Repository navigation
How to decide by which method user logs in in linked account #40436
Replies: 1 comment 3 replies
|
If updating user credentials is the only place where this distinction is important, you may be able to achieve the same result by enforcing user authentication before a password update, and configure this authentication flow to not allow federated logins. See the maximum authentication age parameter https://www.keycloak.org/docs/latest/server_admin/index.html#maximum-authentication-age |
|
I need to make a decision on react app side, whether to show some fields if user logs in using email/password or hide when logged in using idp (google) |
|
Any update on this ? |
|
I think using ACRs to require a "higher" level of authentication (see https://www.keycloak.org/docs/latest/server_admin/index.html#_client-policy-auth-flow) when the user can perform more privileged operations would work in your case. |
Uh oh!
There was an error while loading. Please reload this page.
In our application, users can sign up using either the basic login method (email/password) or an identity provider (IDP) such as Google. If a user initially signs up using the basic method and later attempts to sign in with the same email via Google, we prompt them to link the accounts. After linking, the user can log in using either method.
However, we have a use case where we show a "Change Password" option. This option should only be visible if the user logged in using the basic email/password method.
Currently, we determine whether the user used Google login by checking the federatedIdentities field in the user profile. This works correctly until the user links their Google account. After linking, federatedIdentities is always present, even if the user logs in using the basic method — which breaks our logic.
The Problem:
Once accounts are linked, we can no longer differentiate whether the current session used Google or basic login, because the presence of federatedIdentities is no longer a reliable indicator.
Question:
Is there a reliable way to identify the login method used in the current session, especially after account linking in Keycloak? Specifically, can we differentiate between:
A user logging in with basic credentials
A user logging in via Google (IDP)
when both are linked to the same account?
Is this achievable in Keycloak (v25+), and what would be the best approach?
All reactions