Prevent username enumeration while registering a user in keycloak

190 views Asked by At

I'm currently working with Keycloak version 16.1.1. During user registration, if an email that is already present in the database is entered, keyclaok generates an "email_in_use" error. I aim to modify this behavior. Specifically, when a user attempts to register with an email that already exists, I want to redirect him to the successful registration page. On this page, the user will be prompted to click a link sent to his email inbox for verification.

in the registration flow, I created a copy of the registration flow where I replaced the "Profile Validation" execution with a new ProfileValidationIgnoreEmailInUse execution.

public class ProfileValidationIgnoreEmailInUse implements FormAction, FormActionFactory {
@Override
    public void validate(ValidationContext context) {
    // copied the same code as org.keycloak.authentication.forms.RegistrationProfile, but I modified the email check part
    ...
    if (emailValid && !context.getRealm().isDuplicateEmailsAllowed() && context.getSession().users().getUserByEmail(email, context.getRealm()) != null) {
            logger.infof("TTEST skipped error email in use");
        }
    ... 
    }
}

Now when the user enters an existing email in the register form, I get a new error: ConstraintViolationException: could not execute statement at org.keycloak.storage.UserStorageManager.addUser(UserStorageManager.java:247) which is normal because the username already exists in the database. What would be the next change I have to make in order to ignore this ConstraintViolationException exception?

0

There are 0 answers