[keycloak-dev] Multiple user login on the same browser for Account Aggregation application

Mon Jan 21 03:17:08 EST 2019

Thanks a lot for your advice.

I followed what you had said, but unfortunately, it did not work as what I would like to do.

- On Browser authentication flow, I made "Cookie" authenticator disabled.
- "login=prompt" was added as the authorization code request's query parameter.
- After login as AliceEin, I tried to login as AliceZwei on the same browser, AuthenticationProcessor.attachSession returned the error saying "You are already authenticated as different user 'AliceEin' in this session. Please logout first.".

I think that this feature is important for securing API access use case. Therefore, I would like to implement and contribute this feature onto keycloak without interfering with existing features (e.g. Web SSO).

----------
From: Stian Thorgersen <sthorger at redhat.com> 
Sent: Friday, January 18, 2019 5:17 PM
To: 乗松隆志 / NORIMATSU，TAKASHI <takashi.norimatsu.ws at hitachi.com>
Cc: keycloak-dev at lists.jboss.org
Subject: [!]Re: Re: [keycloak-dev] Multiple user login on the same browser for Account Aggregation application

I can see Keycloak adding support for:

* Always requiring login to a specific client, not relying on SSO session. This can already supported through login=prompt and maximum authentication time and probably doesn't need anything specific.
* Login to Keycloak with multiple accounts with a way to switch accounts

I don't think what you are after is something we should add directly to Keycloak, but I believe you can achieve it reasonably easily with a custom authentication flow.

Keycloak recently added support for the ability to specify a separate flow for specific clients. That means you can create a new browser flow without the cookie authenticator and associate with with "ClientApp". This means that ClientApp will prompt the user for username and password, ignoring the cookie, while other clients would continue to use the SSO cookie. I think this will just work as is without any changes needed to Keycloak. It's probably going to look a bit strange from what open sessions the users has though.

On Fri, 18 Jan 2019 at 06:09, 乗松隆志 / NORIMATSU，TAKASHI <mailto:takashi.norimatsu.ws at hitachi.com> wrote:
Thank you for comments. I'm afraid it is not relevant to an external identity provider directly nor selecting from multiple accounts.

To say shortly, our considering user case is as follows:

In Japan(maybe other countries), there is such the fintech client application that accesses APIs provided by financial institutions to retrieve some information like transaction records and balance, and provide its user some useful services like online automatic housekeeping book, personal financial management, and so on.

It is the case that the user her or himself has multiple accounts on the same bank (Checking Account, Savings Account, Time Deposit Account, and so on), or the user manages her or his family member's accounts on the same bank.

If such the user uses this fintech client application for the first time, for this application to get an access token that is granted, she or he opens a browser, start Authz Code flow, do authentication and authorization per each account.

In this use case, we need not SSO. We use keycloak only to let a client application get an access token that is granted by an end user.

For example, a customer (say, Alice) has multiple accounts (say AliceEin, AliceZwei, AliceDrei) on the keycloak, and want to make the client application (say ClientApp) get access tokens for each of these accounts (namely, access token granted by AliceEin, access token granted by AliceZwei, access token granted by AliceDrei).

To do so, this customer opens a browser, start Authz Code flow, do authentication and authorization per each account. We hope to do it without closing and restarting the browser.

Procedure is as follows:
1. invoke a browser
2. accesses ClientApp
3. start Authz code flow
4. on keycloak, login as AliceEin
5. tokens for user account "AliceEin" are issued to ClienApp
6. on the same browser, start Authz code flow again
7. on keycloak, login as AliceZwei
8. tokens for user account "AliceZwei" are issued to ClienApp
9. on the same browser, start Authz code flow again
10. on keycloak, login as AliceDrei
11. tokens for user account "AliceDrei" are issued to ClienApp

The expectation is the following:
ClientApp got all in-active access tokens for each user account "AliceEin", "AliceZwei", and "AliceDrei".

