Repository navigation
Phone number verification and building blocks for SMS/voice #53306
ryan-morris
started this conversation in
Ideas
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I've looked through a bunch of the conversations around SMS/phone support and put together what I think brings basic support into Keycloak without becoming a maintenance nightmare.
The focus of what I am proposing is verifying phone numbers, but the pieces are also the building blocks people keep asking for: with a verified number and a way to reach it, extensions can do SMS/voice OTP, phone-based sign-in or security notifications without each one building delivery and verification itself.
1. Reset
phoneNumberVerifiedwhen a user changes their number:I have opened Issue #53019 and PR #53020.
See the issue for details, but it boils down to treating phone number verification the same way as email verification. Due to limitations in what extensions can hook into, this needs to be built in to be reliable.
Related: #25379, #25305, #25341
2. A phone message sender SPI and a
VERIFY_PHONE_NUMBERrequired action:Current work is in this branch
Senders are configured per realm, similar to SMTP. Keycloak itself ships no sender, so Twilio, Azure, in-house gateways etc. stay as extensions. A realm can have a text sender and a voice sender, and the user picks one. The required action is modeled on
VerifyEmailand is disabled by default. Having the SPI available is what opens the door or at least allows for better extension/plugin support around things such as security notifications (for example, "a new sign-in to your account"), SMS or voice-call MFA, and phone-assisted sign-inRelated: #37848, #32009, #52361, #49606
3. I've also built a Phone OTP Form authenticator on top of 1 and 2:
Current work is in this branch.
It's a second step that sends a code to an already verified number, by SMS or voice. I think it
has value in core, but given the security debate I've kept it separate from verification.
Related: #27152, #43649
If piece 1 + 2 both get merged, I believe better handling of phone number formats and input, particularly the E.164 format, would be worth visiting as well.
I'm open to any suggestions or other ideas. I've tried to keep piece 1 and 2 as minimal and generic as possible and easily extended via plugins for things like the OTP Form authenticator or Phone based login while a firm decision is made on if features like that belong within Keycloak itself.
All reactions
Replies: 0 comments