Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Configure authenticationFlowBindingOverrides for a client

See original GitHub issue

Describe the bug It seems not possible to configure authenticationFlowBindingOverrides for a client. Keycloak uses authentication flow ID in their client configuration instead of alias.

To Reproduce I tried to force the authentication flow id and use this id in the client authenticationFlowBindingOverrides configuration but it does not seems to work at least if the auth flow already exists.

{
  "enabled": true,
  "realm": "realmWithFlow",
  "authenticationFlows": [
    {
      "alias": "my auth flow",
      "id": "ad7d518c-4129-483a-8351-e1223cb8eead",
      "description": "My auth flow for testing",
      "providerId": "basic-flow",
      "topLevel": true,
      "builtIn": false,
      "authenticationExecutions": [
        {
          "authenticator": "docker-http-basic-authenticator",
          "requirement": "DISABLED",
          "priority": 0,
          "userSetupAllowed": true,
          "autheticatorFlow": false
        }
      ]
    }
  ],
  "clients": [
    {
      "clientId": "moped-client",
      "authenticationFlowBindingOverrides": {
        "browser": "ad7d518c-4129-483a-8351-e1223cb8eead"
      },
      "name": "moped-client",
      "description": "Moped-Client",
      "enabled": true,
      "clientAuthenticatorType": "client-secret",
      "secret": "changed-special-client-secret",
      "redirectUris": [
        "https://moped-client.org/redirect"
      ],
      "webOrigins": [
        "https://moped-client.org/webOrigin"
      ]
    }
  ]
}

Expected behavior The configuration should probably use authentication flow aliases and resolve them to ids before making the calls to Keycloak.

{
  "enabled": true,
  "realm": "realmWithFlow",
  "authenticationFlows": [
    {
      "alias": "my auth flow",
      "description": "My auth flow for testing",
      "providerId": "basic-flow",
      "topLevel": true,
      "builtIn": false,
      "authenticationExecutions": [
        {
          "authenticator": "docker-http-basic-authenticator",
          "requirement": "DISABLED",
          "priority": 0,
          "userSetupAllowed": true,
          "autheticatorFlow": false
        }
      ]
    }
  ],
  "clients": [
    {
      "clientId": "moped-client",
      "authenticationFlowBindingOverrides": {
        "browser": "my auth flow"
      },
      "name": "moped-client",
      "description": "Moped-Client",
      "enabled": true,
      "clientAuthenticatorType": "client-secret",
      "secret": "changed-special-client-secret",
      "redirectUris": [
        "https://moped-client.org/redirect"
      ],
      "webOrigins": [
        "https://moped-client.org/webOrigin"
      ]
    }
  ]
}

Environment (please complete the following information)

Keycloak Version: 11.0.2
keycloak-config-cli Version: v2.1.0-11.0.0
Java Version: 11

Issue Analytics

State:
Created 3 years ago
Reactions:3
Comments:9 (6 by maintainers)

Top GitHub Comments

4reactions

jkroepkecommented, Sep 11, 2020

Looks great!

Just one more: While authenticationFlowBindingOverrides is set, change something on an auth flow that triggers a re-create. The id inside authenticationFlowBindingOverrides should be updated to the new flowId.

Additionally. the code coverage will show us some untested codepath. Within this metric we should able to see if we miss something.

1reaction

ybonnefondcommented, Sep 10, 2020

Thanks for your helpful comment, we will look into it on our side. I will likely not be the one who do the PR though. We’ve got better java coder than myself.

Top Results From Across the Web

Exported 'authentication flow binding overrides' cannot be ...

KEYCLOAK-9246 [GSS] Fails to import realm with a client that has "direct_grant" as auth flow binding override. Major - To be worked after...

Is it possible to override clients authentication flow in special ...

AFAIK only flows for “Browser” and “Direct Grant” are possible to override in a client configuration, no client auth flow.

Authentication Flows | keycloak-documentation

An authentication flow is a container for all authentications, screens, and actions that must happen during login, registration, and other Keycloak ...

Keycloak: Custom Authentication Flows - YouTube

Keycloak is a highly customizable Identity and Access Management solution. You can build very complex authentication flows using reach SPI ...

Is there an elegant way to clone a Keycloak realm with all its ...

"Unable to resolve auth flow binding override for: direct_grant" when ... What you could do is configure everything using the Keycloak ...