Regex or "default" domain

[alishchytovych]

Hi, @sventorben
Thank you for the great add-on. Would you please suggest how to implement this flow:

• we have users with the usernames like abc@domain1.com
• we have users with the usernames like abc@domain2.com
• we have users with usernames without @domain.com part, just "abc"
• we have a lot of users with different domain parts (@yahoo.com, @xxx.yyy etc.)

And we have our IdP, which can authenticate all of them, except the first two. It is easy to configure the first two, but how to configure something like "if no domain -> go to IdP X", and/or "if any domain, except domain1 and domain2, -> go to IdP X", and/or "if no configuration found for the domain, go to IdP X" (like default fallback)?

Would appreciate any ideas (the only idea I have is to modify the code to do domain matching based on the regular expressions)

[sventorben]

Hello @alishchytovych

the part "if no domain -> go to IdP X" can be easily configured with Keycloak itself. There is an example flow in this comment. The Identity Provide Redirector has a config option to set the default IdP.

Does this help?

[alishchytovych]

Yes, thank you. This is how it works right now - fallback to the default IdP.
With the migration from the old custom auth solution to the keycloak, it could be the cases like user1@hotmail.com and user2@hotmail.com should be redirected to the different IdPs - so maybe it will be beneficial to have the special type selector based on the regex expression to select the IdP? Not the domain part only, but the whole username. In this way we can send special types of users (for example, with the phone number usernames) to some particular IdP which can handle it

[sventorben]

In your concrete example, how would you match the identity provider?

Keycloak allows to link users to specific IdP. My extensions allows to forward to linked IdPs already. Wouldn't that work in your case?

There is also an issue #230 where I am collecting other ideas of how to discover an idp. I will add this to the list.