https://daniiiol.github.io/tags/identity-brokering/Recent content in Identity Brokering on dan///olHugoenFri, 04 Sep 2026 00:00:00 +0000https://daniiiol.github.io/posts/2026-turning-federated-claims-into-user-input-a-keycloak-misconfiguration-story/Fri, 04 Sep 2026 00:00:00 +0000https://daniiiol.github.io/posts/2026-turning-federated-claims-into-user-input-a-keycloak-misconfiguration-story/<p><img src="https://daniiiol.github.io/images/posts/2026-keycloak-example_update-cover.png" alt="Keycloak Postcover Image"></p> <p>I only recently discovered this behaviour in a Keycloak installation. Once I knew what to look for, I noticed that the same feature had been misconfigured in several other places.</p> <p>Add one parameter to an otherwise normal OpenID Connect login request:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">kc_action=UPDATE_PROFILE </span></span></code></pre></div><p>Log in through the configured identity provider and before returning to the application, Keycloak presents an <strong>Update Account Information</strong> page. Sometimes it only contains first and last name. On other installations it also contains the email address and additional attributes.</p>