<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1451954843448_3901"><span></span></div><div dir="ltr" id="yui_3_16_0_1_1451954843448_3947">I second all of Travis' suggestions and ideas. We currently use a very well known commercial product that doesn't support the below feature and hence are looking at other options. Even we just need the capability to customize the themes for each client application that includes password reset, multi factor authentication etc. Moreover, depending upon the division and region, type of application (internet or intranet), we will have to display additional text (legal requirements) on the login screens.</div><div dir="ltr" id="yui_3_16_0_1_1451954843448_3947"><br></div><div dir="ltr" id="yui_3_16_0_1_1451954843448_3947">Ideally we should be able to create custom templates upfront and make them available during the client registration. While most of the client applications would use the default login template, a few applications would select different login templates but the underlying authentication, single signon realm etc will remain the same. </div> <div class="qtdSeparateBR" id="yui_3_16_0_1_1451954843448_3966"><br></div><div class="yahoo_quoted" id="yui_3_16_0_1_1451954843448_3854" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 13px;" id="yui_3_16_0_1_1451954843448_3853"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1451954843448_3852"> <div dir="ltr" id="yui_3_16_0_1_1451954843448_3851"> <font size="2" face="Arial" id="yui_3_16_0_1_1451954843448_3850"> <hr size="1" id="yui_3_16_0_1_1451954843448_4048"> <b id="yui_3_16_0_1_1451954843448_4509"><span style="font-weight:bold;" id="yui_3_16_0_1_1451954843448_4508">From:</span></b> Travis De Silva <traviskds@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> stian@redhat.com <br><b><span style="font-weight: bold;">Cc:</span></b> keycloak-user <keycloak-user@lists.jboss.org><br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, January 4, 2016 8:25 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [keycloak-user] Different theme for each client<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_1_1451954843448_3858"><br><div id="yiv2681072159"><div id="yui_3_16_0_1_1451954843448_3857"><div dir="ltr" id="yui_3_16_0_1_1451954843448_3856">HI Stian,<div id="yui_3_16_0_1_1451954843448_3887"><br clear="none"></div><div id="yui_3_16_0_1_1451954843448_3855">Adding SSO zones just to address the theming issue looks a bit overkill to me as it will eventually come down to doing some theming at a level below the realm. I was going on the basis that if theming is not set at a client level, then it will default to the realm level theming which is basically your SSO enabled zone.</div><div><br clear="none"></div><div id="yui_3_16_0_1_1451954843448_4016">Also my other point was with regard to SaaS based applications where we have a backoffice system which is themed as per our SaaS product but the consumer facing front end needs to be themed to be aligned with the customer's web site. In this case, we cannot go with what KeyCloak has at present. What I am doing is as suggested by Bill sometime back, adding "if/else" statements into the freemarker templates and based on the client id loading different freemarker templates which is not ideal but does the job.</div><div><br clear="none"></div><div id="yui_3_16_0_1_1451954843448_4019">In any case, since what we are discussing is in general edge cases, Therefore instead of complicating the core KeyCloak platform, why don't you just expose the various links/flows that is currently available in the login process (forgot password/reset credentials, <span style="line-height:1.5;">required actions (update password, verify email, configure OTP, etc.), </span><span style="line-height:1.5;" id="yui_3_16_0_1_1451954843448_4018">user account mgmt, registration, social login etc. Then we are still using the core of keycloak but for the frontend themes/UI, we use our own.</span></div><div id="yui_3_16_0_1_1451954843448_4046"><span style="line-height:1.5;"><br clear="none"></span></div><div>I also haven't explored the Login SPI which as per the KeyCloak docs which says "The Login SPI allows implementing the login forms using whatever web framework or templating engine you want". Wonder if this will give us what we are after.</div><div><span style="line-height:1.5;"><br clear="none"></span></div><div><span style="line-height:1.5;">Cheers</span></div><div>Travis</div><div><br clear="none"></div><div><span style="line-height:1.5;"><br clear="none"></span></div><div><br clear="none"></div><div><br clear="none"></div><div><br clear="none"></div><div><br clear="none"></div></div><br clear="none"><div class="yiv2681072159yqt3681091901" id="yiv2681072159yqt84955"><div class="yiv2681072159gmail_quote"><div dir="ltr">On Mon, 4 Jan 2016 at 22:27 Stian Thorgersen <<a rel="nofollow" shape="rect" ymailto="mailto:sthorger@redhat.com" target="_blank" href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>> wrote:<br clear="none"></div><blockquote class="yiv2681072159gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div dir="ltr"><div>I strongly disagree. With Keycloak you are logging in to a SSO realm, not an individual application. With that in mind it's important that the login screen reflects that. Users need to know the difference as it's an important distinction. It just doesn't make any sense that I'm logged-in to the SSO with a login screen that is themed to look like the login screen for an individual application.