Hello, We are using keycloak with multiple IdP from our customers. Because we don't want to offer a list of Idp (customer A can't use the idp of customer B), I would like to prompt the user for the email address first and decide then to redirect to a specific IdP based on the domain as an example. Does somebody here can advise me on the greatest way to implement this behavior? My first thought was to use a custom flow with a script, but I can't find how to specify the idp to use using script. Best regards, Yann Jouanin _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hello, Thanks for your reply. Indeed I managed to write the function attached in javascript and I was able to redirect to an IdP for specific domains. I have an additional question, I there a way to continue the flow (In my case I would like to optionaly prompt for OTP).  My current flow is: "cookies"(alternative) " Choose User"(required) Script(select idp) (required) (the script redirect to idp for a domains, otherwise triggers context.success) Subflow forms(optional):  - Username Password Form (required) OTP Form (optional). Did I misunderstood the flow usage? Now when a user is authenticated using my idp but has an OTP, the OTP is not prompted. Best regards , Yann   -------- FUNCTIONS --------- Authenticate function: function authenticate(context) {          var username = user ? user.username : "anonymous";     if (username.endsWith("mydomain.com")) {         redirect_to_idp(context, "idpformydomain");         return;     }     context.success();     return; } Function: AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError"); ClientSessionCode = Java.type("org.keycloak.services.managers.ClientSessionCode"); Urls = Java.type("org.keycloak.services.Urls"); OAuth2Constants = Java.type("org.keycloak.OAuth2Constants"); Response = Java.type("javax.ws.rs.core.Response"); /**  * Redirect to Identification provider  * >  * @param context {@see org.keycloak.authentication.AuthenticationFlowContext}  * @param providerId : the alias of the provider to use  */   function redirect_to_idp(context, providerId) {     var identityProviders = context.getRealm().getIdentityProviders();     var identityProvidersLen = identityProviders.length;     for (var i = 0; i < identityProvidersLen; i++) {         identityProvider = identityProviders[i];         if (identityProvider.isEnabled() && providerId.equals(identityProvider.getAlias())) {             var accessCode = new ClientSessionCode(context.getSession(), context.getRealm(), context.getAuthenticationSession()).getOrGenerateCode();             var clientId = context.getAuthenticationSession().getClient().getClientId();             var tabId = context.getAuthenticationSession().getTabId();             var location = Urls.identityProviderAuthnRequest(context.getUriInfo().getBaseUri(), providerId, context.getRealm().getName(), accessCode, clientId, tabId);             if (context.getAuthenticationSession().getClientNote(OAuth2Constants.DISPLAY) != null)              {                 location = UriBuilder.fromUri(location).queryParam(OAuth2Constants.DISPLAY, context.getAuthenticationSession().getClientNote(OAuth2Constants.DISPLAY)).build();             }             var response = Response.seeOther(location).build();             LOG.info("Redirecting to %s" + providerId);             context.forceChallenge(response);             return;         }     } } _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user