Re: [keycloak-dev] Identity Broker login flow

You're right, we don't have this right now. I don't know if it's something we should support OOTB. The idea of broker login is, that you delegate authentication to another SSO/social server. Once the second server say "Ok, user is authenticated", we treat him as authenticated on Keycloak side too. Isn't it the more proper option for your usecase to use OTP on the second server side instead? Another option is to implement IdentityProviderMapper and in "updateBrokeredUser" method, you will redirect user to OTP login. Could you try this? If we want to support another login flow triggered after each broker login (which I am not convinced TBH), we can either: 1) Introduce "post-broker-login" flow, which will be configurable per IdentityProvider. By default, it will be empty . 2) Use just one flow, which will be triggered after each broker login (current "first broker login" flow is triggered only if federatedIdentity doesn't yet exist in Keycloak). In this case, the current "first broker login" flow will need to be renamed to "broker login" and more logic will need to be moved from IdentityBrokerService to the flow itself. The disadvantage of this option is, that it may always require another redirect to trigger authentication flows. But we're trying to reduce the number of redirects ( https://issues.jboss.org/browse/KEYCLOAK-2098 ) Marek On 20/11/15 00:06, Dane Barentine wrote: