Repository navigation
Replies: 2 comments 3 replies
|
If I understand the process correctly, when authenticating Keycloak evaluates the rules in the flow top to bottom, going into sub-flows when applicable. Because of this, if you want to use OTP as the primary authentication option, you indeed need to add it first. However, the order applies per flow, so any client that uses the flow will follow the same steps. You cannot set a flow per user, they can be individual for each client at most. I do not understand what you mean by changing the order for multiple users. The flow above should prioritize OTP for all users - please note that the flows requirements are a bit awkward, in that Keycloak will look at all alternatives to see if they can be satisfied (i.e., OTP or password is set) and only display the options that have been set up. I think that if an user has set their password, but not the OTP token, the password is seen as a valid authentication option, and during the authentication only the password is requested. Since both the OTP and the password options are set to required, but inside alternative sub-flows (and one of the alternatives can be satisfied), the OTP would have to be manually configured in the account or admin consoles. |
When you only have one of the credentials setup (whether that's OTP or password), it will favor the one that is actually valid. I've attempted both "No Password/OTP" and "Password/No OTP" and their behaviors are consistent with what you mentioned. Keycloak will end up favoring the one that is actually valid. I agree that the flow should prioritize OTP for all users, but unfortunately it does not. I've also been able to reproduce it in a simpler version where OTP and Password are both alternatives without the additional sub-flows in between. I was only able to see the behavior I expected after re-ordering the user's credentials based on that StackOverflow post. If you edit a user's credential ordering, it changes the default authentication flow that is shown after the user enters their username. It's very easy to replicate this behavior in the latest version of Keycloak, but I have not checked to see if that behavior is consistent in older versions. |
|
I think it should prioritize OTP, but it must be configured. Otherwise it is simply not valid, so there is nothing to prioritize. You may be able to use a required user action to make the users configure their OTP (if there is one), in which case the OTP can become the first option, as expected. However, if Keycloak chooses to honor the order of the credentials in the user's account, it could just be a case where the backend anticipated the need to allow users to configure their preferred authentication methods, but the account console did not keep up. On a side note, while it may suit your needs, do bear in mind that OTP is usually not a very strong alternative to a password, and is normally used to complement it. WebAuthn (FIDO) tokens are much better replacements, although quite expensive. |
|
A bit late to the game, but I just figured this out. The default credential ordering is dictated by the ordering of the Required Actions. If you reorder them in your Realm Authentication settings then force the required actions on your user, they should add credentials in your desired order
|
|
The workarount does not seem to work for me with Keycloak 26. Despite having: |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Whenever I try to use my login flow where I can use either OTP or Password, it always favors password even though I placed OTP as the first alternative in the authentication flow (see image below).
I stumbled upon this post on StackOverflow, which mentioned that the option you're given is based upon the ordering of the credential when editing a user in the administrative console.
After changing the credential order to use OTP first, then password, I was able to get the option of OTP first when using the above authentication flow. However, this means in order to do this for multiple users, all of their credential orderings would need to be modified by the administrative console. I looked in the accounts page for users and noticed you can't modify the credential ordering there either.
Does anyone know how to set the credential ordering to prioritize OTP over all other options, if available? So far from looking at the code, it seems like there's no way to particularly change it outside of using the administrative console.
All reactions