Hi Marcus, On the AEGIS call yesterday [1] I asked if anyone had implemented idphinting in Keycloak, and nobody was aware of an implementation yet. Could you provide a pointer to the thread on the Keycloak mailing list? I'm not seeing any posts by Gowtham in the archives [2]. I'd like to point the AARC/AEGIS folks to it, since I know they are also using Keycloak, so it'd be good for them to join the discussion.
Thanks, Jim [1] https://lists.geant.org/sympa/arc/appint/2019-03/msg00017.html [2] http://lists.jboss.org/pipermail/keycloak-user/2019-March/thread.html ________________________________________ From: Christie, Marcus Aaron <[email protected]> Sent: Tuesday, March 12, 2019 1:39 PM To: [email protected] Subject: Forwarding query parameters from Keycloak to CILogon Hi All, In order to implement a user interface (for example, in Galaxy's login page) that allows a user to select a CILogon supported identity provider and then be redirected directly to that identity provider login page, we need to be able to pass a query parameter ("selected_idp") on Keycloak's authorization endpoint and have Keycloak in turn pass this on to CILogon when redirecting to CILogon's authorization endpoint. Essentially the flow would be something like: - Client redirects to Keycloak authorization endpoint with "selected_idp=whatever" query parameter (in addition to any other query parameters) - Keycloak redirects to CILogon's authorization endpoint, copying the selected_idp=whatever query parameter to CILogon's authorization endpoint URI Gowtham has asked on the Keycloak mailing list but I don't believe he has received any responses. From looking at Keycloak's documentation and code, it appears there is no support for such a thing. I propose the use of Keycloak's Service Provider Interface (SPI) to create a custom Authenticator that can be configured to forward along specific query parameters to an identity provider's authorization endpoint. Keycloak has SPIs [1] for Authenticator and AuthenticatorFactory. What we need is essentially the same as the IdentityProviderAuthenticator [2] and IdentityProviderAuthenticatorFactory [3] but to forward certain query parameters. The AuthenticatorFactory can be configured in the Keycloak Admin console to specify which query parameters should be forward (see [4] for an example of making an Authenticator configurable). For more information, see the complete walkthrough of creating a custom Authenticator [5]. [1] https://www.keycloak.org/docs/latest/server_development/index.html#_providers [2] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java [3] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java [4] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java#L78 [5] https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi_walkthrough
