the status of the user in SP end. So during token validation, this user status is verified.<br><br>Please let me know if there is any similar plan in Keycloak too.<br><br>Thanks<br>Kamal<br><br><br>**************************************<br><br><br>What do you mean by federated user? We have the concept of federating
between IDPs, where Keycloak is the child and an external IDP is teh
parent. In this case, we do not check the status of the external user
at all. I'm not currently aware of any standard we can use to do this.</pre><div id="yui_3_16_0_1_1436882400684_27354"><span></span></div><br> <div id="yui_3_16_0_1_1436882400684_27699" style="font-family: times new roman, new york, times, serif; font-size: 13px;"> <div id="yui_3_16_0_1_1436882400684_27698" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1436882400684_27697" dir="ltr"> <hr size="1"> <font id="yui_3_16_0_1_1436882400684_27720" face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Kamal Jagadevan <j.kamal@ymail.com><br> <b><span style="font-weight: bold;">To:</span></b> Keycloak-user <keycloak-user@lists.jboss.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, July 13, 2015 5:39 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Use case of Deprovisioning a user in Federated IDP<br> </font> </div> <div class="y_msg_container"><br><div id="yiv4384422168"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div id="yiv4384422168yui_3_16_0_1_1436821921932_27401"><font face="times new roman, new york, times, serif">Hello,</font></div><div dir="ltr" id="yiv4384422168yui_3_16_0_1_1436821921932_27432"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28205" face="times new roman, new york, times, serif"> I would like to know how De-provisioning of user in Federated IDP case being handled in Keycloak.</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27599" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28203" face="times new roman, new york, times, serif">How frequently Keycloak validates the federated user status before reissuing the new access token to the already authenticated user.</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27636" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28201" face="times new roman, new york, times, serif">Is there plans to support SCIM (System for Cross-domain Identity Management) in Keycloak roadmap?</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27666" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27795" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28200" face="times new roman, new york, times, serif"><u id="yiv4384422168yui_3_16_0_1_1436821921932_27940">Following is our use case<br></u></font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27760" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_27934" face="times new roman, new york, times, serif" size="2">1. There are few processes that will be authenticated with Federated IDP using SAML just after <b id="yiv4384422168yui_3_16_0_1_1436821921932_27938">user</b><b id="yiv4384422168yui_3_16_0_1_1436821921932_27936">(A)</b> registration is complete (one time login manually).</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27762" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_27930" face="times new roman, new york, times, serif" size="2">2. Subsequently SP will issue the token pair to these processes to use as long as Refresh token lifetime is valid.</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27782" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_27932" face="times new roman, new york, times, serif" size="2">3. Within this refresh token lifetime (if it too long) and in the case <b id="yiv4384422168yui_3_16_0_1_1436821921932_27809">user(A)</b> is de-provisioned/removed, how would <b id="yiv4384422168yui_3_16_0_1_1436821921932_28109"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28108" color="#9d1811"><span id="yiv4384422168yui_3_16_0_1_1436821921932_28107" style="background-color:rgb(253, 239, 43);"><span id="yiv4384422168yui_3_16_0_1_1436821921932_28086"><u id="yiv4384422168yui_3_16_0_1_1436821921932_27964">SP be aware to block this token renewal</u></span></span></font></b>.</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27837" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28125" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28127" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Please share your thoughts.</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28184" dir="ltr"><br></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28186" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Best</font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28220" dir="ltr"><font id="yiv4384422168yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Kamal<br></font></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27840" dir="ltr"><br></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_28183" dir="ltr"><br></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27781" dir="ltr"><br></div><div id="yiv4384422168yui_3_16_0_1_1436821921932_27638" dir="ltr"><br></div></div></div></div><br><br></div> </div> </div> </div></body></html>