Hi Jim. Sorry that I could not reply to you earlier. I did post about our requirement but it was in a wrong group. However I posted our basic question in keycloak-user mailer list yesterday and waiting for the reply now. Here is the link for the question I posted in the keycloak-user group, keycloak idp hint <http://lists.jboss.org/pipermail/keycloak-user/2019-March/017505.html>
Thanks, Gowtham On Tue, Mar 12, 2019 at 3:44 PM Basney, Jim <[email protected]> wrote: > Hi Marcus, > > On the AEGIS call yesterday [1] I asked if anyone had implemented > idphinting in Keycloak, and nobody was aware of an implementation yet. > Could you provide a pointer to the thread on the Keycloak mailing list? I'm > not seeing any posts by Gowtham in the archives [2]. I'd like to point the > AARC/AEGIS folks to it, since I know they are also using Keycloak, so it'd > be good for them to join the discussion. > > Thanks, > Jim > > [1] https://lists.geant.org/sympa/arc/appint/2019-03/msg00017.html > [2] http://lists.jboss.org/pipermail/keycloak-user/2019-March/thread.html > ________________________________________ > From: Christie, Marcus Aaron <[email protected]> > Sent: Tuesday, March 12, 2019 1:39 PM > To: [email protected] > Subject: Forwarding query parameters from Keycloak to CILogon > > > Hi All, > > In order to implement a user interface (for example, in Galaxy's login > page) that allows a user to select a CILogon supported identity provider > and then be redirected directly to that identity provider login page, we > need to be able to pass a query parameter ("selected_idp") on Keycloak's > authorization endpoint and have Keycloak in turn pass this on to CILogon > when redirecting to CILogon's authorization endpoint. Essentially the flow > would be something like: > > - Client redirects to Keycloak authorization endpoint with > "selected_idp=whatever" query parameter (in addition to any other query > parameters) > - Keycloak redirects to CILogon's authorization endpoint, copying the > selected_idp=whatever query parameter to CILogon's authorization endpoint > URI > > Gowtham has asked on the Keycloak mailing list but I don't believe he has > received any responses. From looking at Keycloak's documentation and code, > it appears there is no support for such a thing. > > I propose the use of Keycloak's Service Provider Interface (SPI) to create > a custom Authenticator that can be configured to forward along specific > query parameters to an identity provider's authorization endpoint. Keycloak > has SPIs [1] for Authenticator and AuthenticatorFactory. What we need is > essentially the same as the IdentityProviderAuthenticator [2] and > IdentityProviderAuthenticatorFactory [3] but to forward certain query > parameters. The AuthenticatorFactory can be configured in the Keycloak > Admin console to specify which query parameters should be forward (see [4] > for an example of making an Authenticator configurable). For more > information, see the complete walkthrough of creating a custom > Authenticator [5]. > > > [1] > https://www.keycloak.org/docs/latest/server_development/index.html#_providers > [2] > https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java > [3] > https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java > [4] > https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticatorFactory.java#L78 > [5] > https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi_walkthrough > > -- Thanks & regards, Gowtham Kannan B Graduate Student, Computer Science Indiana university, Bloomington
