Account: allow refusing removal of a user's last credential (passkey-only users can lock themselves out) #55110

Description

In a realm where users sign in with passkeys only (no password), a user can delete their only passkey from the account console and is then unable to sign in again.

In 26.8.2, AccountCredentialResource.removeCredential calls CredentialDeleteHelper.removeCredential, and its checkIfCanBeRemoved checks two things: that the credential type is removable (CredentialTypeMetadata.isRemoveable()), and that the current level of authentication is sufficient. It does not check whether the user would be left with no usable credential or identity provider link.

Value Proposition

Passwordless realms are increasingly common. A self-inflicted lockout needs an administrator to recover the account, and as far as I can tell no realm or client setting prevents it today, so the only workaround is a custom provider.

Goals

• An opt-in realm (or credential-type) setting that refuses deleting a credential when no other credential or linked identity provider would remain for that user.
• The same rule applied wherever a user can remove their own credential (the account REST endpoint and the delete_credential application-initiated action).
• A clear error that the account console can show.

Non-Goals

Changing the default behaviour for existing realms.

Discussion

No response

Notes

Found by reading the 26.8.2 source (services/src/main/java/org/keycloak/services/resources/account/AccountCredentialResource.java and services/src/main/java/org/keycloak/authentication/requiredactions/util/CredentialDeleteHelper.java). I have not yet reproduced it on a running server, and I have not checked whether the delete_credential application-initiated action goes through the same helper. I searched existing issues and did not find one for this; apologies if it is a duplicate.

Setup where this matters: a customer realm with Google as an identity provider plus passkeys, no passwords, Keycloak 26.8.2.