Failed authentication: java.lang.IllegalStateException: Magic links not allowed for master realm

[p2-inc]

Failed authentication: java.lang.IllegalStateException: Magic links not allowed for master realm

[xgp]

Magic links are not allowed for the master realm. It was deemed too dangerous, given that you can make and distribute a token that will log you in to master with admin privileges. If you want to use this, try it in another realm.

[xgp]

So you consider magic links as unsafe to use?

No, that is an incorrect and overly broad generalization. I was very specific. Magic links are not allowed for the master realm. That is a design decision we made.

We consider magic links and this library safe to use, for most use cases. However, we decided not to allow them for the master realm because of the possible permissions that can be associated with the token.

If you would like to use this library for creating tokens to log into the master realm, fork this library, and remove this section https://github.com/p2-inc/keycloak-magic-link/blob/main/src/main/java/io/phasetwo/keycloak/magic/MagicLink.java#L191

Can users share the token, also do the not expire?

Please try this sentence again. It doesn't make sense.

• Magic links can be created via the REST resource or sent to an email address. So, by definition, they can then be shared.
• Magic links expiration and reuse are configurable. Please see the config page in the admin UI.

[Martin-Andersen]

So you consider magic links as unsafe to use? Can users share the token, also do the not expire?