nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to separate SSO users from different sites?

Alvaro Gonzalez

I maintain a set of web applications that use a centralised SSO server (Red Hat SSO / Keycloak for what it's worth). Each application has its own subdomain:

But login form is displayed in a different subdomain that's common to all apps, and you can only tell them apart from a URL parameter:

As a result, I have to pick credentials from a huge list that includes every site users, which often share the same username (my email). This is further aggravated by the fact that user and password are typed in different pages.

Setting the full login form URL in vault item does not work (I guess only domain portion is considered).

I also went to "Account Settings/ URL Rules" to add some items, but neither "Host: auth.example.net:8080" nor "Host: auth.example.net" seem to make any difference, nor does leaving "Path" empty or setting it to "/auth/realms/ADMIN/protocol/openid-connect/auth?client_id=admin", etc.

Is there an arrangement I can do so LastPass only shows matches for the app I'm signing in, or it's an unsupported scenario?

Find more posts tagged with

Accepted answers

Alvaro Gonzalez

Please add support for this. Single sign-on is becoming increasingly popular. As it's now, there're tons of usability issues:

You're offered irrelevant users to pick from.
You cannot type to filter because it types in the password field.
You cannot use the search feature because it searches in your entire vault.
After logging in, you're always asked to update the password of a random user in a dialog you need to dismiss manually

All comments

LastPass Support

Hello @Alvaro Gonzalez,

My name is Henry and I am happy to assist with your inquiry, and appreciate you contacting LastPass Support!

I am sorry about the issue you are having. This issue should be resolved if you setup a URL rule. This would make the extension to only provide the credentials with the URL that matches exactly for each site.

Thank you,

Henry | Customer Care

Alvaro Gonzalez

Hi, Henry. Thank you for your response but, as can you read in my original post, I already tried a few URL rules to no avail. How should the rules be?

Alvaro Gonzalez

Is there additional information needed? Is there a bug, or perhaps the feature is not supported?

Alvaro Gonzalez

Please add support for this. Single sign-on is becoming increasingly popular. As it's now, there're tons of usability issues:

You're offered irrelevant users to pick from.
You cannot type to filter because it types in the password field.
You cannot use the search feature because it searches in your entire vault.
After logging in, you're always asked to update the password of a random user in a dialog you need to dismiss manually