Provide ability to set client suggested identity provider

[abstractj]

What:

Keycloak allows to pass client suggested identity provider
https://www.keycloak.org/docs/latest/server_admin/index.html#_client_suggested_idp
It's a great feature which helps to specify exact IDP needed for specific client.

Keycloak Gatekeeper doesn't support passing of this parameter as of now (couldn't find it in docs).

There could be two options:

1. Add kc-idp-hint as a configuration option, so that gatekeeper can set it's own suggested idp.
2. Allow passing query parameter to the Gatekeeper such as ?kc_idp_hint= which would open desired idp.

One doesn't exclude another so it can support both.

Reference:

• KEYCLOAK-11499 - [keycloak-gatekeeper] Provide ability to set client suggested identity provider
• [KEYCLOAK-11499] Add idp-hint as a configuration option #495

[rickyschechter]

I support this request big time, I strongly need this.
Both the options mentioned above would at least allow me to configure (docker swarm stack) 1 gatekeeper per idp and in my opinion it is much better than having to add one keycloak realm per idp (using the "Identity Provider Redirector" defaulting to such idp.
Today for that I (attempting to implement) the following config instead: "--discovery-url=http://keycklock-url.com:7000/auth/realms/realm-alias" (instead of master) for each idp. (Having now trouble with the multiple realms different public keys)

I was thinking that even a better idea would be for gatekeeper to capture the kc_idp_hint from the original url request to it and so then I can have ONLY 1 gatekeeper configured.

Thoughts?

Thank you!

Ricky

[abstractj]

@rickyschechter would you like to give this PR a try #495 to see if it covers what you need? It's still incomplete and it requires more testing, but you are welcome to provide some feedback there.

[c0rmichels]

Any progress on this ? I am very interested in this feature.

[laurent-r]

Hi @c0rmichels
As far as I know, the louketo project is no longer maintained and you may have a look at https://oauth2-proxy.github.io/oauth2-proxy/