Advanced Topics

Advanced Topics

Using the Scoutnet member number as sub

By default, ScoutID assigns each user a Keycloak-generated UUID as their sub (subject identifier). This is stable and unique, but opaque — you cannot predict it before a user first logs in.

Some applications need a predictable identifier, for example to pre-populate user records from Scoutnet data before anyone has logged in, or to correlate users across systems that already know member numbers. In these cases, you can request a mapper that substitutes the Scoutnet member number as sub.

When requesting your client, mention this requirement. The mapper will be configured on your client's dedicated scope and sets scoutnet_member_no as the sub value in the ID token, access token, and userinfo endpoint.

Caveat: If you later want to support additional login methods (e.g. Microsoft login), a member-number-based sub can cause problems since those identities do not have a Scoutnet member number. Consider this tradeoff before requesting the mapper.

Microsoft login via kc_idp_hint

Microsoft is configured as an identity provider in ScoutID but is hidden from the default login screen. It can be activated for a specific login flow by passing kc_idp_hint=microsoft-scouterna-dev as a query parameter in the authorization request:

https://dev.id.scouterna.se/realms/scoutnet/protocol/openid-connect/auth
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=openid
  &kc_idp_hint=microsoft-scouterna-dev

This skips the ScoutID login screen and sends the user directly to Microsoft's login page. It is useful for services used by organisations that already manage their members via Microsoft accounts.

Note: If your client uses the member number as sub (see above), Microsoft-authenticated users will not have a Scoutnet member number and this combination will not work correctly.