Sample Flow for Keycloak 20

[schenardi]

Hi Torben,

thanks for this provider.
I could succesfully install it but I'm struggling with the configuration of the flow.
Do you perhaps have a complete sample flow?`

Scenario:
User enters username (email oder username), keycloak decides if to forward to openId provider (to Azure AD) > show Azure AD SignIn or to use internal users > show password field.

Thanks; Markus

[sventorben]

Hello @schenardi!

sure, the flow from readme should work in your scenario.

Is there any issue with that flow? Let me know if it is not working for you.

Regards
Sven-Torben

[schenardi]

Yes, because you cannot mix required and alternative flows/executions at the same level. The username/password form does cannot be configured as an alternative itself, so it needs to be wrapped in an alternative sub-flow.

Can you explain a bit more about that subflow? I'm somehow missing something... On the image I cannot see the subflow itself.

Mabey the other view helps:

[sventorben]

Can you explain a bit more about that subflow? I'm somehow missing something... On the image I cannot see the subflow itself.

The subflow is only there to be able to use the username password form as an alternative to the cookie and home idp discovery authenticators. If you check the requirement options for the username and password form, it will only show required and disabled. When wrapping it in a subflow, the subflow can be made an alternative.

Would you mind exporting your realm and posting it here?

[schenardi]

Can you explain a bit more about that subflow? I'm somehow missing something... On the image I cannot see the subflow itself.

The subflow is only there to be able to use the username password form as an alternative to the cookie and home idp discovery authenticators. If you check the requirement options for the username and password form, it will only show required and disabled. When wrapping it in a subflow, the subflow can be made an alternative.

Would you mind exporting your realm and posting it here?

took out a lot of info, hope you can import it. Otherwise give me please an email or contact me at markus.schenardi(at)laixo.ch
realm-export-json.txt

[sventorben]

Yes, I can import it without issues.

You should see a warning in the logs that explains the problem you have:

WARN  [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-7) REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored: [auth-cookie, home-idp-discovery, null]

You need to add the Username Password Form to the username and password sub-flow, but you have it on the same level. Click the plus icon (+) beside the sub-flow and click Add step to add the Username Password Form authenticator.

[schenardi]

Thanks for your assistance!

Sorry, I tried that substep before but sent an older version. Behaviour changes a little bit, but I would expect to be sent to the azure provider after entering my email. And I would expect not to see the Azure Buttons.

[sventorben]

If you don't want the Azure Button, make sure you hide it in the identity provider configuration.

You are mostlikey seeing the password form, because there exists a local user with that username/email and the email has not been verified.

From the docs:

the authenticator will only forward the user if the email has been verified

You should also see a warning in your logs like this:

WARN  [de.sventorben.keycloak.authentication.hidpd.DomainExtractor] (executor-thread-25) Email address of user 'f2506946-dbea-4feb-8b85-34f2546ac75b' is not verified

[schenardi]

Thanks a lot!

Three parts for the solution:

• mark users (automatically) as verified once they are generated from Azure automatically (force mode)
• disable the buttons in the advanced provider settings
• define username/password form as substep of username/password (please adjust the image in the documentation with indention of the last step