</div><div><br clear="none"></div><div>Adding an option on clients to set the theme just doesn't make any sense. If we added the option to create SSO "zones" or disable SSO for individual applications then it would make sense to be able to set theme on a per-zone or apps that doesn't have SSO enabled.</div><div><br clear="none"></div><div class="yiv2681072159gmail_extra"><div class="yiv2681072159gmail_quote"></div></div></div><div dir="ltr"><div class="yiv2681072159gmail_extra"><div class="yiv2681072159gmail_quote">On 31 December 2015 at 09:46, Travis De Silva <span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:traviskds@gmail.com" target="_blank" href="mailto:traviskds@gmail.com">traviskds@gmail.com</a>></span> wrote:<br clear="none"><blockquote class="yiv2681072159gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex;"><div dir="ltr">Hi,<div><br clear="none"></div><div>My vote is to provide this feature at a client level as per the original request.</div><div><br clear="none"></div><div>I think realms should be used for completely different domains when we want to isolate users etc. Should not try and use it for something that it was not intended in the design.</div><div><br clear="none"></div><div>The reason why you might need theming at client level is i<span style="color:rgb(0,0,0);line-height:normal;">if you really think that clients which are essentially different applications most of the time and each of these applications might have different look and feel themes (either due to different development teams or vendors building different applications). </span></div><div><span style="color:rgb(0,0,0);line-height:normal;"><br clear="none"></span></div><div><span style="color:rgb(0,0,0);line-height:normal;">So when someone logins via KeyCloak, its true that we are logging into a realm but for an end user, it is really logging into a application and there is a need for the login page theme to look similar to the application look and feel.</span></div></div></blockquote></div></div></div><div dir="ltr"><div class="yiv2681072159gmail_extra"><div class="yiv2681072159gmail_quote"><blockquote class="yiv2681072159gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex;"><div dir="ltr"><div><span style="color:rgb(0,0,0);line-height:normal;"><br clear="none"></span></div><div><span style="color:rgb(0,0,0);line-height:normal;">Also I have a use case where I have a back office application that requires login for admin users and then I have the front office of this application where in addition to the admin users, you also can have other users as well who can self register and login to the front end which is a consumer facing site.</span></div><div><span style="color:rgb(0,0,0);line-height:normal;"><br clear="none"></span></div><div><span style="color:rgb(0,0,0);line-height:normal;">How I handle this is by having two clients in the same realm. This works fine if you are happy with the same backend login theme to be there for the consumer facing frontend. But we cannot do that as the front end is a consumer facing SaaS site, so each front end needs to have the client's website theme. This becomes very hard to do if we don't have theming at a client level.</span></div><div><span style="color:rgb(0,0,0);line-height:normal;"><br clear="none"></span></div><div><font color="#000000"><span style="line-height:normal;">I came across this post from Bill a few months ago </span></font></div><div><a rel="nofollow" shape="rect" target="_blank" href="http://lists.jboss.org/pipermail/keycloak-user/2015-July/002537.html" style="line-height:normal;">http://lists.jboss.org/pipermail/keycloak-user/2015-July/002537.html</a><font color="#000000"><span style="line-height:normal;"><br clear="none"></span></font></div><div><font color="#000000"><span style="line-height:normal;"><br clear="none"></span></font></div><div><font color="#000000"><span style="line-height:normal;">I am thinking to make use of the client variable that is available in login.ftl and load different freemarker fragments that will then theme it differently for each client. As mentioned by Bill, having many if conditions might not be ideal but it might meet the requirement.</span></font></div><div><font color="#000000"><span style="line-height:normal;"><br clear="none"></span></font></div><div><font color="#000000"><span style="line-height:normal;">Cheers</span></font></div><span><font color="#888888"></font></span><div><font color="#000000"><span style="line-height:normal;">Travis</span></font></div><div><font color="#000000"><span style="line-height:normal;"><br clear="none"></span></font></div><div><font color="#000000"><span style="line-height:normal;"><br clear="none"></span></font></div><div><br clear="none"></div><div><font color="#000000"><span style="line-height:normal;"> </span></font></div></div>
<br clear="none"></blockquote></div></div></div><div dir="ltr"><div class="yiv2681072159gmail_extra"><div class="yiv2681072159gmail_quote"><blockquote class="yiv2681072159gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex;">_______________________________________________<br clear="none">
keycloak-user mailing list<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">
<a rel="nofollow" shape="rect" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none"></blockquote></div></div></div></blockquote></div></div></div></div><br><div class="yqt3681091901" id="yqt01516">_______________________________________________<br clear="none">keycloak-user mailing list<br clear="none"><a shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none"><a shape="rect" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></div><br><br></div> </div> </div> </div></div></body></html>