Should login_hint work with a SAML authorize request? #49907

In Keycloak's SAML flow, a plain login_hint query parameter beside SAMLRequest is not what fills the username field.

The confusing bit is that the name is shared with OIDC behavior. In the OIDC authorization endpoint, login_hint is parsed as an authorization request parameter and copied into the authentication session. The SAML path is different: Keycloak decodes the SAMLRequest and builds the SAML auth session from that request. The comparable login-hint note appears to be set from a Subject/NameID inside the SAML AuthnRequest, not from the outer URL query string in the same way as OIDC.

So with a URL like:

/protocol/saml?SAMLRequest=...&RelayState=...&login_hint=ben@example.com

I would not expect Keycloak 26.3.0 to pre-fill the username field from that last parameter.

The practical choices are:

• if your SP can generate it and it fits your flow, put the intended user identifier into the SAML AuthnRequest subject/name ID;
• if login_hint query-parameter behavior is required, use an OIDC client for this login path;
• if this is only a local UX convenience, handle it with custom authenticator/theme behavior.

kc_idp_hint is separate: it hints which identity provider to use, but it should not be expected to pre-populate the username field.

If that matches your test result, selecting an answer here would make the SAML/OIDC distinction easier to find later.