Keyclaok E-mail Domain Authenticator

This project provides a custom authenticator for Keycloak that restricts user login based on their email domain. It ensures that only users with email addresses from specified domains can authenticate successfully.

Building the Project

To build the project, ensure you have Maven installed and run the following command in the project directory:

./gardlew clean jar

Usage

Copy the build artefact jar file from build/libs to the Keycloak folder /opt/bitnami/keycloak/providers. and restart keycloak.

Modify your authentication flow in Keycloak to include the "Email Domain Authenticator" as a required action.

Tested in first broker login flow. Before Keycloak creates the user, the authenticator checks the email domain.

Edit the configuration of the authenticator to specify the allowed email domains.

Docker / Kubernetes

Best practice for production is to build a custom Keycloak image including the authenticator.

A quick way to test it or for development, is to mount the jar file into the Keycloak container:

Steps:

1. Builde the jar file as described above
2. Create a ConfigMap from the jar file:

   kubectl create configmap keycloak-custom-jar  --from-file keycloak-email-domain-auth-1.0.0.jar --dry-run=client -o yaml > keycloak-custom-jar.yaml

3. Deploy and mount the ConfigMap and run a InitContainer that copies the jar file into the keycloak providers folder. Keep in mind that other authenticators might be present, so do not overwrite the folder but copy the jar file into it.