Hello,
I am new to Keycloak and the whole IAM world. I have a simple configuration of Keycloak that has different users and a client.
The users all have their respective email. However the client app only has one account and it has to stay with one account, so there is only 1 email address acceptable to connect with SSO.
The client makes the connection in SAML and request only the email address, so X500 email is configured in the client scope mapper.
With an account that has the email address attribute configured like the client’s account, connection works.
I would like to be able to connect to this client with different users by providing this email address instead of their own.
I have tried creating a new role in this client that has an attribute ‘email’ with the value of the address in order to overwrite them. And assigning this role to a user then.
But It’s not working and I can’t seem to understand the logic of it.
I am using the UI only by the way.