Yes, that kc_idp_hint parameter seems to be exactly what we're looking for. Thanks Thejaka!
Also thanks Gowtham for the pointer to the keycloak-user post. I wonder if kc_idp_hint supports (or could be easily modified to support) chained hinting. AARC-G049 has the following example: https://example.service.edu/?idphint=urlencode(https://idp-sp-proxy.org/oauth2?idphint=urlencode(https://home-idp.org/idp/shibboleth)) We might consider the following concrete case, where the University of Illinois has a Galaxy instance that uses Shibboleth authentication: https://galaxy.illinois.edu/ -> https://iam.scigap.org/ (Keycloak issuer?) -> https://cilogon.org/ (CILogon's OIDC issuer) -> urn:mace:incommon:uiuc.edu (Illinois IdP entityID) So https://galaxy.illinois.edu/ would redirect to: https://iam.scigap.org/auth/realms/uiuc/broker/cilogon/endpoint?idphint=urlencode(urn:mace:incommon:uiuc.edu) or maybe that should instead be https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(https://cilogon.org/?idphint=urlencode(urn:mace:incommon:uiuc.edu)) and until we support the idphint standard it might instead be https://iam.scigap.org/auth/realms/uiuc/endpoint?kc_idp_hint=urlencode(https://cilogon.org/?selected_idp=urlencode(urn:mace:incommon:uiuc.edu)) Then iam.scigap.org would redirect to: https://cilogon.org/authorize?selected_idp=urlencode(urn:mace:incommon:uiuc.edu) Lots of guesswork on my part. I've seen URLs like https://iam.scigap.org/auth/realms/uiuc/broker/cilogon/endpoint and https://iam.scigap.org/auth/realms/iugateway/broker/cilogon/endpoint but I'm not clear if that's a pattern that Custos would follow. -Jim
