Skip required action, if user was impersonated

Getting advice
1

Hi,

I am creating a custom RequiredActionProvider.
In evaluateTriggers I have a logic which decides, if required action should be added to the user.
This works fine, and required action gets executed when user logins.
Also have a flow, when “administrator” can use impersonation option, and in this case, Required action should not be attached to the user.
But I am not able to build this condition.

What, in theory, I can check, it is notes on UserSession, but I do not have active UserSession in RequiredActionContext, at least I do not know how to reach it.

I was able to find a proper session from KeycloakSession.session(),getUserSessionsStream(realm, user) method results, but it is just a stream, and all I know, that such session exists, and no guarantee that is my current session.

Can you advice me, how I can approach “impersonation” detection in RequiredAction ?

2

You got any solutions?

3

In the RequiredActionContext, you have access to the AuthenticationSessionModel, which allows you to get auth, client, and user session notes: AuthenticationSessionModel (Keycloak Docs Distribution 24.0.1 API)