Re: [keycloak-user] Switch User enhancement - How best to modify Browser Flow

Hi Ryan, we handled this with a specific querystring (&login=manual), which is checked by our custom authenticator and then stops the spnego login execution, so keycloak falls back to the normal browserform. Use-Case was simply "logout and login as another user", so we didn't want an extra interrupt of the auto-login process for convenience of most users. Instead, the user has to manually "log out" and then does not get automatically re-loggeed in as himself (as per spnego ticket), but can login as another user. But(!) not important if you use your solution or something similar to mine, keep in mind that your spnego/kerberosticket is active in the whole(!) browser. So, when you have more than one tab with the same application or another one of the same realm open, 1 with autologin, 1 with a manually logged in other user, keycloak throws a already authenticated-exception ("you're logged in as another user...). We had this error coming up quite often in the dev-environments, which were all clients in one realm first. After a little talk here, I used one realm per environment (say local, dev, qa, ...) as a workaround. There's no simple fix from the keycloak side I think, because that's just the way the ticketing at spnego/kerberos works as how I understand. Best regards, Dominik Am 02.05.18 um 19:29 schrieb Ryan Slominski: