keycloak - Email claim overrides username in keycloak

Question

I've written a custom OIDC-Provider and connected it to keycloak. After the first login in via my provider, the user gets asked to enter a username, email, first name and last name (first-broker-login-flow).

Usually the username is prefilled with what is in the 'sub' claim. But when sending an 'email' claim, the username is prefilled with the email.

How can I prefill the username with something else than my email, while also sending an 'email' claim?

So far I've tried sending a 'name', a 'username' and a 'preferred_username' claim - no success.

I figured out that the IdpReviewProfileAuthenticator checks for isRegistrationEmailAsUsername(). So I've deactivated "Login with email" in my realm settings - no success.

Is there any way for keycloak to not use the 'email' claim for the username?

标签： keycloakopenid-connect

Answer 1

我想出了一个解决办法。在 keycloak 中，我为我的 oidc 提供程序创建了一个“用户名模板导入器”映射器，并将模板值设置为${CLAIM.sub}.

在我看来，这不是最好的解决方案。但它一直有效，直到我想出一个更好的方法来做到这一点......