Is it possible to add more than one email per user in Keycloak?

user_8235367 0
Viewed 3233

I'm using Keycloak for Identity Brokering through Google, Microsoft, etc. But Keycloak only allows one email per user. So the user can be authenticated only through one of the social login options (Google if gmail is added as user's email address, etc.). Is there any way to include more than one email per user, or any other workaround?

EDIT: (Editing based on comments to make scenario more clear)

In my scenario, I'm using a federated user store which contains a large number of users and and I need Keycloak to access all the emails linked to a user when that user is logging in using Google,Azure,etc. because Keycloak is using the email as the unique identifier for the authentication response from the social login provider. Without having the required email as the main email, Keycloak won't allow that user to log in through social IdP

keycloak
2 Answers

Although, Keycloak emphasises on keeping a unique email,but there are certain scenarios where you may want to keep , say, secondary email.

This can be achieved in a couple of steps:

1. Add a custom attribute for secondary email in user like this:

enter image description here

2. Next , in your client create attribute mapper like this:

enter image description here

When I generated the token after above configuration, the new attribute was avialble in token. You can use this attribute in your app as you desire.

Parsed JWT:

enter image description here

user_24588580

I figured out the best way to deal with this is through the custom user provider (federated user store). Even though we can't add multiple emails per user through the Keycloak admin console, we can write the user provider in such a way that it can get all the emails linked to a user from our database and assign them to the email attribute of each user. Once this is done, all the emails will appear on the admin console as well.

For the social login to recognize those emails, we have to get all the emails linked to a user in the provider to an array and iterate through it until the authentication is complete. This would help to create the social login link to the user through First Login Broker authentication flow.

This is a crude way to approach this, but nevertheless it works!

user_82353670
Related