Repository navigation
|
Using quay.io/keycloak/keycloak:26.5.5. I have a SAML Identity Provider and OIDC (both) configured in Keycloak. The flow I want: I tried using an Identity Provider Post login flow with a conditional OTP flow: I also tried variants with OTP Form set to However, for a brand-new brokered user, the post-login flow fails before the user can complete the Configure OTP required action. The Keycloak logs show: If I set the Identity Provider Post login flow to None, first login works correctly: the user is created, Terms and Conditions are shown, Configure OTP is shown, and the user reaches the application. But then later logins through the external IdP do not get an OTP challenge. In Authentication->Required actions i have Configure OTP enabled and set as default action (both on). My question: Is there a built-in way in Keycloak 26.5.5 to express this logic for brokered logins? Any guidance on the recommended flow structure would be appreciated. |
Replies: 1 comment 1 reply
|
The post-login flow approach is right, but I think the conditional OTP subflow config needs tweaking. The problem is probably that "Condition - user configured" + "OTP Form" as Alternative means Keycloak skips OTP entirely when the user hasn't configured it yet — which is what you want for later logins, but for first login you need to force OTP setup. I think you need two separate subflows inside your post-login flow: Actually wait — the simpler approach that should work for both first and subsequent logins is to just use the That's it. The OTP Form execution handles both states (not-yet-configured → setup, already-configured → verify) internally. The conditional wrapper is only needed if you want to skip OTP for some users, which isn't your case. |
|
Thank you! I don't know how I didn't try this. 😄 In the end, I only have a single step in my post-login flow: (Execution) OTP Form Required |
The post-login flow approach is right, but I think the conditional OTP subflow config needs tweaking. The problem is probably that "Condition - user configured" + "OTP Form" as Alternative means Keycloak skips OTP entirely when the user hasn't configured it yet — which is what you want for later logins, but for first login you need to force OTP setup.
I think you need two separate subflows inside your post-login flow:
A…