Repository navigation
Use e-mail address in label of OTP key URI #16190
StanRaskin
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello everyone
The current implementation of the "Update OTP" required action always uses the realm's display name and the user name as the label in the otpauth-URI. This is hard-coded in
OTPPolicy#getKeyURI:OTPPolicy.java#L150-L160
In some of our relams, we allow users to log in using the email address. At the same time, the email address is not used as the user name. Instead, the user names are issued automatically (mostly as a UUID) and are unknown to the user.
This leads to the issue, that when setting up OTP in one of these realms, labels displayed in the authenticator app are not intelligible to the users. It would rather be expected to display the e-mail address there. Here is an example from my Microsoft Authenticator app:
In the current implementation, there seems to be no extension point to change this behaviour.
I will happily submit a pull request with a solution.
My most naive approach would be to to modify
OTPPolicy#getKeyURIin such a way that it uses the email address in the label ifrealm.isLoginWithEmailAllowed()==true && realm.isRegistrationEmailAsUsername()==falseapplies. To my understanding this should have no adverse effects.Of course, more elaborate solutions are imaginable, but would be significantly more intrusive.
All reactions