Hello

 

Right now our keycloak server was setup to do kerberos authentication with ldap as backup, so in this case, the user will get them in automatically

from the company domain when they hitting the URL, we have application role definitions in the keycloak, if the user does not have the role configured

then we want to logout them back to the default key cloack login page and let them try their LDAP user account.

 

But because kerberos authentication is always on the top, so right after we logout the user, the kerberos will let them in automatically

 

right now we are using keycloak.logout from keycloak.js to logout user

 

I am wondering what is the good practice to achieve this?

 

Any suggestions are welcome

 

thanks

raymond