Re: [keycloak-user] Force certain realm users to login via IDP

Hi Dmitry, I like your alternative solution. I will have a go with that. Thank you very much! I appreciate it. Regards Tim -----Original Message----- From: Dmitry Telegin [mailto:dt@acutus.pro] Sent: den 1 februari 2019 13:00 To: Tim Hedlund; keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Force certain realm users to login via IDP Hello Tim, I think your solution is viable. In your script authenticator, you can use authenticationSession.getExecutionStatus() to determine which auth method has been actually used. Alternatively, I'd suggest something similar to the built-in identity-provider-redirector [1], but with the different condition to trigger redirect (e.g. admin role membership instead of kc_idp_hint presence). However, this would be harder to implement in JavaScript. [1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... Good luck, Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro On Thu, 2019-01-31 at 13:49 +0000, Tim Hedlund wrote: