Simple keycloak authenticator to add an attribute from an http json API to an authenticated user. The idea was to get user info from another source than the configured user storage. For example, it can be used to fetch info from github API...

Build the jar :

mvn package

Copy it in $keycloak/standalone/deployments

Add the http user decorator to authenticator flow (:warning: you need to set it as required, so you will need to wrap the old authenticator config in a generic flow to set it both as required )

Don't forget to configure the new authenticator, for everything to work.

This authenticator adds an user attribute by requesting an http api. The user attribute is refreshed everytime the authenticator is used.

Let's say you want to retrieve information on your keycloak user from github (maybe to check their organizations or get their github avatar).

The github api publish an endpoint to search user by email here : https://api.github.com/search/users?q=email+in:email

In keycloak admin console, let's start by creating a new authtication flow with 2 executions :

• User Password form
• Http User decorator

The 2 executions are marked as Required, that way, we assure to execute both actions.

The Http User decorator is configured as follow :

And we leave the others fields empty.

Then when authenticating an user, their email adress is searched on github and if found, a new attribute github_login is created for this user.