11:09 p.m.
Thank you for comments. I'm afraid it is not relevant to an external identity provider
directly nor selecting from multiple accounts.
To say shortly, our considering user case is as follows:
In Japan(maybe other countries), there is such the fintech client application that
accesses APIs provided by financial institutions to retrieve some information like
transaction records and balance, and provide its user some useful services like online
automatic housekeeping book, personal financial management, and so on.
It is the case that the user her or himself has multiple accounts on the same bank
(Checking Account, Savings Account, Time Deposit Account, and so on), or the user manages
her or his family member's accounts on the same bank.
If such the user uses this fintech client application for the first time, for this
application to get an access token that is granted, she or he opens a browser, start Authz
Code flow, do authentication and authorization per each account.
In this use case, we need not SSO. We use keycloak only to let a client application get an
access token that is granted by an end user.
For example, a customer (say, Alice) has multiple accounts (say AliceEin, AliceZwei,
AliceDrei) on the keycloak, and want to make the client application (say ClientApp) get
access tokens for each of these accounts (namely, access token granted by AliceEin, access
token granted by AliceZwei, access token granted by AliceDrei).
To do so, this customer opens a browser, start Authz Code flow, do authentication and
authorization per each account. We hope to do it without closing and restarting the
browser.
Procedure is as follows:
1. invoke a browser
2. accesses ClientApp
3. start Authz code flow
4. on keycloak, login as AliceEin
5. tokens for user account "AliceEin" are issued to ClienApp
6. on the same browser, start Authz code flow again
7. on keycloak, login as AliceZwei
8. tokens for user account "AliceZwei" are issued to ClienApp
9. on the same browser, start Authz code flow again
10. on keycloak, login as AliceDrei
11. tokens for user account "AliceDrei" are issued to ClienApp
The expectation is the following:
ClientApp got all in-active access tokens for each user account "AliceEin",
"AliceZwei", and "AliceDrei".
The actual result is the following:
at the procedure 7, keycloak returned the error page saying;
You are already authenticated as different user AliceEin in this session. Please logout
first.
If logout, the access token granted by AliceEin is revoked.
Considering some workaround, Alice close and restart the browser, or use another
browser.
I've recognized that keycloak inherently try to achieve Web SSO, therefore, the result
above is reasonable.
However, in our user case not requiring Web SSO, we would like to achieve the expectation
above.
From: Stian Thorgersen <sthorger(a)redhat.com>
Sent: Friday, January 18, 2019 12:53 AM
To: 乗松隆志 / NORIMATSU，TAKASHI <takashi.norimatsu.ws(a)hitachi.com>
Cc: keycloak-dev(a)lists.jboss.org
Subject: [!]Re: [keycloak-dev] Multiple user login on the same browser for Account
Aggregation application
Not sure I fully understand what you are after.
Are you basically talking about what Google provides where you can login to multiple
accounts at the same time from the browser with the ability to select accounts when
logging into an application as well as ability to switch between logged-in accounts from
within the application itself?
In case you don't know how Google does it, I'll explain it here:
* Login to Gmail first time
* Gmail has an icon that displays your account details and sign out. This icon also
provides an option to add additional accounts
* Clicking add account redirects to login screen and you can now login using an additional
account
* When using a new application and you are logged-in from multiple accounts Google
displays an account selector where you can select which of the logged-in accounts to use
If this is what you are after and it's implemented as a complete feature we can
consider it, but if it's something else we need to have further discussions and see if
it is something Keycloak should support or if you should use a custom authentication flow
to achieve it.
On Wed, 16 Jan 2019 at 09:03, 乗松隆志 / NORIMATSU，TAKASHI
<takashi.norimatsu.ws@hitachi.com<mailto:takashi.norimatsu.ws@hitachi.com>>
wrote:
Hello,
I've used keycloak for such the client application that collect a user's
information via API provided by a resource server (e.g. collect balance from bank’s
API).
If the user has multiple accounts in the resource server, the client application must
collect information on all these accounts. In order to do this, the client application let
the user conduct an authentication and authorization flow for each account on the same
browser consecutively.
The current keycloak implementation cannot allow a user to login multiple accounts
consecutively and simultaneously on the same browser. Therefore, the user must terminate
and restart the browser every time she or he login on one of his or him accounts, which is
not good for UX perspective. I’ve opened JIRA
(https://issues.jboss.org/browse/KEYCLOAK-9332<https://clicktime.symant...).
I have an idea to resolve it and contribute its realization hopefully. However, I'm
not sure this idea is appropriate or not. So, I am happy to get some suggestions and
advices on it.
[Idea]
The current (keycloak-4.8.2.Final) keycloak's implementation seems to be as follows:
RootAuthenticationSessionModel class instance has several AuthenticationSessionModel class
instances.
Browser is bounded to RootAuthenticationSessionModel by AUTH_SESSION_ID Cookie and
realm.
AuthenticationSessionModel is bounded to Browser's tab by
RootAuthenticationSessionModel, client id, and tab id.
It seems that keycloak allows a user on the same browser to login on the same account for
several clients per browser's tab, and it is good for Web SSO use case. However, it
does not work good for Account Aggregation use case.
My proposal is that suppressing (expiring explicitly) AUTH_SESSION_ID Cookie and its
related Cookies on the client side (not the server side) at the end of an authentication
and authorization flow make the browser new to logging-in onto keycloak every time. Also,
adding a switch to change the operation mode from the ordinal Web SSO mode to the proposed
one (like Securing API mode).
Best Regards
Takashi Norimatsu
Hitachi, Ltd.
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev<https://clicktim...