Repository navigation
Replies: 3 comments 1 reply
|
@mposolda could you take a look at this one? |
|
When an Authenticator is set to "Alternative" the code at DefaultAuthenticationFlow.java#L425 doesn't call |
|
I'd love to see how to do this, as well. Our users hope to log in with either OTP or WebAuthn, with recovery codes as a fallback. When I logged into github just now to post this comment, my much-abused USB security key didn't work, and conveniently, github had a set of links ready for me to choose SMS or OTP as alternative second factors. I'd like to do something like that, and don't see how. |
|
My plan as it stands now, with inspiration from this post, is to have "recovery authentication codes" as a default required action for the realm, and to modify the default browser authentication flow to disable the "Condition - user configured" preceding "OTP Form", to change "OTP Form" to "alternative", and to add "WebAuthn authenticator" and "Recovery Authentication Code Form" as additional alternatives in that subflow. This results in my 21.0.1 installation in the user being prompted to use OTP, WebAuthn, or Recovery codes. The system selects the first one of those factors that's configured for the user, and presents them with a link to "Try another way", which lets them choose a different factor instead. I don't have a good way yet for users to choose whether they prefer OTP or WebAuthn, but I expect in our case that administrators will be able to know when they create a new user which of the two is most appropriate, and to add to the user the proper required action to configure the user's choice of second factor. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We want to have step-up two-factor authentication, so that
The following authentication flow works fine, as long as the user has pre-setup the factors via Account UI.
With this flow and URL param acr_values=2 the following happens, depending on already existing configuration of TOTP and Recovery Codes at the user:
What is needed: Setup of TOTP and Recovery codes should be completed in any case.
Is there some other flow setup which enforces initial configuration of both factors on first use AND allows the user to select the factor on login?
If not, would it be an option to make the "OTP Form" executor and "Recovery Authentication Form" executor configurable? (So that configuration can be set to "required" / "not required" and isn't purely depending on Alternative/Required setting at authentication time?)
Related question:
All reactions