Closed
Description
Before reporting an issue
- I have read and understood the above terms for submitting 85F2 issues, and I understand that my issue may be closed without action if I do not follow them.
Area
identity-brokering
Describe the bug
I have a scenario where users authenticate with an identity provider and have the option to skip verifying their email address for later. However, once they do, this email verification status is not detected by Keycloak because their email address technically did not change.
Version
26.2
Regression
- The issue is a regression
Expected behavior
The user's "Email verified" toggle should be set to the state last reported by an IDP with "FORCE" sync mode set.
Actual behavior
The "Email verified" state is unchanged, only updating if the user's email address changes.
How to Reproduce?
- Connect a Keycloak realm to another IDP (such as another Keycloak realm) with an OIDC identity provider type. The IDP should have the "Trust email" setting toggled On.
- Sign into the Keycloak realm as a user with an unverified email address on the connected IDP
- Toggle the user's email verified state to
trueon the connected IDP - Sign out, and sign into the realm again
- Observe that the user's email is still unverified on the Keycloak realm.
Anything else?
The change detection here needs to account for the state of the email_verified claim sent from the IDP!