Re: [keycloak-dev] Kerberos, login with different user

On 02.10.2015, at 08:37, Marek Posolda <mposolda(a)redhat.com&gt; wrote: On 01/10/15 20:49, Bill Burke wrote: > Sorry for late reply. > > On 10/1/2015 3:13 AM, Stian Thorgersen wrote: >> * If a user that was logged in using Kerberos logs out the user should >> not just be automatically logged-in again for the current browser >> session. Instead the user should be displayed with a regular >> username/password field, but also with an option to login with Kerberos > Don't like this idea. > > #1 Users that want to bypass kerberos have to know to logout first so > they can login as a non-kerberos user. > > #2 username/password screen would have to have knowledge that kerberos > is turned on and that the user was logged in via kerberos. I'm don't > think this is possible with the current SPI. > >> * A variant on the above where if a user has logged-out from Kerberos >> the user would be displayed with a "Is this you?" when login, if the >> user selects yes the Kerberos authenticator would continue, if not the >> regular username/password form would be displayed > This one might be easy to do with current SPI although not sure if > kerberos plugin sets some session variables that need to be cleared. Yes, it can add the gss_delegation_credential note when Kerberos credential delegation is enabled. Looks that we may also need the non-persistent cookie added during logout, so the "Is this you" screen is not displayed for the first time login? > > >> * Implement account switcher - where a user can login to multiple >> accounts at a time and select which account to use >> > Not sure how this is different than "Is this you?". > >> Other ideas? Points for ideas that requires no hacks in applications ;) >> > idp_hint is a much different animal, isn't it? idp_hint is provided by > the application. skip_auth_mechanism would be something the user has to > know about to type in the URL right? > > > It's quite the same. Both allow application to send something to auth-server . Application can use secured URL with the param ( http://localhost/customer-portal/secured?kc_idp_hint=facebook <http://localhost/customer-portal/secured?kc_idp_hint=facebook> or http://localhost/customer-portal/secured?skip_auth_mechanism=kerberos <http://localhost/customer-portal/secured?skip_auth_mechanism=kerberos> ). Adapter then takes care of resend the parameter to auth-server in initial AuthorizationEndpoint request. In both cases, application can either provide the link or user can add the parameters manually. Marek _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-dev <https://lists.jboss.org/mailman/listinfo/keycloak-dev>