fix: remove restart login flow for clients with multiple idps and allow sso #486
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SSO Across Clients with Shared IDPs:
Users can now perform Single Sign-On (SSO) across both single and multi-IDP clients. If a user is authenticated with IDP A on Client A, they can seamlessly access Client B using the same IDP A, provided that IDP A is allowed for Client B. This also applies to a case where Client A is single IDP and Client B is a multi IDP with one common IDP.
Session Handling for Clients with Distinct IDPs:
When switching between clients that use entirely different sets of IDPs (i.e., no shared IDPs), only the most recent Keycloak session is retained. The previous session is invalidated, effectively logging the user out of the earlier client.
Direct IDP Login via KC_IDP_HINT:
Using the KC_IDP_HINT parameter still enables users to bypass the Keycloak login screen and land directly on the specified IDP’s login page.