search

keycloak / keycloak

Open Source Identity and Access Management For Modern Applications and Services
https://www.keycloak.org
Apache License 2.0
23.06k stars 6.71k forks source link

Verification link via Email for External IDP Account Sync not working in 23.0.1 #25310

Closed rawllopes closed 10 months ago

rawllopes commented 10 months ago

Before reporting an issue

Area

identity-brokering

Describe the bug

If a user is already added to keycloak, and when that user's email domain is synced with External SAML IDP, and when the user tries to login to the configured client (application), he is asked to confirm the account linking when he click on Add to existing account. image

When the user clicks on this button the user will receive an email with a link to verify the account linking image

When the user click on this link to verify the account linking server responds with 500 Error. image

This is working fine in 22.0.1

Version

23.0.1

Expected behavior

User should be able to verify the link and should get redirected to the configured client (application) configured with keycloak

Actual behavior

Verification link received via email is not working. The link responds with 500 server error

How to Reproduce?

  1. Add a user in keycloak
  2. Configure the users email domain for any external IDP (SAML Jumpcloud)
  3. Login the user account from configured client application.
  4. The user will be redicted to external IDP for login and post successful login will be redirected to the client application.
  5. The user will see 2 options Review profile and Add to existing account.
  6. Once the user clicks on add to existing account, he will get an email with verification link.
  7. Click on the link to check the defect.

Anything else?

No response

rmartinc commented 10 months ago

I could not reproduce your error with 23.0.1 or current main branch, I have repeated the reproducer steps. Is there any error or log when you receive the error 500?

rawllopes commented 10 months ago

Hi @rmartinc,

I checked the logs. Looks like there was an issue with the custom IDP mapper that I've written.

I had to make some changes to that and it worked.

Just the overlap between upgrading to 23 and working on custom IDP mappers caused the confusion.

We're good to close this or mark it invalid.

rmartinc commented 10 months ago

Thanks for checking @rawllopes! Closing then the issue.