We're using an online service platform that uses the email address as the unique identifier. The challenge we're facing is that we need two separate instances on the platform (to prevent information from one side "leaking" to the other side) ... but there are some staff (e.g. Finance) that need to be able to access both instances.
Since the email address is the unique identifier, one option is to simply get the users on one of the instances to log in with a "+1" in their email address, e.g. fred.flintstone+1@bedrock.org. That requires them to remember that, though, so it occurred to me that we could use Google SSO for one instance and Keycloak SSO for the other instance.
Except that the email address is the unique identifier not some GUID value ... and both Google and Keycloak will return the same email address.
So now I'm thinking whether a Javascript mapper could be written for the client configured in Keycloak so that it "hacks" the email address to insert "+1" when that is returned as the NameID attribute.
I'm not sure if that is viable, though. Looking at the SAML response, the NameID attribute looks more complicated than just a simple attribute value.
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">fred.flintstone@bedrock.org</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData InResponseTo="_81df8d37-0690-4cc9-9460-f5d75dcb6b06" NotOnOrAfter="2022-09-17T09:52:43.706Z" Recipient="REDACTED"/>
</saml:SubjectConfirmation>
</saml:Subject>
I was wondering whether I could just get the mapper to "overwrite" the mail attribute but I'm not sure if the code that builds the NameID attribute in the SAML response would use that mapped value.
I know that the "simple" answer is to only require "+1" accounts for those (few) people who do need access to both instances but, knowing people, I think it would be clearer to say "Click on the Google button for this instance and the Keycloak button for this instance". So I do at least want to see how far I can get in trying to override the NameID response.
Any suggestions or guidance gratefully appreciated :)