Keycloak - let user choose another user based on matching attribute

[Nicola Beghin]

I'm trying to understand if Keycloak could be useful in this scenario.

1. user enters correct credentials
2. based on a given user attribute (ie. attributeX=xyz), Keycloak checks if any other user matches attributeX=xyz: ie. user1, user2 and user3
3. user is given possibility to proceed with login with one of the matched users user1, user2 and user3

thanks a lot

nicola

(cross-post from SO question https://stackoverflow.com/q/79216331/2378095)

[Björn Pedersen]

Nicola Beghin schrieb am Freitag, 22. November 2024 um 20:21:17 UTC+1:

I'm trying to understand if Keycloak could be useful in this scenario.

1. user enters correct credentials
2. based on a given user attribute (ie. attributeX=xyz), Keycloak checks if any other user matches attributeX=xyz: ie. user1, user2 and user3
3. user is given possibility to proceed with login with one of the matched users user1, user2 and user3

thanks a lot

nicola

I don't think this is possible out of the box, as this is a restricted impersonate. The impersonate rights are currently always realm-scoped. One could maybe 

emulate this behaviour with a backend service that can impersonate and does your checking and  then uses token exchange to mint new tokens, but that would be 

rather demanding in get it correct security-wise.