Keycloak 2FA enrollment

[mixman68]

Hello,

I try to create a browser flow with this conditionnal

• If PKI presented => authenticated
• If User/password => if user has force_otp role => ask for OTP or WebAuthN => Authenticated

I can do this with success, but if my user has no OTP or WebAuthN key registered, the flow fails with credentials error.

How I can ask user for register OTP or WebAuthN if nothing is configured ?

Thanks you

[markusmoormann]

Hi,

we had some similar requirements, so I build a custom Required action that let's the user select which device (OTP or Webauthn) he want's to register, when he doesn't have any at login time. Currently there is still the issue that you cannot change your choice. But maybe this still can help you: https://gist.github.com/markusmoormann/9a346bc2df77d796984075acb0a48961

[markusmoormann]

thanks a lot. That looks promising

[markusmoormann]

@sventorben I've tried your code but I cannot see any possibility for the user to reset the login flow after selecting the 2nd factor. Am I missing somthing?

[sventorben]

There is no logic, besides the one Keycloak offers out of the box. You can simply open a new browser window and start all over again, because the required actions are configured per authentication session and not per user.

[markusmoormann]

Do you know whether one could activate the cancel button. Something like when you manually add a 2nd factor? For a non technical user (which we have a lot of) it's not obvious he has to open a new browser window.

[sventorben]

Tough one. Technically it should be possible to do so. It should only be a link like loginRestartLink in login-page-expired.ftl

However, the authenticator is basically setting a required action for the authentication session. As the name already suggests, that action is required. Cancelling a required actions does not really make sense besides in the case we are just discussing.

[sventorben]

for reference see also #17092

[mixman68]

HelloI don't know how build the jar with Kotlin fileI never do this except for themesI tried the same way but with no successLe 22 févr. 2023 à 07:30, Markus Moormann ***@***.***> a écrit : Hi, we had some similar requirements, so I build a custom Required action that let's the user select which device (OTP or Webauthn) he want's to register, when he doesn't have any at login time. Currently there is still the issue that you cannot change your choice. But maybe this still can help you: https://gist.github.com/markusmoormann/9a346bc2df77d796984075acb0a48961 —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>