Redirect to default IDP if user is not linked

[mm-pcosco]

Is it possible to always redirect to one default IdP if the entered username/email is not linked?
I only have one IDP configured in Keycloak.
Users can't be uniquely identified through a domain, since any e-mail address is allowed in that IDP.

[sventorben]

Please check if this works for you --> #34 (comment)

[mm-pcosco]

Thanks for your quick reply!

Unfortunately, this is not working on my side. I have federated and non-federated users in my Keycloak.

Whenever I type in a completely unknown username to Keylcoak it will just show the passwort field, instead of redirecting to a default IDP (on the IDP the user is already there).

However, if I configure a default identity provider in the Identity Provider Redirector, it will always redirect me to that default IDP, for any user (federated and non-federated)

I'm using Keycloak v19 and IDP-Discovery v.19.1.0.

[sventorben]

Ok, I see. You want to redirect non-existend users to an identity provider while existing local users should be able to enter their password, right?

That is currently not supported.

If this were supported by the extension, it would make it easy for attackers to discover registered emails present on keycloak, because the attacker would see different behaviour for non-existent and existent accounts.

[mm-pcosco]

Thanks for your clarification Sven.