Repository navigation
AMR Support for OAuth Tokens
#23267
Replies: 1 comment
|
Any news here? The feature is still desirable. My use-case is that I want to authorize only users that, e.g. used 2fa or biometrics while authenticating |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Description
I work at MITRE and for one of my projects, I developed a reference implementation for authentication method reference (AMR) values in OIDC tokens that we are interested in incorporating back into the Keycloak source.
Motivation
Our sponsor requires the ability to make authorization decisions based on the authenticators used during authentication. The claim used to convey this information is documented in RFC 8176 (https://www.rfc-editor.org/rfc/rfc8176.html). There is currently no way to extract the completed authentication executions from a user session and therefore, its not possible to populate an AMR claim with the required information.
Implementation
The implementation requires 2 pieces of information that is not currently available:
To track completed executions I propose setting a user session note in the authentication flow handler code during a successful result from the authentication processor.
Authenticator executions already have the ability to store configurations, however, this configuration is only utilized for some authenticators. An "Authenticator Reference" value can be stored as part of that configuration. To reduce the impact to the existing code base and ensure compatibility with existing authenticators, the admin UI can be modified with a default set of configurations added to all authenticators. This enables all existing authenticators to utilize this change without modifying the authenticator execution model.
The completed executions can then be easily mapped to the configured authenticator reference values using an OIDCProtocolMapper and set in the AMR claim.
All reactions