Search code examples
keycloakfreemarker

Keycloak use IdP display name instead of alias in templates

The Identity Provider Link email template uses the "alias" of an identity provider (identityProviderAlias) as one of the variables into the email body. I'd prefer to use the IdP's "display name".

I tried identityProviderDisplayName, but that printed null.

My IdP alias is something like "company-prod-sso", and the display name is "Company SSO"

Update:

I've now also tried to use the identityProviderContext as follows: identityProviderContext.getIdpConfig().getAlias() returns the same thing as identityProviderAlias (except not capitalized). identityProviderContext.getIdpConfig().getDisplayName() returns null. Using it like this:

${kcSanitize(msg("identityProviderLinkBodyHtml", identityProviderContext.getIdpConfig().getDisplayName(), realmName, identityProviderContext.username, link, linkExpiration, linkExpirationFormatter(linkExpiration)))?no_esc}

Thanks to @jan-garaj for pointing to the code that adds the alias and brokerContext variables to the template attributes.

Second Update: Ok, apparently the social providers (which I was using in my test environment) don't have display names. The above approach does work when a display name is defined. I've added an answer below.

Solution

  • The brokerContext (available as identityProviderContext in the theme) has a path to the display name, but the display name is optional for some providers, and just not available on others (GitHub social provider, for example).

    I've updated the identity-provider-link.ftl by replacing the original parameter identityProviderAlias to:

    identityProviderContext.getIdpConfig().getDisplayName()!identityProviderAlias

    That will use the display name in the body, if available. Otherwise it defaults to the original alias parameter.

    I also created an enhancement request to make the display name available to the email subject, which doesn't use a template. https://issues.redhat.com/browse/KEYCLOAK-16380