Re: [keycloak-user] Adding attributes during login

Hello Craig, Thanks for the explanation, it's pretty clear now. I guess that "partner code" is the same parameter you use to dynamically brand your login themes, right? First, you need to extract it from your request parameters. In Keycloak, you can do this with a script authenticator. Things are a bit complicated by the fact that the initial incoming link (protocol/openid-connect/auth) does a POST to another endpoint (login-actions/authenticate), and the script authenticator is able introspect only the second request. Query parameters do not survive POST, but still can be found in the Referer header; therefore, you need to fish them out of there. (NB this will only work unless sending this header is disabled in the browser by a paranoid user :) Create it as the last authenticator in the flow and make it "required". It's up to you how to handle the case where there is no "foo" parameter in the initial link. =================================================== function authenticate(context) { var username = user ? user.username : "anonymous"; var uri = new java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer")); LOG.info(uri); var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri); var _foo = uriInfo.queryParameters['foo']; if (_foo !== null ){ var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map LOG.info(script.name + ": " + username + " foo=" + foo); authenticationSession.setUserSessionNote("foo", foo); } context.success(); } =================================================== (Quick remark on terminology: in Keycloak's terms, "attributes" are persistent pieces of data attached to a user, group or realm; you can find them in the corresponding GUI tabs. Transient data is called "[session] notes".) Next, you will need to propagate it to the tokens. Again, JavaScript to the rescue, this time in the form of script mapper (client -> Mappers): =================================================== var foo = userSession.notes["foo"]; if (foo !== null) { token.setOtherClaims("foo", foo); } =================================================== And voilà, your query parameter is now in the tokens :) Good luck! Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote: