Custom email claim with keycloak (self-hosted)

[CosmicFlavour]

Hello,
I am currently trying to deploy Langfuse (EE) within our infra with Keycloak. I use the official helm chart (1.5.3) with the default docker images. I don't have access to the Keycloak configuration.

I am trying to customize the email claim as we would rather use a specific field from the keycloak profile as email in Langfuse. For example, our keycloak profile yields

• email: "user.name@company.com"
• otherField: "un1111111@company.com"

The point is to use "un1111111@company.com" as user ID because it's very important for us.

At the moment, I use the Keycloak SSO provider (AUTH_KEYCLOAK_* env variables) and it's not possible to customize the email claim.

I noticed this PR #5858 that allows just this with the custom SSO (env variable CUSTOM_EMAIL_CLAIM="otherField"). The thing is the custom provider (env variables AUTH_CUSTOM_*) does not work with Keycloak because of this error: "Unknown argument refresh_expires_in". I believe NextAuth has a special treatment in the Keycloak provider to prevent this error.

How should I proceed ? I am willing to make a contribution to the codebase but I don't know what would be the best approach or I I should just make a patch for our deployment but that's not really a long-term option.

Here is a very similar issue about custom scope for Keycloak provider: #9186

[Steffen911]

@CosmicFlavour I believe the change would we very similar to the one made in https://github.com/langfuse/langfuse/pull/5858/files. If you're willing to give this a shot, please create a PR, tag me, and I'd be happy to review it! 🙌

[CosmicFlavour]

Thanks for your reply. For the moment I don't see how the existing KeycloakProvider can modify the email claim as the custom SSO provider manages it but I can try.