The actual result is the following:
at the procedure 7, keycloak returned the error page saying;
You are already authenticated as different user AliceEin in this session. Please logout first.
If logout, the access token granted by AliceEin is revoked.
Considering some workaround, Alice close and restart the browser, or use another browser.

I've recognized that keycloak inherently try to achieve Web SSO, therefore, the result above is reasonable. 
However, in our user case not requiring Web SSO, we would like to achieve the expectation above.

From: Stian Thorgersen <mailto:sthorger at redhat.com> 
Sent: Friday, January 18, 2019 12:53 AM
To: 乗松隆志 / NORIMATSU，TAKASHI <mailto:takashi.norimatsu.ws at hitachi.com>
Cc: mailto:keycloak-dev at lists.jboss.org
Subject: [!]Re: [keycloak-dev] Multiple user login on the same browser for Account Aggregation application

Not sure I fully understand what you are after.

Are you basically talking about what Google provides where you can login to multiple accounts at the same time from the browser with the ability to select accounts when logging into an application as well as ability to switch between logged-in accounts from within the application itself?

In case you don't know how Google does it, I'll explain it here:

* Login to Gmail first time
* Gmail has an icon that displays your account details and sign out. This icon also provides an option to add additional accounts
* Clicking add account redirects to login screen and you can now login using an additional account
* When using a new application and you are logged-in from multiple accounts Google displays an account selector where you can select which of the logged-in accounts to use

If this is what you are after and it's implemented as a complete feature we can consider it, but if it's something else we need to have further discussions and see if it is something Keycloak should support or if you should use a custom authentication flow to achieve it.

On Wed, 16 Jan 2019 at 09:03, 乗松隆志 / NORIMATSU，TAKASHI <mailto:takashi.norimatsu.ws at hitachi.com> wrote:
Hello,

I've used keycloak for such the client application that collect a user's information via API provided by a resource server (e.g. collect balance from bank’s API).

If the user has multiple accounts in the resource server, the client application must collect information on all these accounts. In order to do this, the client application let the user conduct an authentication and authorization flow for each account on the same browser consecutively.

The current keycloak implementation cannot allow a user to login multiple accounts consecutively and simultaneously on the same browser. Therefore, the user must terminate and restart the browser every time she or he login on one of his or him accounts, which is not good for UX perspective. I’ve opened JIRA (https://clicktime.symantec.com/3Lvd7ed2QRdLsEq6ziXbHvg7Vc?u=https%3A%2F%2Fissues.jboss.org%2Fbrowse%2FKEYCLOAK-9332).

I have an idea to resolve it and contribute its realization hopefully. However, I'm not sure this idea is appropriate or not. So, I am happy to get some suggestions and advices on it.

[Idea]
The current (keycloak-4.8.2.Final) keycloak's implementation seems to be as follows:
RootAuthenticationSessionModel class instance has several AuthenticationSessionModel class instances.
Browser is bounded to RootAuthenticationSessionModel by AUTH_SESSION_ID Cookie and realm.
AuthenticationSessionModel is bounded to Browser's tab by RootAuthenticationSessionModel, client id, and tab id.

It seems that keycloak allows a user on the same browser to login on the same account for several clients per browser's tab, and it is good for Web SSO use case. However, it does not work good for Account Aggregation use case.

My proposal is that suppressing (expiring explicitly) AUTH_SESSION_ID Cookie and its related Cookies on the client side (not the server side) at the end of an authentication and authorization flow make the browser new to logging-in onto keycloak every time. Also, adding a switch to change the operation mode from the ordinal Web SSO mode to the proposed one (like Securing API mode).

Best Regards
Takashi Norimatsu
Hitachi, Ltd.

_______________________________________________
keycloak-dev mailing list
mailto:keycloak-dev at lists.jboss.org
https://clicktime.symantec.com/3W4zNBtUkGecLAcJy5U61t97Vc?u=https%3A%2F%2Flists.jboss.org%2Fmailman%2Flistinfo%2Fkeycloak-dev