Hi All,
In order to implement a user interface (for example, in Galaxy's login page)
that allows a user to select a CILogon supported identity provider and then be
redirected directly to that identity provider login page, we need to be able to
pass a query parameter ("selected_idp") on Keycloak's authorization endpoint
and have Keycloak in turn pass this on to CILogon when redirecting to CILogon's
authorization endpoint. Essentially the flow would be something like:- Client redirects to Keycloak authorization endpoint with "selected_idp=whatever" query parameter (in addition to any other query parameters) - Keycloak redirects to CILogon's authorization endpoint, copying the selected_idp=whatever query parameter to CILogon's authorization endpoint URI Gowtham has asked on the Keycloak mailing list but I don't believe he has received any responses. From looking at Keycloak's documentation and code, it appears there is no support for such a thing. I propose the use of Keycloak's Service Provider Interface (SPI) to create a custom Authenticator that can be configured to forward along specific query parameters to an identity provider's authorization endpoint. Keycloak has SPIs [1] for Authenticator and AuthenticatorFactory. What we need is essentially the same as the IdentityProviderAuthenticator [2] and IdentityProviderAuthenticatorFactory [3] but to forward certain query parameters. The AuthenticatorFactory can be configured in the Keycloak Admin console to specify which query parameters should be forward (see [4] for an example of making an Authenticator configurable). For more information, see the complete walkthrough of creating a custom Authenticator [5]. [1] https://www.keycloak.org/docs/latest/server_development/index.html#_providers <https://www.keycloak.org/docs/latest/server_development/index.html#_providers> [2] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java> [3] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java> [4] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java#L78 <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java#L78> [5] https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi_walkthrough <https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi_walkthrough>
smime.p7s
Description: S/MIME cryptographic signature
